From 546eaed7b7d9bfc71bd2c6ef5e1335c5e4328761 Mon Sep 17 00:00:00 2001
From: olalikeola <78701501+olalikeola@users.noreply.github.com>
Date: Mon, 1 Dec 2025 17:37:37 -0500
Subject: [PATCH 01/80] flter out ignored alerts

---
 socketsecurity/core/__init__.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index fd8774e..0d4e2ac 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1317,8 +1317,14 @@ def add_package_alerts_to_collection(self, package: Package, alerts_collection:
                 url=package.url
             )
 
-            if alert.type in self.config.security_policy:
+            # Use action from API (triage) if present, otherwise fall back to security policy
+            action = None
+            if hasattr(alert, 'action') and alert.action:
+                action = alert.action
+            elif alert.type in self.config.security_policy:
                 action = self.config.security_policy[alert.type]['action']
+            
+            if action:
                 setattr(issue_alert, action, True)
 
             if issue_alert.key not in alerts_collection:

From 8d7944dc998b9384c0ccb7b3c849f59700508b1b Mon Sep 17 00:00:00 2001
From: olalikeola <78701501+olalikeola@users.noreply.github.com>
Date: Mon, 1 Dec 2025 18:28:46 -0500
Subject: [PATCH 02/80] pr comments + version bump

---
 pyproject.toml                  |  7 ++++++-
 socketsecurity/__init__.py      |  2 +-
 socketsecurity/core/__init__.py |  7 ++++---
 uv.lock                         | 22 +++++++++++++---------
 4 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index a167d1c..2816533 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.40"
+version = "2.2.41"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -160,3 +160,8 @@ docstring-code-line-length = "dynamic"
 
 [tool.hatch.build.targets.wheel]
 include = ["socketsecurity", "LICENSE"]
+
+[dependency-groups]
+dev = [
+    "pre-commit>=4.3.0",
+]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 58461e0..37e5777 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.40'
+__version__ = '2.2.41'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 0d4e2ac..e407446 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1317,10 +1317,11 @@ def add_package_alerts_to_collection(self, package: Package, alerts_collection:
                 url=package.url
             )
 
-            # Use action from API (triage) if present, otherwise fall back to security policy
+            # Use action from API if present (label policy, triage, etc.), 
+            # otherwise fall back to security policy
             action = None
-            if hasattr(alert, 'action') and alert.action:
-                action = alert.action
+            if 'action' in alert_item and alert_item['action']:
+                action = alert_item['action']
             elif alert.type in self.config.security_policy:
                 action = self.config.security_policy[alert.type]['action']
             
diff --git a/uv.lock b/uv.lock
index 205aec0..529ab6c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1052,28 +1052,26 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.17"
+version = "3.0.21"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/47/60/54b56ac179a9c89b2c9f2ab7eb5ba81220de64d11d52cf19249113ff364d/socketdev-3.0.17.tar.gz", hash = "sha256:a4446a84856c637c312d809d5b8deb25dd20ca38ae7d00a4c8104ea5b890c0af", size = 134013, upload-time = "2025-11-07T22:38:34.354Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/33/fb/4669dcd763144f7ebba824562b58648be08f93474ce12fbe3e21836e622f/socketdev-3.0.21.tar.gz", hash = "sha256:c5fe8bdba8c2c114e3bfff9f5f3a4224eca5c85f86a68f68dda8a2d3fea26815", size = 134528, upload-time = "2025-11-27T17:27:09.608Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/98/56/34ab0e33b5345ca7ada68cd0a9e9d4adcde16051192eb10f8e2c3e0deaa1/socketdev-3.0.17-py3-none-any.whl", hash = "sha256:0986ee0694d5ce879cadb8e06fcfb75a4ca2dfb6f415414593825701593cf991", size = 59317, upload-time = "2025-11-07T22:38:32.704Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/40/2974cca90077b861206e8f402571047ac074f6233c524eb88e8ee9323ecc/socketdev-3.0.21-py3-none-any.whl", hash = "sha256:39a85991445a4a37b0a3bc05138d5799cefc3185b77177fdb1e0d9a2ed81fd08", size = 59698, upload-time = "2025-11-27T17:27:07.696Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.26"
+version = "2.2.40"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
     { name = "gitpython" },
-    { name = "hatch" },
     { name = "mdutils" },
     { name = "packaging" },
-    { name = "pluggy" },
     { name = "prettytable" },
     { name = "python-dotenv" },
     { name = "requests" },
@@ -1096,15 +1094,18 @@ test = [
     { name = "pytest-watch" },
 ]
 
+[package.dev-dependencies]
+dev = [
+    { name = "pre-commit" },
+]
+
 [package.metadata]
 requires-dist = [
     { name = "bs4", specifier = ">=0.0.2" },
     { name = "gitpython" },
-    { name = "hatch", specifier = ">=1.14.1" },
     { name = "hatch", marker = "extra == 'dev'" },
     { name = "mdutils" },
     { name = "packaging" },
-    { name = "pluggy", specifier = ">=1.6.0" },
     { name = "pre-commit", marker = "extra == 'dev'" },
     { name = "prettytable" },
     { name = "pytest", marker = "extra == 'test'", specifier = ">=7.4.0" },
@@ -1115,12 +1116,15 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.17,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.21,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]
 provides-extras = ["test", "dev"]
 
+[package.metadata.requires-dev]
+dev = [{ name = "pre-commit", specifier = ">=4.3.0" }]
+
 [[package]]
 name = "soupsieve"
 version = "2.8"

From 6d8a90a19a0bbf25212544615b46ab578deb80fb Mon Sep 17 00:00:00 2001
From: olalikeola <78701501+olalikeola@users.noreply.github.com>
Date: Mon, 1 Dec 2025 18:44:41 -0500
Subject: [PATCH 03/80] remove the need for getting the security policy

---
 pyproject.toml                  | 2 +-
 socketsecurity/__init__.py      | 2 +-
 socketsecurity/core/__init__.py | 8 +-------
 uv.lock                         | 2 +-
 4 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 2816533..00750ad 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.41"
+version = "2.2.42"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 37e5777..d5122b8 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.41'
+__version__ = '2.2.42'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index e407446..f72f7ec 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1317,15 +1317,9 @@ def add_package_alerts_to_collection(self, package: Package, alerts_collection:
                 url=package.url
             )
 
-            # Use action from API if present (label policy, triage, etc.), 
-            # otherwise fall back to security policy
-            action = None
+            # Use action from API (from security policy, label policy, triage, etc.)
             if 'action' in alert_item and alert_item['action']:
                 action = alert_item['action']
-            elif alert.type in self.config.security_policy:
-                action = self.config.security_policy[alert.type]['action']
-            
-            if action:
                 setattr(issue_alert, action, True)
 
             if issue_alert.key not in alerts_collection:
diff --git a/uv.lock b/uv.lock
index 529ab6c..42ca82d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1065,7 +1065,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.40"
+version = "2.2.41"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 69da876fa8dcec15730635daa53b19883a9e88ea Mon Sep 17 00:00:00 2001
From: Douglas Coburn <douglas@dactbc.com>
Date: Mon, 1 Dec 2025 22:44:04 -0800
Subject: [PATCH 04/80] Removed Security Policy logic completely as it is no
 longer needed

---
 README.md                             |  2 +-
 pyproject.toml                        |  2 +-
 socketsecurity/__init__.py            |  2 +-
 socketsecurity/core/__init__.py       | 12 ----------
 socketsecurity/core/messages.py       |  6 ++---
 socketsecurity/core/socket_config.py  |  8 -------
 tests/core/conftest.py                | 12 +---------
 tests/core/test_package_and_alerts.py | 33 ++-------------------------
 tests/unit/test_config.py             | 13 +----------
 9 files changed, 10 insertions(+), 80 deletions(-)

diff --git a/README.md b/README.md
index 8b09ea5..6dd5d1b 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Socket Security CLI
 
-The Socket Security CLI was created to enable integrations with other tools like GitHub Actions, GitLab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts against the Socket security policy it'll exit with a non-Zero exit code.
+The Socket Security CLI was created to enable integrations with other tools like GitHub Actions, GitLab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts with blocking actions it'll exit with a non-Zero exit code.
 
 ## Quick Start
 
diff --git a/pyproject.toml b/pyproject.toml
index 00750ad..7848929 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.42"
+version = "2.2.43"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index d5122b8..a2f04a3 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.42'
+__version__ = '2.2.43'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index f72f7ec..2e2c9e1 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -19,7 +19,6 @@
 from socketdev.fullscans import FullScanParams, SocketArtifact
 from socketdev.org import Organization
 from socketdev.repos import RepositoryInfo
-from socketdev.settings import SecurityPolicyRule
 import copy
 from socketsecurity import __version__, USER_AGENT
 from socketsecurity.core.classes import (
@@ -82,8 +81,6 @@ def set_org_vars(self) -> None:
         self.config.full_scan_path = f"{base_path}/full-scans"
         self.config.repository_path = f"{base_path}/repos"
 
-        self.config.security_policy = self.get_security_policy()
-
     def get_org_id_slug(self) -> Tuple[str, str]:
         """Gets the Org ID and Org Slug for the API Token."""
         response = self.sdk.org.get(use_types=True)
@@ -112,16 +109,7 @@ def get_sbom_data_list(self, artifacts_dict: Dict[str, SocketArtifact]) -> list[
         """Converts artifacts dictionary to a list."""
         return list(artifacts_dict.values())
 
-    def get_security_policy(self) -> Dict[str, SecurityPolicyRule]:
-        """Gets the organization's security policy."""
-        response = self.sdk.settings.get(self.config.org_slug, use_types=True)
-
-        if not response.success:
-            log.error(f"Failed to get security policy: {response.status}")
-            log.error(response.message)
-            raise Exception(f"Failed to get security policy: {response.status}, message: {response.message}")
 
-        return response.securityPolicyRules
 
     def create_sbom_output(self, diff: Diff) -> dict:
         """Creates CycloneDX output for a given diff."""
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index 6412b4d..5678bad 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -416,7 +416,7 @@ def security_comment_template(diff: Diff, config=None) -> str:
 > **❗️ Caution**  
 > **Review the following alerts detected in dependencies.**  
 >  
-> According to your organization's Security Policy, you **must** resolve all **"Block"** alerts before proceeding. It's recommended to resolve **"Warn"** alerts too.  
+> According to your organization's policies, you **must** resolve all **"Block"** alerts before proceeding. It's recommended to resolve **"Warn"** alerts too.  
 > Learn more about [Socket for GitHub](https://socket.dev?utm_medium=gh).
 
 <!-- start-socket-updated-alerts-table -->
@@ -622,7 +622,7 @@ def create_acceptable_risk(md: MdUtils, ignore_commands: list) -> MdUtils:
     @staticmethod
     def create_security_alert_table(diff: Diff, md: MdUtils) -> tuple[MdUtils, list, dict]:
         """
-        Creates the detected issues table based on the Security Policy
+        Creates the detected issues table based on alert actions from the API
         :param diff: Diff - Diff report with the detected issues
         :param md: MdUtils - Main markdown variable
         :return:
@@ -794,7 +794,7 @@ def create_purl_link(details: Purl) -> str:
     @staticmethod
     def create_console_security_alert_table(diff: Diff) -> PrettyTable:
         """
-        Creates the detected issues table based on the Security Policy
+        Creates the detected issues table based on alert actions from the API
         :param diff: Diff - Diff report with the detected issues
         :return:
         """
diff --git a/socketsecurity/core/socket_config.py b/socketsecurity/core/socket_config.py
index 43a50d5..8ebde8d 100644
--- a/socketsecurity/core/socket_config.py
+++ b/socketsecurity/core/socket_config.py
@@ -25,7 +25,6 @@ class SocketConfig:
     org_slug: Optional[str] = None
     full_scan_path: Optional[str] = None
     repository_path: Optional[str] = None
-    security_policy: Dict = None
     repo_visibility: Optional[str] = 'private'
     all_issues: Optional['AllIssues'] = None
     excluded_dirs: Set[str] = field(default_factory=lambda: default_exclude_dirs)
@@ -42,10 +41,6 @@ def __post_init__(self):
 
         self._validate_api_url(self.api_url)
 
-        # Initialize empty dict for security policy if None
-        if self.security_policy is None:
-            self.security_policy = {}
-
         # Initialize AllIssues if None
         if self.all_issues is None:
             self.all_issues = AllIssues()
@@ -70,6 +65,3 @@ def update_org_details(self, org_id: str, org_slug: str) -> None:
         self.full_scan_path = f"{base_path}/full-scans"
         self.repository_path = f"{base_path}/repos"
 
-    def update_security_policy(self, policy: Dict) -> None:
-        """Update security policy"""
-        self.security_policy = policy
\ No newline at end of file
diff --git a/tests/core/conftest.py b/tests/core/conftest.py
index 9fd1049..2fdefd5 100644
--- a/tests/core/conftest.py
+++ b/tests/core/conftest.py
@@ -10,7 +10,6 @@
     StreamDiffResponse,
 )
 from socketdev.repos import GetRepoResponse
-from socketdev.settings import OrgSecurityPolicyResponse
 
 
 @pytest.fixture
@@ -88,14 +87,7 @@ def stream_diff_response(data_dir, load_json):
     })
 
 
-@pytest.fixture
-def security_policy(data_dir, load_json):
-    json_data = load_json(data_dir / "settings" / "security-policy.json")
-    return OrgSecurityPolicyResponse.from_dict({
-        "success": json_data["success"],
-        "status": json_data["status"],
-        "securityPolicyRules": json_data["securityPolicyRules"]
-    })
+
 
 
 @pytest.fixture
@@ -146,13 +138,11 @@ def mock_sdk_with_responses(
     new_scan_metadata,
     new_scan_stream,
     stream_diff_response,
-    security_policy,
     create_full_scan_response,
 ):
     sdk = mock_socket_sdk.return_value
 
     # Simple returns
-    sdk.settings.get.return_value = security_policy
     sdk.fullscans.post.return_value = create_full_scan_response
 
     # Argument-based returns
diff --git a/tests/core/test_package_and_alerts.py b/tests/core/test_package_and_alerts.py
index 29cfa21..1eabc85 100644
--- a/tests/core/test_package_and_alerts.py
+++ b/tests/core/test_package_and_alerts.py
@@ -33,11 +33,10 @@ def mock_sdk(self):
             }
         })
         
-        # Set up settings.get() to return empty security policy
+        # Set up settings.get() to return empty response
         mock.settings = Mock()
         settings_response = Mock()
         settings_response.success = True
-        settings_response.security_policy = {}
         mock.settings.get = Mock(return_value=settings_response)
         
         return mock
@@ -48,7 +47,6 @@ def config(self):
             api_key="test-key",
             allow_unverified_ssl=False
         )
-        config.security_policy = {}  # Initialize with empty dict
         return config
     
     @pytest.fixture
@@ -135,34 +133,7 @@ def test_add_package_alerts_basic(self, core):
         assert alert.type == "networkAccess"
         assert alert.severity == "high"
 
-    def test_add_package_alerts_with_security_policy(self, core):
-        """Test alerts are properly tagged based on security policy"""
-        # Mock security policy in config
-        core.config.security_policy = {
-            "networkAccess": {"action": "error"}
-        }
-        
-        package = Package(
-            id="pkg:npm/test@1.0.0",
-            name="test",
-            version="1.0.0",
-            type="npm",
-            alerts=[{
-                "type": "networkAccess",
-                "key": "test-alert",
-                "severity": "high"
-            }],
-            topLevelAncestors=[]
-        )
-        
-        alerts_collection = {}
-        packages = {package.id: package}
-        
-        result = core.add_package_alerts_to_collection(package, alerts_collection, packages)
-        
-        assert len(result) == 1
-        alert = result["test-alert"][0]
-        assert alert.error is True
+
 
     def test_get_capabilities_for_added_packages(self, core):
         """Test capability extraction from package alerts"""
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index e958410..bdebf36 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -7,13 +7,12 @@ def test_config_default_values():
 
     assert config.api_key == "test_key"
     assert config.api_url == "https://api.socket.dev/v0"
-    assert config.timeout == 30
+    assert config.timeout == 1200
     assert config.allow_unverified_ssl is False
     assert config.org_id is None
     assert config.org_slug is None
     assert config.full_scan_path is None
     assert config.repository_path is None
-    assert config.security_policy == {}
 
 def test_config_custom_values():
     """Test that config accepts custom values"""
@@ -67,14 +66,4 @@ def test_config_update_org_details():
     assert config.full_scan_path == "orgs/test-org/full-scans"
     assert config.repository_path == "orgs/test-org/repos"
 
-def test_config_update_security_policy():
-    """Test updating security policy"""
-    config = SocketConfig(api_key="test_key")
-
-    test_policy = {
-        "rule1": {"action": "block"},
-        "rule2": {"action": "warn"}
-    }
 
-    config.security_policy = test_policy
-    assert config.security_policy == test_policy

From c2deb214cf50c6a4ff926ea0f7b7d29d4c8c4fd9 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Wed, 10 Dec 2025 16:18:10 +0100
Subject: [PATCH 05/80] Adds the `--reach-use-only-pregenerated-sboms` flag
 (#138)

* add flag --reach-use-only-pregenerated-sboms to exclude non-CDX and SPDX files from a Tier 1 reachability scan

* prepare for 2.2.44

* ensure only CDX/SPDX manifests and the .socket.facts.json are included in the final scan

* Moved the logic for find_sbom_files to find_files to avoid code duplication. Left the new function in place and just called find_files with the optional params

* Bumped minimum required SDK version with fix for no version in results

* bumped to fixed version of the SDK for no version in results

* Upgraded socketdev sdk in lock file

---------

Co-authored-by: Douglas Coburn <douglas@dactbc.com>
---
 pyproject.toml                            |    4 +-
 socketsecurity/__init__.py                |    2 +-
 socketsecurity/config.py                  |   13 +
 socketsecurity/core/__init__.py           |   59 +-
 socketsecurity/core/tools/reachability.py |   11 +-
 socketsecurity/socketcli.py               |   47 +-
 uv.lock                                   | 1225 +++++++++++----------
 7 files changed, 773 insertions(+), 588 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 7848929..4d739d2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.43"
+version = "2.2.48"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    'socketdev>=3.0.21,<4.0.0',
+    'socketdev>=3.0.22,<4.0.0',
     "bs4>=0.0.2",
 ]
 readme = "README.md"
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index a2f04a3..f334adf 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.43'
+__version__ = '2.2.48'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index e267ac6..28aa39b 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -77,6 +77,7 @@ class CliConfig:
     reach_concurrency: Optional[int] = None
     reach_additional_params: Optional[List[str]] = None
     only_facts_file: bool = False
+    reach_use_only_pregenerated_sboms: bool = False
     
     @classmethod
     def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
@@ -139,6 +140,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_concurrency': args.reach_concurrency,
             'reach_additional_params': args.reach_additional_params,
             'only_facts_file': args.only_facts_file,
+            'reach_use_only_pregenerated_sboms': args.reach_use_only_pregenerated_sboms,
             'version': __version__
         }
         try:
@@ -175,6 +177,11 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--only-facts-file requires --reach to be specified")
             exit(1)
 
+        # Validate that reach_use_only_pregenerated_sboms requires reach
+        if args.reach_use_only_pregenerated_sboms and not args.reach:
+            logging.error("--reach-use-only-pregenerated-sboms requires --reach to be specified")
+            exit(1)
+
         # Validate reach_concurrency is >= 1 if provided
         if args.reach_concurrency is not None and args.reach_concurrency < 1:
             logging.error("--reach-concurrency must be >= 1")
@@ -602,6 +609,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Submit only the .socket.facts.json file when creating full scan (requires --reach)"
     )
+    reachability_group.add_argument(
+        "--reach-use-only-pregenerated-sboms",
+        dest="reach_use_only_pregenerated_sboms",
+        action="store_true",
+        help="When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project. (requires --reach)"
+    )
 
     parser.add_argument(
         '--version',
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 2e2c9e1..2a2987c 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -281,12 +281,13 @@ def format_bytes(bytes_value):
         except Exception as e:
             log.error(f"Failed to save manifest tar.gz to {output_path}: {e}")
 
-    def find_files(self, path: str) -> List[str]:
+    def find_files(self, path: str, ecosystems: Optional[List[str]] = None) -> List[str]:
         """
         Finds supported manifest files in the given path.
 
         Args:
             path: Path to search for manifest files.
+            ecosystems: Optional list of ecosystems to include. If None, all ecosystems are included.
 
         Returns:
             List of found manifest file paths.
@@ -299,6 +300,9 @@ def find_files(self, path: str) -> List[str]:
         patterns = self.get_supported_patterns()
 
         for ecosystem in patterns:
+            # If ecosystems filter is provided, only include specified ecosystems
+            if ecosystems is not None and ecosystem not in ecosystems:
+                continue
             if ecosystem in self.config.excluded_ecosystems:
                 continue
             log.debug(f'Scanning ecosystem: {ecosystem}')
@@ -343,6 +347,23 @@ def find_files(self, path: str) -> List[str]:
 
         return file_list
 
+    def find_sbom_files(self, path: str) -> List[str]:
+        """
+        Finds only pre-generated SBOM files (CDX and SPDX) in the given path.
+
+        This is used with --reach-use-only-pregenerated-sboms to find only
+        pre-computed CycloneDX and SPDX manifest files.
+
+        Args:
+            path: Path to search for SBOM files.
+
+        Returns:
+            List of found CDX and SPDX file paths.
+        """
+        log.debug("Starting Find SBOM Files (CDX and SPDX only)")
+        sbom_ecosystems = ['cdx', 'spdx']
+        return self.find_files(path, ecosystems=sbom_ecosystems)
+
     def get_supported_patterns(self) -> Dict:
         """
         Gets supported file patterns from the Socket API.
@@ -547,7 +568,8 @@ def create_full_scan_with_report_url(
             no_change: bool = False,
             save_files_list_path: Optional[str] = None,
             save_manifest_tar_path: Optional[str] = None,
-            base_paths: Optional[List[str]] = None
+            base_paths: Optional[List[str]] = None,
+            explicit_files: Optional[List[str]] = None
     ) -> Diff:
         """Create a new full scan and return with html_report_url.
 
@@ -558,6 +580,7 @@ def create_full_scan_with_report_url(
             save_files_list_path: Optional path to save submitted files list for debugging
             save_manifest_tar_path: Optional path to save manifest files tar.gz archive
             base_paths: List of base paths for the scan (optional)
+            explicit_files: Optional list of explicit files to use instead of discovering files
 
         Returns:
             Dict with full scan data including html_report_url
@@ -571,11 +594,15 @@ def create_full_scan_with_report_url(
         if no_change:
             return diff
 
-        # Find manifest files from all paths
-        all_files = []
-        for path in paths:
-            files = self.find_files(path)
-            all_files.extend(files)
+        # Use explicit files if provided, otherwise find manifest files from all paths
+        if explicit_files is not None:
+            all_files = explicit_files
+            log.debug(f"Using {len(all_files)} explicit files instead of discovering files")
+        else:
+            all_files = []
+            for path in paths:
+                files = self.find_files(path)
+                all_files.extend(files)
         
         # Save submitted files list if requested
         if save_files_list_path and all_files:
@@ -943,7 +970,8 @@ def create_new_diff(
             no_change: bool = False,
             save_files_list_path: Optional[str] = None,
             save_manifest_tar_path: Optional[str] = None,
-            base_paths: Optional[List[str]] = None
+            base_paths: Optional[List[str]] = None,
+            explicit_files: Optional[List[str]] = None
     ) -> Diff:
         """Create a new diff using the Socket SDK.
 
@@ -954,16 +982,21 @@ def create_new_diff(
             save_files_list_path: Optional path to save submitted files list for debugging
             save_manifest_tar_path: Optional path to save manifest files tar.gz archive
             base_paths: List of base paths for the scan (optional)
+            explicit_files: Optional list of explicit files to use instead of discovering files
         """
         log.debug(f"starting create_new_diff with no_change: {no_change}")
         if no_change:
             return Diff(id="NO_DIFF_RAN", diff_url="", report_url="")
 
-        # Find manifest files from all paths
-        all_files = []
-        for path in paths:
-            files = self.find_files(path)
-            all_files.extend(files)
+        # Use explicit files if provided, otherwise find manifest files from all paths
+        if explicit_files is not None:
+            all_files = explicit_files
+            log.debug(f"Using {len(all_files)} explicit files instead of discovering files")
+        else:
+            all_files = []
+            for path in paths:
+                files = self.find_files(path)
+                all_files.extend(files)
         
         # Save submitted files list if requested
         if save_files_list_path and all_files:
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index e3ad9e0..2ac3e6c 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -101,10 +101,11 @@ def run_reachability_analysis(
         additional_params: Optional[List[str]] = None,
         allow_unverified: bool = False,
         enable_debug: bool = False,
+        use_only_pregenerated_sboms: bool = False,
     ) -> Dict[str, Any]:
         """
         Run reachability analysis.
-        
+
         Args:
             org_slug: Socket organization slug
             target_directory: Directory to analyze
@@ -125,7 +126,8 @@ def run_reachability_analysis(
             additional_params: Additional parameters to pass to coana CLI
             allow_unverified: Disable SSL certificate verification (sets NODE_TLS_REJECT_UNAUTHORIZED=0)
             enable_debug: Enable debug mode (passes -d flag to coana CLI)
-            
+            use_only_pregenerated_sboms: Use only pre-generated CDX and SPDX files for the scan
+
         Returns:
             Dict containing scan_id and report_path
         """
@@ -179,7 +181,10 @@ def run_reachability_analysis(
         
         if enable_debug:
             cmd.append("-d")
-        
+
+        if use_only_pregenerated_sboms:
+            cmd.append("--use-only-pregenerated-sboms")
+
         # Add any additional parameters provided by the user
         if additional_params:
             cmd.extend(additional_params)
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index c244a2e..00b64a7 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -167,6 +167,8 @@ def main_code():
     
     # Variable to track if we need to override files with facts file
     facts_file_to_submit = None
+    # Variable to track SBOM files to submit when using --reach-use-only-pregenerated-sboms
+    sbom_files_to_submit = None
     
     # Git setup
     is_repo = False
@@ -230,12 +232,14 @@ def main_code():
     # Run reachability analysis if enabled
     if config.reach:
         from socketsecurity.core.tools.reachability import ReachabilityAnalyzer
-        
+
         log.info("Starting reachability analysis...")
-        
+
         # Find manifest files in scan paths (excluding .socket.facts.json to avoid circular dependency)
         log.info("Finding manifest files for reachability analysis...")
         manifest_files = []
+
+        # Always find all manifest files for the tar hash upload
         for scan_path in scan_paths:
             scan_manifests = core.find_files(scan_path)
             # Filter out .socket.facts.json files from manifest upload
@@ -289,7 +293,8 @@ def main_code():
                     concurrency=config.reach_concurrency,
                     additional_params=config.reach_additional_params,
                     allow_unverified=config.allow_unverified,
-                    enable_debug=config.enable_debug
+                    enable_debug=config.enable_debug,
+                    use_only_pregenerated_sboms=config.reach_use_only_pregenerated_sboms
                 )
                 
                 log.info(f"Reachability analysis completed successfully")
@@ -301,6 +306,17 @@ def main_code():
                 if config.only_facts_file:
                     facts_file_to_submit = os.path.abspath(output_path)
                     log.info(f"Only-facts-file mode: will submit only {facts_file_to_submit}")
+
+                # If reach-use-only-pregenerated-sboms mode, submit CDX, SPDX, and facts file
+                if config.reach_use_only_pregenerated_sboms:
+                    # Find only CDX and SPDX files for the final scan submission
+                    sbom_files_to_submit = []
+                    for scan_path in scan_paths:
+                        sbom_files_to_submit.extend(core.find_sbom_files(scan_path))
+                    # Use relative path for facts file
+                    if os.path.exists(output_path):
+                        sbom_files_to_submit.append(output_path)
+                    log.info(f"Pre-generated SBOMs mode: will submit {len(sbom_files_to_submit)} files (CDX, SPDX, and facts file)")
                 
             except Exception as e:
                 log.error(f"Reachability analysis failed: {str(e)}")
@@ -331,6 +347,12 @@ def main_code():
         files_explicitly_specified = True
         log.debug(f"Overriding files to only submit facts file: {facts_file_to_submit}")
 
+    # Override files if reach-use-only-pregenerated-sboms mode is active
+    if sbom_files_to_submit:
+        specified_files = sbom_files_to_submit
+        files_explicitly_specified = True
+        log.debug(f"Overriding files to submit only SBOM files (CDX, SPDX, and facts): {sbom_files_to_submit}")
+
     # Determine files to check based on the new logic
     files_to_check = []
     force_api_mode = False
@@ -452,7 +474,7 @@ def main_code():
         log.info("Push initiated flow")
         if scm.check_event_type() == "diff":
             log.info("Starting comment logic for PR/MR event")
-            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths)
+            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
             comments = scm.get_comments_for_pr()
             log.debug("Removing comment alerts")
             
@@ -505,14 +527,14 @@ def main_code():
             )
         else:
             log.info("Starting non-PR/MR flow")
-            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths)
+            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
 
         output_handler.handle_output(diff)
-    
+
     elif config.enable_diff and not force_api_mode:
         # New logic: --enable-diff forces diff mode even with --integration api (no SCM)
         log.info("Diff mode enabled without SCM integration")
-        diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths)
+        diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
         output_handler.handle_output(diff)
     
     elif config.enable_diff and force_api_mode:
@@ -530,12 +552,13 @@ def main_code():
             no_change=should_skip_scan,
             save_files_list_path=config.save_submitted_files_list,
             save_manifest_tar_path=config.save_manifest_tar,
-            base_paths=base_paths
+            base_paths=base_paths,
+            explicit_files=sbom_files_to_submit
         )
         log.info(f"Full scan created with ID: {diff.id}")
         log.info(f"Full scan report URL: {diff.report_url}")
         output_handler.handle_output(diff)
-    
+
     else:
         if force_api_mode:
             log.info("No Manifest files changed, creating Socket Report")
@@ -550,7 +573,8 @@ def main_code():
                 no_change=should_skip_scan,
                 save_files_list_path=config.save_submitted_files_list,
                 save_manifest_tar_path=config.save_manifest_tar,
-                base_paths=base_paths
+                base_paths=base_paths,
+                explicit_files=sbom_files_to_submit
             )
             log.info(f"Full scan created with ID: {diff.id}")
             log.info(f"Full scan report URL: {diff.report_url}")
@@ -561,7 +585,8 @@ def main_code():
                 no_change=should_skip_scan,
                 save_files_list_path=config.save_submitted_files_list,
                 save_manifest_tar_path=config.save_manifest_tar,
-                base_paths=base_paths
+                base_paths=base_paths,
+                explicit_files=sbom_files_to_submit
             )
             output_handler.handle_output(diff)
 
diff --git a/uv.lock b/uv.lock
index 42ca82d..b37557c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -4,17 +4,16 @@ requires-python = ">=3.10"
 
 [[package]]
 name = "anyio"
-version = "4.10.0"
+version = "4.12.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
     { name = "idna" },
-    { name = "sniffio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f1/b4/636b3b65173d3ce9a38ef5f0522789614e590dab6a8d505340a4efe4c567/anyio-4.10.0.tar.gz", hash = "sha256:3f3fae35c96039744587aa5b8371e7e8e603c0702999535961dd336026973ba6", size = 213252, upload-time = "2025-08-04T08:54:26.451Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/16/ce/8a777047513153587e5434fd752e89334ac33e379aa3497db860eeb60377/anyio-4.12.0.tar.gz", hash = "sha256:73c693b567b0c55130c104d0b43a9baf3aa6a31fc6110116509f27bf75e21ec0", size = 228266, upload-time = "2025-11-28T23:37:38.911Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6f/12/e5e0282d673bb9746bacfb6e2dba8719989d3660cdb2ea79aee9a9651afb/anyio-4.10.0-py3-none-any.whl", hash = "sha256:60e474ac86736bbfd6f210f7a61218939c318f43f9972497381f1c5e930ed3d1", size = 107213, upload-time = "2025-08-04T08:54:24.882Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/9c/36c5c37947ebfb8c7f22e0eb6e4d188ee2d53aa3880f3f2744fb894f0cb1/anyio-4.12.0-py3-none-any.whl", hash = "sha256:dad2376a628f98eeca4881fc56cd06affd18f659b17a747d3ff0307ced94b1bb", size = 113362, upload-time = "2025-11-28T23:36:57.897Z" },
 ]
 
 [[package]]
@@ -35,17 +34,122 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b9/fa/123043af240e49752f1c4bd24da5053b6bd00cad78c2be53c0d1e8b975bc/backports.tarfile-1.2.0-py3-none-any.whl", hash = "sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34", size = 30181, upload-time = "2024-05-28T17:01:53.112Z" },
 ]
 
+[[package]]
+name = "backports-zstd"
+version = "1.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f4/d8/e8426a2abd7bfdafffcc1be07a23890314f199928515937c8ee7e3537157/backports_zstd-1.2.0.tar.gz", hash = "sha256:6c3fc19342db750b52fde793e4440a93575761b1493bb4a1d3b26033d2bd3452", size = 997263, upload-time = "2025-12-06T20:26:39.595Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/97/01630376854dab8cc6e58819236c46ffc40bc2ad1c5a82b430e0c5b79009/backports_zstd-1.2.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:68d70396997cbaaf8e571dee93f05c4cec5053ef14a6e165c26ad4aadca6b7ee", size = 435932, upload-time = "2025-12-06T20:24:08.421Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/62/a06ddca84e3c0ec45e667a02be5c4a157ab5e1e940d65096a80d409f0557/backports_zstd-1.2.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8dc2d15224ea683bbf7ad6aa8eacde40972c2c700e8ff72862cb0663e18ae953", size = 362327, upload-time = "2025-12-06T20:24:09.956Z" },
+    { url = "https://files.pythonhosted.org/packages/10/16/1045c674bb09fad1b838098c0b16a88bae9a7bab5e305aac11e55a8c813e/backports_zstd-1.2.0-cp310-cp310-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:7137114011f380f7e8bd97d92664b5bd71ab5f6e08144f22836263ad45273af2", size = 506230, upload-time = "2025-12-06T20:24:11.273Z" },
+    { url = "https://files.pythonhosted.org/packages/32/8d/ef8a8051374a1948d19c9888d2898d7091314448360a803bffc8474bbf58/backports_zstd-1.2.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fb922d2f278ec2e62a29121f98e573f622cefa9408dc0462a0e51ac08bca30b8", size = 475845, upload-time = "2025-12-06T20:24:12.846Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/b9/2c01e970e69f7ea2fa9710373fa4b48d31e677098d04d9b05d01e109feef/backports_zstd-1.2.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b72f4fe1764d53c6f8526d53ef566dcbe71daa81b3219fd802b51a153692159a", size = 581469, upload-time = "2025-12-06T20:24:14.343Z" },
+    { url = "https://files.pythonhosted.org/packages/84/a3/a2780c37d876badb483815239f2cc9bd863123248e20b2290e3f08355b7e/backports_zstd-1.2.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:743feb4e13e0f41a22d257bb5d2d4323f0308ecfedfd53db69172e2d9c3e4ba8", size = 641118, upload-time = "2025-12-06T20:24:16.024Z" },
+    { url = "https://files.pythonhosted.org/packages/92/88/5f40f9ead71dfb234fb7ab3c7949f2c0aa52eaed3f75115e4e7cfb5528f4/backports_zstd-1.2.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:199c41106c05bf12cb665a1d105ce2185da5e190e13b95933420d6fd9cd8bb10", size = 491335, upload-time = "2025-12-06T20:24:17.565Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/e2/4fd0071eb6035d6a412f6c5c2802ebacdbb845569dbb7a1e723c13cc1742/backports_zstd-1.2.0-cp310-cp310-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:270f10d14852fd11f85e1199f59fcb9dbcb425d489c678e5b0ea669c091b1cf3", size = 565341, upload-time = "2025-12-06T20:24:18.705Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/ef/b40a17346294c892d93fa738f48fc145432fa4ff265cf2d1ab3c177f10b1/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:c276433f6bbe67a8c71fa78bbfe1d7859ee17f799e6fcff9ac250840e38608d4", size = 481792, upload-time = "2025-12-06T20:24:19.948Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/24/7e0d77b17a3ae899a0c3f5ed9be842a8e6134577ea3411d8ff0e3962764d/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:772ad9b56a546fde9c1636dcf525d727330b11c6e34c9af8f879f23b41a8054e", size = 509736, upload-time = "2025-12-06T20:24:21.263Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/2a/99f7d247b974de0e5238796e85ba29e49c285a2d8a51c3b6f5b8abd4cd93/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:f7fd5d7c8c1c7b26b52b49bf3e392c3c6295658a34a887c587044b37a0b68a3c", size = 585835, upload-time = "2025-12-06T20:24:22.835Z" },
+    { url = "https://files.pythonhosted.org/packages/47/d9/0eabba1630f4b0674ce6ae79793e8901b0cdb28c83a484b424df29ed66dc/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:18b510dd03a2b7cdda62744802d8c43df7f027f578c4e67f6fa7208d8691db84", size = 563163, upload-time = "2025-12-06T20:24:24.35Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/67/cc1cd5cbb8982ca156393b8b50698b86efdd0245ba56f3b3b539950061c6/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:26301adc3008c2de40fedf780deb2bceb79471ea89efba37d30768871313f673", size = 631693, upload-time = "2025-12-06T20:24:26.166Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/19/01d30f83e87ae4890297f0d2422eb2fad0679c48eb65de8f2c8e131a9345/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:9dc4c9cf3804e6b6cc5aa9aedc63cf81551cc4f6150ea4b248b95de84051317d", size = 495392, upload-time = "2025-12-06T20:24:27.424Z" },
+    { url = "https://files.pythonhosted.org/packages/06/5e/4fb7553901245637ae70d934f5ae719be7207aea3243b254a19f5947b554/backports_zstd-1.2.0-cp310-cp310-win32.whl", hash = "sha256:e456426bf45dd8d818df5ce6b81faaf3961ef8b16834e91cbe2b739346abe9fb", size = 288844, upload-time = "2025-12-06T20:24:28.563Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/64/9f8a05ff703f5bdc2b2c9c8e5797299eb2cf4791226a46b2e14489784b4a/backports_zstd-1.2.0-cp310-cp310-win_amd64.whl", hash = "sha256:cf6e2cbe1e637a834e1920ded11e423897a9822d17a0be9486d3f63554f51618", size = 313759, upload-time = "2025-12-06T20:24:29.665Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/e7/cc45af33a4e4aee365ab76c3f4fcadf984fea221563c2c29c5613cffeaa9/backports_zstd-1.2.0-cp310-cp310-win_arm64.whl", hash = "sha256:4d50bd23c4520e1ccd60af59f8aadc43ce3a481f2793afe01c18a7aa6a518892", size = 288960, upload-time = "2025-12-06T20:24:30.819Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/40/f914ee5a00c1f5df9a162efd7130db7ab339b838e6b1613eb2ed7f0594a2/backports_zstd-1.2.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:b47ed63b1c04e06981ac552d107945752d1ffecae98a4bce9c8a627490ce460d", size = 435933, upload-time = "2025-12-06T20:24:31.903Z" },
+    { url = "https://files.pythonhosted.org/packages/36/5b/f03eeaee5b17cf88d9f252381f5b8573b1a1c958787af68e9d287c65086a/backports_zstd-1.2.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4e6433f889edb998abe33f3498c37ddd97b3ce3607eebbc0fed148f8c7c7f2ef", size = 362324, upload-time = "2025-12-06T20:24:33.186Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/78/369773911bd9968ca5f4e10ee4232ab6b71cbe45d6e17c78d3399e4a3944/backports_zstd-1.2.0-cp311-cp311-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:4cd00e5bfd6d17233809f08d979742a5b9c322162d8daea16f7c3538387b9c64", size = 506229, upload-time = "2025-12-06T20:24:34.364Z" },
+    { url = "https://files.pythonhosted.org/packages/19/da/f23872cd114b5352c97bf83a2082427aa08bd22f42461309c23783e82da5/backports_zstd-1.2.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f8c7239b457f4d51c03634edb0c9b2ebdffc6806f58c0396209f5eb7f8d7642e", size = 475842, upload-time = "2025-12-06T20:24:36.079Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/ea/07b6ee0956b522e6a8e0aca97d7b28ed0dc72a7c35a5b77485d2b8d7c4dc/backports_zstd-1.2.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:75c35e5292d5c5fa879ce3f40428fdb510b11a98801ccf1140690ed7a9c13b3d", size = 581467, upload-time = "2025-12-06T20:24:37.735Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/ea/ce04fed217a484ad9f3e8e087dd29c198dbfcb2d4d2c216d044a2a18aea8/backports_zstd-1.2.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:153e1af06e348f5ed1b104c345880c001824a192536940a8d012d33014b27ecf", size = 641159, upload-time = "2025-12-06T20:24:38.967Z" },
+    { url = "https://files.pythonhosted.org/packages/96/8f/b28147869bb8aba7a0b30f05cfec567d90002c4161dabb8315f002709ee3/backports_zstd-1.2.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf700fd79758417b1c0b725a56fa485ba15b10ee07ada736ff7e669fddd28b38", size = 491371, upload-time = "2025-12-06T20:24:40.209Z" },
+    { url = "https://files.pythonhosted.org/packages/33/92/26c7f8bee4cb3e6aae08b04351aa5578d30bac2701197ca2e3cb2b785978/backports_zstd-1.2.0-cp311-cp311-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b04638b6adf68f730b04b21ac81fb58eef2ea10f6c221aa653f1009c0afcf67b", size = 565341, upload-time = "2025-12-06T20:24:41.551Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/4b/d1595a7d877e67da6ec6d759d08f5dedaca59d4317c6116b19fd9e3c60bd/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:35a445eb01e525ae8dec59fcbabcc373c9ace57f8c10455185038f54a930a039", size = 481793, upload-time = "2025-12-06T20:24:43.036Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/0f/1e1c6a154026bcdd2daecb1abd1d924cb6d274b0f7bae4042f83fb0e97ab/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:1923ac203545a18a1b9726f6ae7bed1ab4f8825f0b8f4a32d2795932af3f5322", size = 509738, upload-time = "2025-12-06T20:24:44.427Z" },
+    { url = "https://files.pythonhosted.org/packages/40/7e/09a807f3920fa1fe4ae019275d5978168d94fe8615c5bde3f7969760edb7/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:97d06ec9b5b21fb59cfa5e716ca1c91f3bac2cd2c3b14e21c3d29fa1b2b0baf9", size = 585823, upload-time = "2025-12-06T20:24:46.001Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/14/ef90815a3ad6eabbca59b9cd62013c39acfd38c7cf1f5da31c733520a6d8/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:57e773e295e7d56bd67a2f57071b1c978832566d0f908d7d7aabb16f35401810", size = 563165, upload-time = "2025-12-06T20:24:47.132Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/98/8918bb085bb2f333d5785cc67918c65e497674de6d53834c1c42233ddde0/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:157950cfd4ed85e03c2557067867e37090796b556c613badfaefcdf2750e95e1", size = 631734, upload-time = "2025-12-06T20:24:48.309Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/c6/a2e494d412728fc04c7e1f40479bac80c505f9eaeafa8048f764104dbfc8/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:4a3450d9cf69d76843ea195c1defeff087b68a8a4a3687f0927f870ab594e062", size = 495397, upload-time = "2025-12-06T20:24:49.516Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/81/f9a762ad3e965324a19574c1aa7b39ac35196bc072534efd34b24bec9786/backports_zstd-1.2.0-cp311-cp311-win32.whl", hash = "sha256:77f0e7e71506e12f99927ddea7ab1de5933d47c9af048d05a229246977d89127", size = 288936, upload-time = "2025-12-06T20:24:50.68Z" },
+    { url = "https://files.pythonhosted.org/packages/21/95/1d699d9bc9a94ad5b8bc06d1a59246a5adce02668e3773a8c29b1f5a7554/backports_zstd-1.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:84a0b581408efce8624b887326e0b285fc2e5ba32348b9b6e6775f171fd4926b", size = 313884, upload-time = "2025-12-06T20:24:51.772Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/56/74b78b9313af6e330b04ae010a98e1d8cc133254c3c53ae2b5e5f4d5ec83/backports_zstd-1.2.0-cp311-cp311-win_arm64.whl", hash = "sha256:65e7591b20aa803c87a104c0dc9129a984f04adec9b042d88c7a14d1254c9524", size = 289080, upload-time = "2025-12-06T20:24:53.321Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/53/235dcac25478d60c4e58b6f982b91550b60908dbc07ab42405f818f41794/backports_zstd-1.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ff2348b69da19243b7148f69fc60753c27b3efe313dfb29dcb642b4b3a064261", size = 436243, upload-time = "2025-12-06T20:24:54.458Z" },
+    { url = "https://files.pythonhosted.org/packages/db/b2/549d1933995ccf4464b29f068f6fdd1e2d9f6abc8ecbcab99dd90d4d28fd/backports_zstd-1.2.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f194a3cb53173f8bf8160597d39be16731e576ccf0244e7694e3aeac47e6c85d", size = 362396, upload-time = "2025-12-06T20:24:55.712Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/11/dc21a59734f2ce145a9a7f2d0016987cedf95598a850a3f4ab6ce73ddea0/backports_zstd-1.2.0-cp312-cp312-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:79a18d5d707cd92fc7ce28c4a1a63cfdaf8d19223b3167d2d879042bf1c018ac", size = 506651, upload-time = "2025-12-06T20:24:56.975Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/16/12f84de430428f620a6ced01fd2768d2296951d7543b81d971455f39ef75/backports_zstd-1.2.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f04bcbb75de26d39de81e7c02a784cb55a706c6ce9665b8df218fa9275193a1a", size = 476474, upload-time = "2025-12-06T20:24:58.136Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/8a/980e349fac1e1ba596f440b24901af498399c6e33b83032abbf22fed7d21/backports_zstd-1.2.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9c36bbd7cc85629d77f9537ad02bc438b3e3f9f1741a43f1cede1027fd9ebfb5", size = 581930, upload-time = "2025-12-06T20:24:59.605Z" },
+    { url = "https://files.pythonhosted.org/packages/36/f8/cba3372ca8d777cf5c3e312b35112ff608cf6b0b2f6a813b600b69763495/backports_zstd-1.2.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:28828f15a7429a7f7570a1465f9b71ccf7f99ea0a6bf786be7c276777f3cdc14", size = 640659, upload-time = "2025-12-06T20:25:01.164Z" },
+    { url = "https://files.pythonhosted.org/packages/61/59/c8bd0a5a39770cf7c0d864cbb65ac5df57405ee28a51fd5c11a5fbf1a169/backports_zstd-1.2.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6d634cba354a3ca61837e5a8d9a6ee19d9d37927ec288f0828437b2620ae83fb", size = 494445, upload-time = "2025-12-06T20:25:02.867Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/bf/52665f48d449fa1586fb775468e2fa83ebc8e222eb2d18332b3b5f12f933/backports_zstd-1.2.0-cp312-cp312-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3624a67d12695d5c32a332bd8cc4c1d45273eba1a4a451a0ecf70f4c3e67dd4f", size = 568897, upload-time = "2025-12-06T20:25:04.151Z" },
+    { url = "https://files.pythonhosted.org/packages/95/ca/e559551d4d206a71ae545fcb690e704dfee141d88984729b0100042e91d3/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:93c9afeee3c60b203644e0a1cc54028283636b4e76ba670c84522584116c1b2e", size = 482506, upload-time = "2025-12-06T20:25:05.388Z" },
+    { url = "https://files.pythonhosted.org/packages/75/61/7440f4c72324c1c455498581faeadc1711cc6728f9d60aa781e6ef939446/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:4687dac0a3c5a4c30fbd871ee3be666822f1eb902a7a68ce0d1379f190917850", size = 510079, upload-time = "2025-12-06T20:25:06.703Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/bf/248692d5e0960a50eebc982e4e2cbbb3ac0f6200ad81d222d4c01ddd500d/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:dd63ed6c7139cef92b1073be892e92631aa468332570f7230089e93a9449f551", size = 586309, upload-time = "2025-12-06T20:25:08.351Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/7c/ecfb1d8ba18e2c9090898f12b6ea83a9dd59e735021a2c564996c4599024/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:464d5fea68f5b03feabea22a4db4f39622db4ff89dab2df259b3c8665f1f676b", size = 566493, upload-time = "2025-12-06T20:25:09.8Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/8d/c81ed0da565f735e8a8f0c3b8c633f9e16bcfdb82ca5cb4d029dac0f1361/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:d5b3518f82c518a09067dab4ed1bd79ca542a2c248f7f9418262dc2c4a06ccdb", size = 631120, upload-time = "2025-12-06T20:25:10.974Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/8e/9dec5a74249b3af4ea4fd4a5dfb5d70167ea82f96592b3b4e7d340ccfff0/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:1d57ce6d62dfb28bd37ad5523678752a5516ec68595fd35559f6c2878edd4de0", size = 498938, upload-time = "2025-12-06T20:25:12.145Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/99/ca71a403c79ec4bc419b71cee532de6545af1a0d8e61d0a2b8d70a034e0a/backports_zstd-1.2.0-cp312-cp312-win32.whl", hash = "sha256:e8bedc2372dae260397a99844420e16bb886912d685058d52e1f3533164f67a5", size = 289072, upload-time = "2025-12-06T20:25:13.48Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/e4/77fc5813ea35906ac1b71cd284e20c5a6f808f138e2e6a13e9586cd61d1a/backports_zstd-1.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:4667b30ea5e9f8b505b2042a40c5115660151987ca748b4be07facc757212ff9", size = 314094, upload-time = "2025-12-06T20:25:14.966Z" },
+    { url = "https://files.pythonhosted.org/packages/44/e3/133652d59a6731f9180a107812c9d52a2c72be2d80c2fd4f874669592a0c/backports_zstd-1.2.0-cp312-cp312-win_arm64.whl", hash = "sha256:cd6326f1562435677ab2bf607a44c96bb2a48beb0e14accff45e8c9f0931e9c1", size = 289197, upload-time = "2025-12-06T20:25:16.077Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/6c/dd602f484f22d8df9ed71859735dc86e094e90b7d8f51e51d48808f3571e/backports_zstd-1.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:1db671ac69df7cd88057c85a7bc614b94afd74a48faacd1576ad91dd18008f6a", size = 435731, upload-time = "2025-12-06T20:25:17.225Z" },
+    { url = "https://files.pythonhosted.org/packages/29/7d/b126e05650103f269282e5271a0960e30ac4ce9f192e3ae98e303325011b/backports_zstd-1.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5f6520e555c2b597863b97ecb90ad21857bf044119f643130c29110b55f67c1a", size = 362007, upload-time = "2025-12-06T20:25:18.841Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/e2/464e87930aa771da08634846300c13355f7ae07a476c8a30f75631fd1689/backports_zstd-1.2.0-cp313-cp313-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:9ef28be8bfebf5169cde28f36ebd146a0305569c91e836aed3a3aa79b7bbc58b", size = 505925, upload-time = "2025-12-06T20:25:20.319Z" },
+    { url = "https://files.pythonhosted.org/packages/44/08/bda420a2d13be0d6aa8323b735207de46bb01c08575e3a6810e01a20501f/backports_zstd-1.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9478c04e285da26ce1198d5ec1e43905531049c9e0f74169a39df5876f44643e", size = 476130, upload-time = "2025-12-06T20:25:21.839Z" },
+    { url = "https://files.pythonhosted.org/packages/17/d5/fca7eb6e5a12e390ea4437bc6705e18efd70c9966127c3c2fec8188654f1/backports_zstd-1.2.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f032452d783876c5f4d81907e42fc6fbe812a9a712c360b497968ea7109bb17", size = 581610, upload-time = "2025-12-06T20:25:23.077Z" },
+    { url = "https://files.pythonhosted.org/packages/81/e2/072fdf5bff7274788b49491a4d039bf0fe2f2f07a9975751d8b70fc14ac6/backports_zstd-1.2.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5642ae3832fb74817bdabc0d8b8877b109537c3f9ceeb54a6cd855aa0afc3bd9", size = 642454, upload-time = "2025-12-06T20:25:24.28Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/74/a7ae8e421ccb779130d64745d3191daf6da02f37bf7cf099dc10d688d14e/backports_zstd-1.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4e7340a7fb7bac7607382554b138ae8dbffda0b8af72ce5c639fb86b49a3b2e4", size = 491079, upload-time = "2025-12-06T20:25:25.481Z" },
+    { url = "https://files.pythonhosted.org/packages/25/26/450b23bad6035f0f3dc8e1cf3729e31a10ce1821a7b6d3bf8555ba818a46/backports_zstd-1.2.0-cp313-cp313-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b72e343b1b2927fc047054450de8738bc64c268e93fabc8228d963690eaf348e", size = 566373, upload-time = "2025-12-06T20:25:27.034Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/42/8161164fb26ac1a656f5fb5e3aa3aa9dcf4d06f6d9553fc596fa6f0ae3ad/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:c3f2a3f898dd1eaba5c8f0ea0e1bd23d993ed86ea7d4c12bf7a0743158d123d6", size = 481888, upload-time = "2025-12-06T20:25:28.198Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/2c/5c4f9a54c7c708f38cdb0670804d62237e9cacd1a6ff567f8c5fb8ef5d1a/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:afb95bc88d7623eeda2c0c8fe0388ac8838fa5a09ddbd7dfa72b283de392024b", size = 509480, upload-time = "2025-12-06T20:25:29.438Z" },
+    { url = "https://files.pythonhosted.org/packages/13/fc/f7a86785fde290b3280adeb81c577a96323d4b661b9befa0d990aaa67a86/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:59ddb84b8bd46a4a297cdf92601aaa9f59881c59f4a402a021173d6bb8bc367a", size = 586040, upload-time = "2025-12-06T20:25:30.598Z" },
+    { url = "https://files.pythonhosted.org/packages/40/7a/11c709c72abeef82c5ef752718c10a3fde0fba8258c069d717de33d366f7/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:d3d0d54ef711ea5ffa4e2eebfb70784295eb517bd7ac64545a142ad35c5b02ba", size = 564125, upload-time = "2025-12-06T20:25:31.772Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/ec/2ea033ceeca0808d830c3fb1d8ced1b6d2e5c4540ed8bdf66e0ec99180af/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:5c170f1329e90614f2d51f6f4622f6f775f51b92b7bc7801fa093b97db6cfc95", size = 632819, upload-time = "2025-12-06T20:25:33.027Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/3a/1469312ce7b1c6d98c788b500df01d61468d17bfd58df21266a7160112fe/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:49c675121210ee23ea9c9b28ad15822e1b0f9182df733f0e1a10a5385f628701", size = 495375, upload-time = "2025-12-06T20:25:34.362Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/da/27ef9e6a169808fc6777fb58fb55991bdc9ec22eee1aaecaf076be91986b/backports_zstd-1.2.0-cp313-cp313-win32.whl", hash = "sha256:0724fb2958eb2ccc100c9f49315d856a88b5deb985c62953876a78ecb46027ba", size = 288717, upload-time = "2025-12-06T20:25:35.565Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/f3/bfe0c470e2cfd0bbc274ca484e7a061f2d505c28df2479c52ed1dcce4fea/backports_zstd-1.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:b80b715170fc590d464d3342757978702ed4b6b41a3b3a0a5dbb46a89f4ccebe", size = 313927, upload-time = "2025-12-06T20:25:36.691Z" },
+    { url = "https://files.pythonhosted.org/packages/16/0d/cf6b22e4ca8cfa850061baa89664437b2da65698b2a8a02eb67de9d6b69e/backports_zstd-1.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:c09f5e985142fc04581c12e635dfd8cdc64b2d595479c1213f0b4db7ee37e3cb", size = 288947, upload-time = "2025-12-06T20:25:37.884Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/65/285bccc9fddb1b1d7fa379b42407f3e88359db05a6955fbe02ef4d5ed6ce/backports_zstd-1.2.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:21c68b9d358f1062c5c8baad946e306b54380dcbe2b12d00fdebc42533b5a499", size = 436423, upload-time = "2025-12-06T20:25:39.048Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/27/bba33f68cfc57a2885bbd1a1ffc9405cb461b12db5083ca63b15074bfa6d/backports_zstd-1.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4c3508074a30e3309bcc1bfdfe6cbd6bd3d64567788d3c6e15b1594e63bef276", size = 362704, upload-time = "2025-12-06T20:25:40.232Z" },
+    { url = "https://files.pythonhosted.org/packages/42/62/9233d99c1be673188afde322aecc467653023185077064dd3eac18678e22/backports_zstd-1.2.0-cp313-cp313t-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:9a0e5f6aebd1ff3c75b26d3e3ac3140996b9f0883b95847fad57992be06fe5d2", size = 507870, upload-time = "2025-12-06T20:25:41.364Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/b0/089867ef455f6311caa9224e68020cabcbfc3f8759cfd19931b06ba7bb8d/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7b12f415fe62f1e9f7196ce9eaedc699547c38cc263e64b6939b610b2a29a200", size = 475770, upload-time = "2025-12-06T20:25:42.873Z" },
+    { url = "https://files.pythonhosted.org/packages/43/d5/8615151ea4bcf5d2dca0755bfa7cad97b7cb8dbd1c9c2e1da57081f1d8a6/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:00066e7c3df700fe0df66aa197dcbd3d691d55c16f6179c3acd87a6ca22e7993", size = 581191, upload-time = "2025-12-06T20:25:44.156Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/71/eb6e7019db30622d2a31faa0e608fc3dc29e336b4a855bd5b0e78ac0943e/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c56bdb8e57563d726ce46225011801ff748018cbeff5175576f8a46868e0f706", size = 640185, upload-time = "2025-12-06T20:25:45.348Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/64/ebd64f84875f7feb83005bfc3e7352700d26f5396e7e5e494681af18fe18/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9f499ec4944c223814be97627d0f1b65c2474ba981e1f21ec8b541f2dff5f960", size = 495073, upload-time = "2025-12-06T20:25:46.546Z" },
+    { url = "https://files.pythonhosted.org/packages/45/a7/8f44bbd2a78855680c24e7f90cad69c0c70650f345c4cf13bc7a6dd56231/backports_zstd-1.2.0-cp313-cp313t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7a0957bc3eb84b4a537388c7a62ed055d61c2246c11babf4cbaafb3b5eda0a9c", size = 570664, upload-time = "2025-12-06T20:25:47.731Z" },
+    { url = "https://files.pythonhosted.org/packages/85/e3/476a8b3ac1d7d1b41442bf634603d0beb392d9df2a1439f9543312b67bc3/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e38b22cb32bd9010ad65c0b75a2934448adfdd6bba4387b0f9bacce11e051716", size = 482252, upload-time = "2025-12-06T20:25:49.166Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/2f/cebac7f4dc977da1dfbef4004dae6ae12e31f6978db34af530425568dea7/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:9af83bbd56f785dffc9a669918e7e7b7f96b0e32fd8877ff90e445ca531463ae", size = 511631, upload-time = "2025-12-06T20:25:50.4Z" },
+    { url = "https://files.pythonhosted.org/packages/22/29/1e9a135af0141d0e0eabb21491f0f058e73ddb4de356ca174406d60d1dd6/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:e3ddf78b1b58291616df13844d5a0e6027b0ce299b15d7d3be2a93b974b7b5f6", size = 585764, upload-time = "2025-12-06T20:25:51.998Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/17/e9b29c3d7c4d13e046876fb81b7564a85463d6ab65c10f7fc42a7c658042/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:93332bf758954da70b1803ccc73697c7cdec475e4ec04286ff8c568f3786c398", size = 568581, upload-time = "2025-12-06T20:25:53.895Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/b5/e2f2f68c204743a9060e50f6910fd7ae1b484250460fa85e843292e8e8d8/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:8f5ba6a97712794ab9c284382a5faefd31ebcb84fa55cb4621e948264dbc6b97", size = 630790, upload-time = "2025-12-06T20:25:55.071Z" },
+    { url = "https://files.pythonhosted.org/packages/78/ff/87fc0e498e6c4ad475da178a4e4c81fbfaf19b043ca586a63068ad704f49/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:9d541c0c1992ac25bfd836a1e77cf0e70f18d5505aeeebc56c2cf06ffbc209f5", size = 499701, upload-time = "2025-12-06T20:25:56.265Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/2e/e10d1b10f087094a108f542b91b44efe928800b6ecd8f1619c9967b6da5b/backports_zstd-1.2.0-cp313-cp313t-win32.whl", hash = "sha256:6c2bc4f7154d5c166912c5b7ee6cbb3a921726d1c2cee7c0f1bfaae736f7c250", size = 289660, upload-time = "2025-12-06T20:25:57.753Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/ae/68e5bca7f9990c45c7b1940deccfa4a106c956c5ddd63393332372dad131/backports_zstd-1.2.0-cp313-cp313t-win_amd64.whl", hash = "sha256:2b7b83331878041a259ec0b384bee7dbfd486b2a2579cd730aca718897d045d7", size = 315026, upload-time = "2025-12-06T20:25:58.952Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/33/a519b4da2015069fb36cded5181ff078ecceb852861b675e2c79547ad10d/backports_zstd-1.2.0-cp313-cp313t-win_arm64.whl", hash = "sha256:a884be79cd0897436e1e06566d0b6bcad2360afca8e8e27fb19422ba0cca4d7a", size = 289583, upload-time = "2025-12-06T20:26:00.127Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/03/0be0f44bfd5a77b6dc476eae791bb2847f786bef717aab510b0764aba2f9/backports_zstd-1.2.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:f94f434e2265c067a7e6e2ea50f93e709421f2c9e4a2458a80284065a79caefd", size = 410041, upload-time = "2025-12-06T20:26:23.148Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/7a/1d2390341fb97e9fa9c3242dce6825646bd6f47d96ca862bf070dce0c943/backports_zstd-1.2.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:0d9e4d77f03524b59bc2d8d9636e5d808e50ef0d20c56f0ab2ab8ee00b6a367a", size = 339556, upload-time = "2025-12-06T20:26:24.718Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/21/36a2a17f5cd360ddd89bc6d24d2cfb1f6b1e4051fe70da9e172697763d7d/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:5d8014aeaec1f47f3209bd5e9e29282fcafa7b9076f89cc342a5dab3f298fdec", size = 420605, upload-time = "2025-12-06T20:26:25.872Z" },
+    { url = "https://files.pythonhosted.org/packages/87/e3/ee54f99fda973cf18dcb5ef7fb481449b1e5770af4f449ac06af77c995d2/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:35b8390fde5644a067a66cbd6f1b1293f48264f7bd867f0148b09d4f206005bf", size = 394149, upload-time = "2025-12-06T20:26:27.57Z" },
+    { url = "https://files.pythonhosted.org/packages/36/d6/1e41a5469606fbe100b4841f03c42275a1b114fa02921cbdedb0aadeaa00/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fb3b0e175170422b1d095709356cb688b664d381f3dba424ae5107990ca913ee", size = 414113, upload-time = "2025-12-06T20:26:29.072Z" },
+    { url = "https://files.pythonhosted.org/packages/46/68/26c9802339a885f567f1c7bbfa5d5b786545e5bb754ba385f81dd6d2ccc1/backports_zstd-1.2.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:5f7e28d44e322c16aaf8973ce3c062105b6d88fe2b4f4611b40e410176a4fd40", size = 299966, upload-time = "2025-12-06T20:26:30.333Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/b1/2b7b0e1dcd165cf0e0fc792b74138489bfb90d66d7ded86f7f7e91f6764c/backports_zstd-1.2.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:1c3a1748eaac8fd1c862d3e16c6beb023f118a82d7230a32d33f6ce65752a2d6", size = 409938, upload-time = "2025-12-06T20:26:31.55Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/ce/c91b6a4681eb8f13c7919ce551d4b5364e9fd6f07e770e4e01ca2c0b1f92/backports_zstd-1.2.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:9e126bd32c97b1f4717d30530a3762c1f9a85d5d629fdc2ad210e6427fd6849c", size = 339472, upload-time = "2025-12-06T20:26:32.765Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/e6/abb1b8e6e5c9dfb8cbf05669745de81273b46fef5bafee00fb1698c75ce8/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:e4524beed644c4074ff017e96afc91c5e98064f40680fa859bddee5974641805", size = 420603, upload-time = "2025-12-06T20:26:34.374Z" },
+    { url = "https://files.pythonhosted.org/packages/50/2e/ca206b678cdbd2eca56aa2ce49996f6d6cd21db840efa6e2e6f73d4cb7db/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72bc2b03590d66d8706e4717da25cc6c192f5a6bfc3f6148f671f79e73afd4e8", size = 394149, upload-time = "2025-12-06T20:26:35.563Z" },
+    { url = "https://files.pythonhosted.org/packages/50/c2/ba7bcfe28dc3f8e8848419757883c8a0c7a4263dcd5d3988dd7f49818ca8/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:89afe7d6e86bedbf2bac083beb096732a1e92025a5efa9c972941a6140994485", size = 414114, upload-time = "2025-12-06T20:26:36.808Z" },
+    { url = "https://files.pythonhosted.org/packages/71/ad/d5e8a3b28150e4f310999ef26db1e6b5f3bbb899c07d88ebd910954fcaf2/backports_zstd-1.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:f00066de6ffd72c653b43afb9aaa36969fd0e2c91f66adb45a11f73e6423263a", size = 299968, upload-time = "2025-12-06T20:26:38.382Z" },
+]
+
 [[package]]
 name = "beautifulsoup4"
-version = "4.14.2"
+version = "4.14.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "soupsieve" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/e9/df2358efd7659577435e2177bfa69cba6c33216681af51a707193dec162a/beautifulsoup4-4.14.2.tar.gz", hash = "sha256:2a98ab9f944a11acee9cc848508ec28d9228abfd522ef0fad6a02a72e0ded69e", size = 625822, upload-time = "2025-09-29T10:05:42.613Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b0/1c6a16426d389813b48d95e26898aff79abbde42ad353958ad95cc8c9b21/beautifulsoup4-4.14.3.tar.gz", hash = "sha256:6292b1c5186d356bba669ef9f7f051757099565ad9ada5dd630bd9de5fa7fb86", size = 627737, upload-time = "2025-11-30T15:08:26.084Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/94/fe/3aed5d0be4d404d12d36ab97e2f1791424d9ca39c2f754a6285d59a3b01d/beautifulsoup4-4.14.2-py3-none-any.whl", hash = "sha256:5ef6fa3a8cbece8488d66985560f97ed091e22bbc4e9c2338508a9d5de6d4515", size = 106392, upload-time = "2025-09-29T10:05:43.771Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/39/47f9197bdd44df24d67ac8893641e16f386c984a0619ef2ee4c51fbbc019/beautifulsoup4-4.14.3-py3-none-any.whl", hash = "sha256:0918bfe44902e6ad8d57732ba310582e98da931428d231a5ecb9e7c703a735bb", size = 107721, upload-time = "2025-11-30T15:08:24.087Z" },
 ]
 
 [[package]]
@@ -62,137 +166,174 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2025.8.3"
+version = "2025.11.12"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/dc/67/960ebe6bf230a96cda2e0abcf73af550ec4f090005363542f0765df162e0/certifi-2025.8.3.tar.gz", hash = "sha256:e564105f78ded564e3ae7c923924435e1daa7463faeab5bb932bc53ffae63407", size = 162386, upload-time = "2025-08-03T03:07:47.08Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a2/8c/58f469717fa48465e4a50c014a0400602d3c437d7c0c468e17ada824da3a/certifi-2025.11.12.tar.gz", hash = "sha256:d8ab5478f2ecd78af242878415affce761ca6bc54a22a27e026d7c25357c3316", size = 160538, upload-time = "2025-11-12T02:54:51.517Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/48/1549795ba7742c948d2ad169c1c8cdbae65bc450d6cd753d124b17c8cd32/certifi-2025.8.3-py3-none-any.whl", hash = "sha256:f6c12493cfb1b06ba2ff328595af9350c65d6644968e5d3a2ffd78699af217a5", size = 161216, upload-time = "2025-08-03T03:07:45.777Z" },
+    { url = "https://files.pythonhosted.org/packages/70/7d/9bc192684cea499815ff478dfcdc13835ddf401365057044fb721ec6bddb/certifi-2025.11.12-py3-none-any.whl", hash = "sha256:97de8790030bbd5c2d96b7ec782fc2f7820ef8dba6db909ccf95449f2d062d4b", size = 159438, upload-time = "2025-11-12T02:54:49.735Z" },
 ]
 
 [[package]]
 name = "cffi"
-version = "1.17.1"
+version = "2.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "pycparser" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/97/c783634659c2920c3fc70419e3af40972dbaf758daa229a7d6ea6135c90d/cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824", size = 516621, upload-time = "2024-09-04T20:45:21.852Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/de/cc/4635c320081c78d6ffc2cab0a76025b691a91204f4aa317d568ff9280a2d/cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382", size = 426024, upload-time = "2024-09-04T20:43:34.186Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/7b/3b2b250f3aab91abe5f8a51ada1b717935fdaec53f790ad4100fe2ec64d1/cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702", size = 448188, upload-time = "2024-09-04T20:43:36.286Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/48/1b9283ebbf0ec065148d8de05d647a986c5f22586b18120020452fff8f5d/cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3", size = 455571, upload-time = "2024-09-04T20:43:38.586Z" },
-    { url = "https://files.pythonhosted.org/packages/40/87/3b8452525437b40f39ca7ff70276679772ee7e8b394934ff60e63b7b090c/cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6", size = 436687, upload-time = "2024-09-04T20:43:40.084Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/fb/4da72871d177d63649ac449aec2e8a29efe0274035880c7af59101ca2232/cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17", size = 446211, upload-time = "2024-09-04T20:43:41.526Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/a0/62f00bcb411332106c02b663b26f3545a9ef136f80d5df746c05878f8c4b/cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8", size = 461325, upload-time = "2024-09-04T20:43:43.117Z" },
-    { url = "https://files.pythonhosted.org/packages/36/83/76127035ed2e7e27b0787604d99da630ac3123bfb02d8e80c633f218a11d/cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e", size = 438784, upload-time = "2024-09-04T20:43:45.256Z" },
-    { url = "https://files.pythonhosted.org/packages/21/81/a6cd025db2f08ac88b901b745c163d884641909641f9b826e8cb87645942/cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be", size = 461564, upload-time = "2024-09-04T20:43:46.779Z" },
-    { url = "https://files.pythonhosted.org/packages/94/dd/a3f0118e688d1b1a57553da23b16bdade96d2f9bcda4d32e7d2838047ff7/cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4", size = 445259, upload-time = "2024-09-04T20:43:56.123Z" },
-    { url = "https://files.pythonhosted.org/packages/2e/ea/70ce63780f096e16ce8588efe039d3c4f91deb1dc01e9c73a287939c79a6/cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41", size = 469200, upload-time = "2024-09-04T20:43:57.891Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/a0/a4fa9f4f781bda074c3ddd57a572b060fa0df7655d2a4247bbe277200146/cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1", size = 477235, upload-time = "2024-09-04T20:44:00.18Z" },
-    { url = "https://files.pythonhosted.org/packages/62/12/ce8710b5b8affbcdd5c6e367217c242524ad17a02fe5beec3ee339f69f85/cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6", size = 459721, upload-time = "2024-09-04T20:44:01.585Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/6b/d45873c5e0242196f042d555526f92aa9e0c32355a1be1ff8c27f077fd37/cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d", size = 467242, upload-time = "2024-09-04T20:44:03.467Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/52/d9a0e523a572fbccf2955f5abe883cfa8bcc570d7faeee06336fbd50c9fc/cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6", size = 477999, upload-time = "2024-09-04T20:44:05.023Z" },
-    { url = "https://files.pythonhosted.org/packages/44/74/f2a2460684a1a2d00ca799ad880d54652841a780c4c97b87754f660c7603/cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f", size = 454242, upload-time = "2024-09-04T20:44:06.444Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/4a/34599cac7dfcd888ff54e801afe06a19c17787dfd94495ab0c8d35fe99fb/cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b", size = 478604, upload-time = "2024-09-04T20:44:08.206Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/b6/db007700f67d151abadf508cbfd6a1884f57eab90b1bb985c4c8c02b0f28/cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36", size = 454803, upload-time = "2024-09-04T20:44:15.231Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/df/f8d151540d8c200eb1c6fba8cd0dfd40904f1b0682ea705c36e6c2e97ab3/cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5", size = 478850, upload-time = "2024-09-04T20:44:17.188Z" },
-    { url = "https://files.pythonhosted.org/packages/28/c0/b31116332a547fd2677ae5b78a2ef662dfc8023d67f41b2a83f7c2aa78b1/cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff", size = 485729, upload-time = "2024-09-04T20:44:18.688Z" },
-    { url = "https://files.pythonhosted.org/packages/91/2b/9a1ddfa5c7f13cab007a2c9cc295b70fbbda7cb10a286aa6810338e60ea1/cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99", size = 471256, upload-time = "2024-09-04T20:44:20.248Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/d5/da47df7004cb17e4955df6a43d14b3b4ae77737dff8bf7f8f333196717bf/cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93", size = 479424, upload-time = "2024-09-04T20:44:21.673Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/ac/2a28bcf513e93a219c8a4e8e125534f4f6db03e3179ba1c45e949b76212c/cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3", size = 484568, upload-time = "2024-09-04T20:44:23.245Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/38/ca8a4f639065f14ae0f1d9751e70447a261f1a30fa7547a828ae08142465/cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8", size = 488736, upload-time = "2024-09-04T20:44:24.757Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/2d/eab2e858a91fdff70533cab61dcff4a1f55ec60425832ddfdc9cd36bc8af/cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3", size = 454792, upload-time = "2024-09-04T20:44:32.01Z" },
-    { url = "https://files.pythonhosted.org/packages/75/b2/fbaec7c4455c604e29388d55599b99ebcc250a60050610fadde58932b7ee/cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683", size = 478893, upload-time = "2024-09-04T20:44:33.606Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/b7/6e4a2162178bf1935c336d4da8a9352cccab4d3a5d7914065490f08c0690/cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5", size = 485810, upload-time = "2024-09-04T20:44:35.191Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/8a/1d0e4a9c26e54746dc08c2c6c037889124d4f59dffd853a659fa545f1b40/cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4", size = 471200, upload-time = "2024-09-04T20:44:36.743Z" },
-    { url = "https://files.pythonhosted.org/packages/26/9f/1aab65a6c0db35f43c4d1b4f580e8df53914310afc10ae0397d29d697af4/cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd", size = 479447, upload-time = "2024-09-04T20:44:38.492Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/e4/fb8b3dd8dc0e98edf1135ff067ae070bb32ef9d509d6cb0f538cd6f7483f/cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed", size = 484358, upload-time = "2024-09-04T20:44:40.046Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/47/d7145bf2dc04684935d57d67dff9d6d795b2ba2796806bb109864be3a151/cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9", size = 488469, upload-time = "2024-09-04T20:44:41.616Z" },
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/50/bd/b1a6362b80628111e6653c961f987faa55262b4002fcec42308cad1db680/cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c", size = 208811, upload-time = "2025-09-08T23:22:12.267Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/27/6933a8b2562d7bd1fb595074cf99cc81fc3789f6a6c05cdabb46284a3188/cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb", size = 216402, upload-time = "2025-09-08T23:22:13.455Z" },
+    { url = "https://files.pythonhosted.org/packages/05/eb/b86f2a2645b62adcfff53b0dd97e8dfafb5c8aa864bd0d9a2c2049a0d551/cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0", size = 203217, upload-time = "2025-09-08T23:22:14.596Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/e0/6cbe77a53acf5acc7c08cc186c9928864bd7c005f9efd0d126884858a5fe/cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4", size = 203079, upload-time = "2025-09-08T23:22:15.769Z" },
+    { url = "https://files.pythonhosted.org/packages/98/29/9b366e70e243eb3d14a5cb488dfd3a0b6b2f1fb001a203f653b93ccfac88/cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453", size = 216475, upload-time = "2025-09-08T23:22:17.427Z" },
+    { url = "https://files.pythonhosted.org/packages/21/7a/13b24e70d2f90a322f2900c5d8e1f14fa7e2a6b3332b7309ba7b2ba51a5a/cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495", size = 218829, upload-time = "2025-09-08T23:22:19.069Z" },
+    { url = "https://files.pythonhosted.org/packages/60/99/c9dc110974c59cc981b1f5b66e1d8af8af764e00f0293266824d9c4254bc/cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5", size = 211211, upload-time = "2025-09-08T23:22:20.588Z" },
+    { url = "https://files.pythonhosted.org/packages/49/72/ff2d12dbf21aca1b32a40ed792ee6b40f6dc3a9cf1644bd7ef6e95e0ac5e/cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb", size = 218036, upload-time = "2025-09-08T23:22:22.143Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ef/a7b77c8bdc0f77adc3b46888f1ad54be8f3b7821697a7b89126e829e676a/cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664", size = 202597, upload-time = "2025-09-08T23:22:34.132Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/91/500d892b2bf36529a75b77958edfcd5ad8e2ce4064ce2ecfeab2125d72d1/cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26", size = 215574, upload-time = "2025-09-08T23:22:35.443Z" },
+    { url = "https://files.pythonhosted.org/packages/44/64/58f6255b62b101093d5df22dcb752596066c7e89dd725e0afaed242a61be/cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9", size = 218971, upload-time = "2025-09-08T23:22:36.805Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/49/fa72cebe2fd8a55fbe14956f9970fe8eb1ac59e5df042f603ef7c8ba0adc/cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414", size = 211972, upload-time = "2025-09-08T23:22:38.436Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/28/dd0967a76aab36731b6ebfe64dec4e981aff7e0608f60c2d46b46982607d/cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743", size = 217078, upload-time = "2025-09-08T23:22:39.776Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/df/a4f0fbd47331ceeba3d37c2e51e9dfc9722498becbeec2bd8bc856c9538a/cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe", size = 212529, upload-time = "2025-09-08T23:22:47.349Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/72/12b5f8d3865bf0f87cf1404d8c374e7487dcf097a1c91c436e72e6badd83/cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062", size = 220097, upload-time = "2025-09-08T23:22:48.677Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/95/7a135d52a50dfa7c882ab0ac17e8dc11cec9d55d2c18dda414c051c5e69e/cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e", size = 207983, upload-time = "2025-09-08T23:22:50.06Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/c8/15cb9ada8895957ea171c62dc78ff3e99159ee7adb13c0123c001a2546c1/cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037", size = 206519, upload-time = "2025-09-08T23:22:51.364Z" },
+    { url = "https://files.pythonhosted.org/packages/78/2d/7fa73dfa841b5ac06c7b8855cfc18622132e365f5b81d02230333ff26e9e/cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba", size = 219572, upload-time = "2025-09-08T23:22:52.902Z" },
+    { url = "https://files.pythonhosted.org/packages/07/e0/267e57e387b4ca276b90f0434ff88b2c2241ad72b16d31836adddfd6031b/cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94", size = 222963, upload-time = "2025-09-08T23:22:54.518Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/75/1f2747525e06f53efbd878f4d03bac5b859cbc11c633d0fb81432d98a795/cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187", size = 221361, upload-time = "2025-09-08T23:22:55.867Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
+    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
+    { url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
+    { url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
+    { url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
 ]
 
 [[package]]
 name = "cfgv"
-version = "3.4.0"
+version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/11/74/539e56497d9bd1d484fd863dd69cbbfa653cd2aa27abfe35653494d85e94/cfgv-3.4.0.tar.gz", hash = "sha256:e52591d4c5f5dead8e0f673fb16db7949d2cfb3f7da4582893288f0ded8fe560", size = 7114, upload-time = "2023-08-12T20:38:17.776Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4e/b5/721b8799b04bf9afe054a3899c6cf4e880fcf8563cc71c15610242490a0c/cfgv-3.5.0.tar.gz", hash = "sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132", size = 7334, upload-time = "2025-11-19T20:55:51.612Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c5/55/51844dd50c4fc7a33b653bfaba4c2456f06955289ca770a5dbd5fd267374/cfgv-3.4.0-py2.py3-none-any.whl", hash = "sha256:b7265b1f29fd3316bfcd2b330d63d024f2bfd8bcb8b0272f8e19a504856c48f9", size = 7249, upload-time = "2023-08-12T20:38:16.269Z" },
+    { url = "https://files.pythonhosted.org/packages/db/3c/33bac158f8ab7f89b2e59426d5fe2e4f63f7ed25df84c036890172b412b5/cfgv-3.5.0-py2.py3-none-any.whl", hash = "sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0", size = 7445, upload-time = "2025-11-19T20:55:50.744Z" },
 ]
 
 [[package]]
 name = "charset-normalizer"
-version = "3.4.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/83/2d/5fd176ceb9b2fc619e63405525573493ca23441330fcdaee6bef9460e924/charset_normalizer-3.4.3.tar.gz", hash = "sha256:6fce4b8500244f6fcb71465d4a4930d132ba9ab8e71a7859e6a5d59851068d14", size = 122371, upload-time = "2025-08-09T07:57:28.46Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d6/98/f3b8013223728a99b908c9344da3aa04ee6e3fa235f19409033eda92fb78/charset_normalizer-3.4.3-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:fb7f67a1bfa6e40b438170ebdc8158b78dc465a5a67b6dde178a46987b244a72", size = 207695, upload-time = "2025-08-09T07:55:36.452Z" },
-    { url = "https://files.pythonhosted.org/packages/21/40/5188be1e3118c82dcb7c2a5ba101b783822cfb413a0268ed3be0468532de/charset_normalizer-3.4.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cc9370a2da1ac13f0153780040f465839e6cccb4a1e44810124b4e22483c93fe", size = 147153, upload-time = "2025-08-09T07:55:38.467Z" },
-    { url = "https://files.pythonhosted.org/packages/37/60/5d0d74bc1e1380f0b72c327948d9c2aca14b46a9efd87604e724260f384c/charset_normalizer-3.4.3-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:07a0eae9e2787b586e129fdcbe1af6997f8d0e5abaa0bc98c0e20e124d67e601", size = 160428, upload-time = "2025-08-09T07:55:40.072Z" },
-    { url = "https://files.pythonhosted.org/packages/85/9a/d891f63722d9158688de58d050c59dc3da560ea7f04f4c53e769de5140f5/charset_normalizer-3.4.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:74d77e25adda8581ffc1c720f1c81ca082921329452eba58b16233ab1842141c", size = 157627, upload-time = "2025-08-09T07:55:41.706Z" },
-    { url = "https://files.pythonhosted.org/packages/65/1a/7425c952944a6521a9cfa7e675343f83fd82085b8af2b1373a2409c683dc/charset_normalizer-3.4.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d0e909868420b7049dafd3a31d45125b31143eec59235311fc4c57ea26a4acd2", size = 152388, upload-time = "2025-08-09T07:55:43.262Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/c9/a2c9c2a355a8594ce2446085e2ec97fd44d323c684ff32042e2a6b718e1d/charset_normalizer-3.4.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:c6f162aabe9a91a309510d74eeb6507fab5fff92337a15acbe77753d88d9dcf0", size = 150077, upload-time = "2025-08-09T07:55:44.903Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/38/20a1f44e4851aa1c9105d6e7110c9d020e093dfa5836d712a5f074a12bf7/charset_normalizer-3.4.3-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:4ca4c094de7771a98d7fbd67d9e5dbf1eb73efa4f744a730437d8a3a5cf994f0", size = 161631, upload-time = "2025-08-09T07:55:46.346Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/fa/384d2c0f57edad03d7bec3ebefb462090d8905b4ff5a2d2525f3bb711fac/charset_normalizer-3.4.3-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:02425242e96bcf29a49711b0ca9f37e451da7c70562bc10e8ed992a5a7a25cc0", size = 159210, upload-time = "2025-08-09T07:55:47.539Z" },
-    { url = "https://files.pythonhosted.org/packages/33/9e/eca49d35867ca2db336b6ca27617deed4653b97ebf45dfc21311ce473c37/charset_normalizer-3.4.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:78deba4d8f9590fe4dae384aeff04082510a709957e968753ff3c48399f6f92a", size = 153739, upload-time = "2025-08-09T07:55:48.744Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/91/26c3036e62dfe8de8061182d33be5025e2424002125c9500faff74a6735e/charset_normalizer-3.4.3-cp310-cp310-win32.whl", hash = "sha256:d79c198e27580c8e958906f803e63cddb77653731be08851c7df0b1a14a8fc0f", size = 99825, upload-time = "2025-08-09T07:55:50.305Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/c6/f05db471f81af1fa01839d44ae2a8bfeec8d2a8b4590f16c4e7393afd323/charset_normalizer-3.4.3-cp310-cp310-win_amd64.whl", hash = "sha256:c6e490913a46fa054e03699c70019ab869e990270597018cef1d8562132c2669", size = 107452, upload-time = "2025-08-09T07:55:51.461Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/b5/991245018615474a60965a7c9cd2b4efbaabd16d582a5547c47ee1c7730b/charset_normalizer-3.4.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:b256ee2e749283ef3ddcff51a675ff43798d92d746d1a6e4631bf8c707d22d0b", size = 204483, upload-time = "2025-08-09T07:55:53.12Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/2a/ae245c41c06299ec18262825c1569c5d3298fc920e4ddf56ab011b417efd/charset_normalizer-3.4.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:13faeacfe61784e2559e690fc53fa4c5ae97c6fcedb8eb6fb8d0a15b475d2c64", size = 145520, upload-time = "2025-08-09T07:55:54.712Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/a4/b3b6c76e7a635748c4421d2b92c7b8f90a432f98bda5082049af37ffc8e3/charset_normalizer-3.4.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:00237675befef519d9af72169d8604a067d92755e84fe76492fef5441db05b91", size = 158876, upload-time = "2025-08-09T07:55:56.024Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/e6/63bb0e10f90a8243c5def74b5b105b3bbbfb3e7bb753915fe333fb0c11ea/charset_normalizer-3.4.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:585f3b2a80fbd26b048a0be90c5aae8f06605d3c92615911c3a2b03a8a3b796f", size = 156083, upload-time = "2025-08-09T07:55:57.582Z" },
-    { url = "https://files.pythonhosted.org/packages/87/df/b7737ff046c974b183ea9aa111b74185ac8c3a326c6262d413bd5a1b8c69/charset_normalizer-3.4.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0e78314bdc32fa80696f72fa16dc61168fda4d6a0c014e0380f9d02f0e5d8a07", size = 150295, upload-time = "2025-08-09T07:55:59.147Z" },
-    { url = "https://files.pythonhosted.org/packages/61/f1/190d9977e0084d3f1dc169acd060d479bbbc71b90bf3e7bf7b9927dec3eb/charset_normalizer-3.4.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:96b2b3d1a83ad55310de8c7b4a2d04d9277d5591f40761274856635acc5fcb30", size = 148379, upload-time = "2025-08-09T07:56:00.364Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/92/27dbe365d34c68cfe0ca76f1edd70e8705d82b378cb54ebbaeabc2e3029d/charset_normalizer-3.4.3-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:939578d9d8fd4299220161fdd76e86c6a251987476f5243e8864a7844476ba14", size = 160018, upload-time = "2025-08-09T07:56:01.678Z" },
-    { url = "https://files.pythonhosted.org/packages/99/04/baae2a1ea1893a01635d475b9261c889a18fd48393634b6270827869fa34/charset_normalizer-3.4.3-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:fd10de089bcdcd1be95a2f73dbe6254798ec1bda9f450d5828c96f93e2536b9c", size = 157430, upload-time = "2025-08-09T07:56:02.87Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/36/77da9c6a328c54d17b960c89eccacfab8271fdaaa228305330915b88afa9/charset_normalizer-3.4.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1e8ac75d72fa3775e0b7cb7e4629cec13b7514d928d15ef8ea06bca03ef01cae", size = 151600, upload-time = "2025-08-09T07:56:04.089Z" },
-    { url = "https://files.pythonhosted.org/packages/64/d4/9eb4ff2c167edbbf08cdd28e19078bf195762e9bd63371689cab5ecd3d0d/charset_normalizer-3.4.3-cp311-cp311-win32.whl", hash = "sha256:6cf8fd4c04756b6b60146d98cd8a77d0cdae0e1ca20329da2ac85eed779b6849", size = 99616, upload-time = "2025-08-09T07:56:05.658Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/9c/996a4a028222e7761a96634d1820de8a744ff4327a00ada9c8942033089b/charset_normalizer-3.4.3-cp311-cp311-win_amd64.whl", hash = "sha256:31a9a6f775f9bcd865d88ee350f0ffb0e25936a7f930ca98995c05abf1faf21c", size = 107108, upload-time = "2025-08-09T07:56:07.176Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/5e/14c94999e418d9b87682734589404a25854d5f5d0408df68bc15b6ff54bb/charset_normalizer-3.4.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:e28e334d3ff134e88989d90ba04b47d84382a828c061d0d1027b1b12a62b39b1", size = 205655, upload-time = "2025-08-09T07:56:08.475Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/a8/c6ec5d389672521f644505a257f50544c074cf5fc292d5390331cd6fc9c3/charset_normalizer-3.4.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0cacf8f7297b0c4fcb74227692ca46b4a5852f8f4f24b3c766dd94a1075c4884", size = 146223, upload-time = "2025-08-09T07:56:09.708Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/eb/a2ffb08547f4e1e5415fb69eb7db25932c52a52bed371429648db4d84fb1/charset_normalizer-3.4.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c6fd51128a41297f5409deab284fecbe5305ebd7e5a1f959bee1c054622b7018", size = 159366, upload-time = "2025-08-09T07:56:11.326Z" },
-    { url = "https://files.pythonhosted.org/packages/82/10/0fd19f20c624b278dddaf83b8464dcddc2456cb4b02bb902a6da126b87a1/charset_normalizer-3.4.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3cfb2aad70f2c6debfbcb717f23b7eb55febc0bb23dcffc0f076009da10c6392", size = 157104, upload-time = "2025-08-09T07:56:13.014Z" },
-    { url = "https://files.pythonhosted.org/packages/16/ab/0233c3231af734f5dfcf0844aa9582d5a1466c985bbed6cedab85af9bfe3/charset_normalizer-3.4.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1606f4a55c0fd363d754049cdf400175ee96c992b1f8018b993941f221221c5f", size = 151830, upload-time = "2025-08-09T07:56:14.428Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/02/e29e22b4e02839a0e4a06557b1999d0a47db3567e82989b5bb21f3fbbd9f/charset_normalizer-3.4.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:027b776c26d38b7f15b26a5da1044f376455fb3766df8fc38563b4efbc515154", size = 148854, upload-time = "2025-08-09T07:56:16.051Z" },
-    { url = "https://files.pythonhosted.org/packages/05/6b/e2539a0a4be302b481e8cafb5af8792da8093b486885a1ae4d15d452bcec/charset_normalizer-3.4.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:42e5088973e56e31e4fa58eb6bd709e42fc03799c11c42929592889a2e54c491", size = 160670, upload-time = "2025-08-09T07:56:17.314Z" },
-    { url = "https://files.pythonhosted.org/packages/31/e7/883ee5676a2ef217a40ce0bffcc3d0dfbf9e64cbcfbdf822c52981c3304b/charset_normalizer-3.4.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:cc34f233c9e71701040d772aa7490318673aa7164a0efe3172b2981218c26d93", size = 158501, upload-time = "2025-08-09T07:56:18.641Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/35/6525b21aa0db614cf8b5792d232021dca3df7f90a1944db934efa5d20bb1/charset_normalizer-3.4.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:320e8e66157cc4e247d9ddca8e21f427efc7a04bbd0ac8a9faf56583fa543f9f", size = 153173, upload-time = "2025-08-09T07:56:20.289Z" },
-    { url = "https://files.pythonhosted.org/packages/50/ee/f4704bad8201de513fdc8aac1cabc87e38c5818c93857140e06e772b5892/charset_normalizer-3.4.3-cp312-cp312-win32.whl", hash = "sha256:fb6fecfd65564f208cbf0fba07f107fb661bcd1a7c389edbced3f7a493f70e37", size = 99822, upload-time = "2025-08-09T07:56:21.551Z" },
-    { url = "https://files.pythonhosted.org/packages/39/f5/3b3836ca6064d0992c58c7561c6b6eee1b3892e9665d650c803bd5614522/charset_normalizer-3.4.3-cp312-cp312-win_amd64.whl", hash = "sha256:86df271bf921c2ee3818f0522e9a5b8092ca2ad8b065ece5d7d9d0e9f4849bcc", size = 107543, upload-time = "2025-08-09T07:56:23.115Z" },
-    { url = "https://files.pythonhosted.org/packages/65/ca/2135ac97709b400c7654b4b764daf5c5567c2da45a30cdd20f9eefe2d658/charset_normalizer-3.4.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:14c2a87c65b351109f6abfc424cab3927b3bdece6f706e4d12faaf3d52ee5efe", size = 205326, upload-time = "2025-08-09T07:56:24.721Z" },
-    { url = "https://files.pythonhosted.org/packages/71/11/98a04c3c97dd34e49c7d247083af03645ca3730809a5509443f3c37f7c99/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:41d1fc408ff5fdfb910200ec0e74abc40387bccb3252f3f27c0676731df2b2c8", size = 146008, upload-time = "2025-08-09T07:56:26.004Z" },
-    { url = "https://files.pythonhosted.org/packages/60/f5/4659a4cb3c4ec146bec80c32d8bb16033752574c20b1252ee842a95d1a1e/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1bb60174149316da1c35fa5233681f7c0f9f514509b8e399ab70fea5f17e45c9", size = 159196, upload-time = "2025-08-09T07:56:27.25Z" },
-    { url = "https://files.pythonhosted.org/packages/86/9e/f552f7a00611f168b9a5865a1414179b2c6de8235a4fa40189f6f79a1753/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:30d006f98569de3459c2fc1f2acde170b7b2bd265dc1943e87e1a4efe1b67c31", size = 156819, upload-time = "2025-08-09T07:56:28.515Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/95/42aa2156235cbc8fa61208aded06ef46111c4d3f0de233107b3f38631803/charset_normalizer-3.4.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:416175faf02e4b0810f1f38bcb54682878a4af94059a1cd63b8747244420801f", size = 151350, upload-time = "2025-08-09T07:56:29.716Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/a9/3865b02c56f300a6f94fc631ef54f0a8a29da74fb45a773dfd3dcd380af7/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:6aab0f181c486f973bc7262a97f5aca3ee7e1437011ef0c2ec04b5a11d16c927", size = 148644, upload-time = "2025-08-09T07:56:30.984Z" },
-    { url = "https://files.pythonhosted.org/packages/77/d9/cbcf1a2a5c7d7856f11e7ac2d782aec12bdfea60d104e60e0aa1c97849dc/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:fdabf8315679312cfa71302f9bd509ded4f2f263fb5b765cf1433b39106c3cc9", size = 160468, upload-time = "2025-08-09T07:56:32.252Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/42/6f45efee8697b89fda4d50580f292b8f7f9306cb2971d4b53f8914e4d890/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:bd28b817ea8c70215401f657edef3a8aa83c29d447fb0b622c35403780ba11d5", size = 158187, upload-time = "2025-08-09T07:56:33.481Z" },
-    { url = "https://files.pythonhosted.org/packages/70/99/f1c3bdcfaa9c45b3ce96f70b14f070411366fa19549c1d4832c935d8e2c3/charset_normalizer-3.4.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:18343b2d246dc6761a249ba1fb13f9ee9a2bcd95decc767319506056ea4ad4dc", size = 152699, upload-time = "2025-08-09T07:56:34.739Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/ad/b0081f2f99a4b194bcbb1934ef3b12aa4d9702ced80a37026b7607c72e58/charset_normalizer-3.4.3-cp313-cp313-win32.whl", hash = "sha256:6fb70de56f1859a3f71261cbe41005f56a7842cc348d3aeb26237560bfa5e0ce", size = 99580, upload-time = "2025-08-09T07:56:35.981Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/8f/ae790790c7b64f925e5c953b924aaa42a243fb778fed9e41f147b2a5715a/charset_normalizer-3.4.3-cp313-cp313-win_amd64.whl", hash = "sha256:cf1ebb7d78e1ad8ec2a8c4732c7be2e736f6e5123a4146c5b89c9d1f585f8cef", size = 107366, upload-time = "2025-08-09T07:56:37.339Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/91/b5a06ad970ddc7a0e513112d40113e834638f4ca1120eb727a249fb2715e/charset_normalizer-3.4.3-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:3cd35b7e8aedeb9e34c41385fda4f73ba609e561faedfae0a9e75e44ac558a15", size = 204342, upload-time = "2025-08-09T07:56:38.687Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/ec/1edc30a377f0a02689342f214455c3f6c2fbedd896a1d2f856c002fc3062/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b89bc04de1d83006373429975f8ef9e7932534b8cc9ca582e4db7d20d91816db", size = 145995, upload-time = "2025-08-09T07:56:40.048Z" },
-    { url = "https://files.pythonhosted.org/packages/17/e5/5e67ab85e6d22b04641acb5399c8684f4d37caf7558a53859f0283a650e9/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2001a39612b241dae17b4687898843f254f8748b796a2e16f1051a17078d991d", size = 158640, upload-time = "2025-08-09T07:56:41.311Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/e5/38421987f6c697ee3722981289d554957c4be652f963d71c5e46a262e135/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8dcfc373f888e4fb39a7bc57e93e3b845e7f462dacc008d9749568b1c4ece096", size = 156636, upload-time = "2025-08-09T07:56:43.195Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/e4/5a075de8daa3ec0745a9a3b54467e0c2967daaaf2cec04c845f73493e9a1/charset_normalizer-3.4.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:18b97b8404387b96cdbd30ad660f6407799126d26a39ca65729162fd810a99aa", size = 150939, upload-time = "2025-08-09T07:56:44.819Z" },
-    { url = "https://files.pythonhosted.org/packages/02/f7/3611b32318b30974131db62b4043f335861d4d9b49adc6d57c1149cc49d4/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ccf600859c183d70eb47e05a44cd80a4ce77394d1ac0f79dbd2dd90a69a3a049", size = 148580, upload-time = "2025-08-09T07:56:46.684Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/61/19b36f4bd67f2793ab6a99b979b4e4f3d8fc754cbdffb805335df4337126/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:53cd68b185d98dde4ad8990e56a58dea83a4162161b1ea9272e5c9182ce415e0", size = 159870, upload-time = "2025-08-09T07:56:47.941Z" },
-    { url = "https://files.pythonhosted.org/packages/06/57/84722eefdd338c04cf3030ada66889298eaedf3e7a30a624201e0cbe424a/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:30a96e1e1f865f78b030d65241c1ee850cdf422d869e9028e2fc1d5e4db73b92", size = 157797, upload-time = "2025-08-09T07:56:49.756Z" },
-    { url = "https://files.pythonhosted.org/packages/72/2a/aff5dd112b2f14bcc3462c312dce5445806bfc8ab3a7328555da95330e4b/charset_normalizer-3.4.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:d716a916938e03231e86e43782ca7878fb602a125a91e7acb8b5112e2e96ac16", size = 152224, upload-time = "2025-08-09T07:56:51.369Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/8c/9839225320046ed279c6e839d51f028342eb77c91c89b8ef2549f951f3ec/charset_normalizer-3.4.3-cp314-cp314-win32.whl", hash = "sha256:c6dbd0ccdda3a2ba7c2ecd9d77b37f3b5831687d8dc1b6ca5f56a4880cc7b7ce", size = 100086, upload-time = "2025-08-09T07:56:52.722Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/7a/36fbcf646e41f710ce0a563c1c9a343c6edf9be80786edeb15b6f62e17db/charset_normalizer-3.4.3-cp314-cp314-win_amd64.whl", hash = "sha256:73dc19b562516fc9bcf6e5d6e596df0b4eb98d87e4f79f3ae71840e6ed21361c", size = 107400, upload-time = "2025-08-09T07:56:55.172Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/1f/f041989e93b001bc4e44bb1669ccdcf54d3f00e628229a85b08d330615c5/charset_normalizer-3.4.3-py3-none-any.whl", hash = "sha256:ce571ab16d890d23b5c278547ba694193a45011ff86a9162a71307ed9f86759a", size = 53175, upload-time = "2025-08-09T07:57:26.864Z" },
+version = "3.4.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/13/69/33ddede1939fdd074bce5434295f38fae7136463422fe4fd3e0e89b98062/charset_normalizer-3.4.4.tar.gz", hash = "sha256:94537985111c35f28720e43603b8e7b43a6ecfb2ce1d3058bbe955b73404e21a", size = 129418, upload-time = "2025-10-14T04:42:32.879Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1f/b8/6d51fc1d52cbd52cd4ccedd5b5b2f0f6a11bbf6765c782298b0f3e808541/charset_normalizer-3.4.4-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e824f1492727fa856dd6eda4f7cee25f8518a12f3c4a56a74e8095695089cf6d", size = 209709, upload-time = "2025-10-14T04:40:11.385Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/af/1f9d7f7faafe2ddfb6f72a2e07a548a629c61ad510fe60f9630309908fef/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4bd5d4137d500351a30687c2d3971758aac9a19208fc110ccb9d7188fbe709e8", size = 148814, upload-time = "2025-10-14T04:40:13.135Z" },
+    { url = "https://files.pythonhosted.org/packages/79/3d/f2e3ac2bbc056ca0c204298ea4e3d9db9b4afe437812638759db2c976b5f/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:027f6de494925c0ab2a55eab46ae5129951638a49a34d87f4c3eda90f696b4ad", size = 144467, upload-time = "2025-10-14T04:40:14.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/85/1bf997003815e60d57de7bd972c57dc6950446a3e4ccac43bc3070721856/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f820802628d2694cb7e56db99213f930856014862f3fd943d290ea8438d07ca8", size = 162280, upload-time = "2025-10-14T04:40:16.14Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/8e/6aa1952f56b192f54921c436b87f2aaf7c7a7c3d0d1a765547d64fd83c13/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:798d75d81754988d2565bff1b97ba5a44411867c0cf32b77a7e8f8d84796b10d", size = 159454, upload-time = "2025-10-14T04:40:17.567Z" },
+    { url = "https://files.pythonhosted.org/packages/36/3b/60cbd1f8e93aa25d1c669c649b7a655b0b5fb4c571858910ea9332678558/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d1bb833febdff5c8927f922386db610b49db6e0d4f4ee29601d71e7c2694313", size = 153609, upload-time = "2025-10-14T04:40:19.08Z" },
+    { url = "https://files.pythonhosted.org/packages/64/91/6a13396948b8fd3c4b4fd5bc74d045f5637d78c9675585e8e9fbe5636554/charset_normalizer-3.4.4-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:9cd98cdc06614a2f768d2b7286d66805f94c48cde050acdbbb7db2600ab3197e", size = 151849, upload-time = "2025-10-14T04:40:20.607Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/7a/59482e28b9981d105691e968c544cc0df3b7d6133152fb3dcdc8f135da7a/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:077fbb858e903c73f6c9db43374fd213b0b6a778106bc7032446a8e8b5b38b93", size = 151586, upload-time = "2025-10-14T04:40:21.719Z" },
+    { url = "https://files.pythonhosted.org/packages/92/59/f64ef6a1c4bdd2baf892b04cd78792ed8684fbc48d4c2afe467d96b4df57/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:244bfb999c71b35de57821b8ea746b24e863398194a4014e4c76adc2bbdfeff0", size = 145290, upload-time = "2025-10-14T04:40:23.069Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/63/3bf9f279ddfa641ffa1962b0db6a57a9c294361cc2f5fcac997049a00e9c/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:64b55f9dce520635f018f907ff1b0df1fdc31f2795a922fb49dd14fbcdf48c84", size = 163663, upload-time = "2025-10-14T04:40:24.17Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/09/c9e38fc8fa9e0849b172b581fd9803bdf6e694041127933934184e19f8c3/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:faa3a41b2b66b6e50f84ae4a68c64fcd0c44355741c6374813a800cd6695db9e", size = 151964, upload-time = "2025-10-14T04:40:25.368Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/d1/d28b747e512d0da79d8b6a1ac18b7ab2ecfd81b2944c4c710e166d8dd09c/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:6515f3182dbe4ea06ced2d9e8666d97b46ef4c75e326b79bb624110f122551db", size = 161064, upload-time = "2025-10-14T04:40:26.806Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/9a/31d62b611d901c3b9e5500c36aab0ff5eb442043fb3a1c254200d3d397d9/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:cc00f04ed596e9dc0da42ed17ac5e596c6ccba999ba6bd92b0e0aef2f170f2d6", size = 155015, upload-time = "2025-10-14T04:40:28.284Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/f3/107e008fa2bff0c8b9319584174418e5e5285fef32f79d8ee6a430d0039c/charset_normalizer-3.4.4-cp310-cp310-win32.whl", hash = "sha256:f34be2938726fc13801220747472850852fe6b1ea75869a048d6f896838c896f", size = 99792, upload-time = "2025-10-14T04:40:29.613Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/66/e396e8a408843337d7315bab30dbf106c38966f1819f123257f5520f8a96/charset_normalizer-3.4.4-cp310-cp310-win_amd64.whl", hash = "sha256:a61900df84c667873b292c3de315a786dd8dac506704dea57bc957bd31e22c7d", size = 107198, upload-time = "2025-10-14T04:40:30.644Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/58/01b4f815bf0312704c267f2ccb6e5d42bcc7752340cd487bc9f8c3710597/charset_normalizer-3.4.4-cp310-cp310-win_arm64.whl", hash = "sha256:cead0978fc57397645f12578bfd2d5ea9138ea0fac82b2f63f7f7c6877986a69", size = 100262, upload-time = "2025-10-14T04:40:32.108Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/27/c6491ff4954e58a10f69ad90aca8a1b6fe9c5d3c6f380907af3c37435b59/charset_normalizer-3.4.4-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:6e1fcf0720908f200cd21aa4e6750a48ff6ce4afe7ff5a79a90d5ed8a08296f8", size = 206988, upload-time = "2025-10-14T04:40:33.79Z" },
+    { url = "https://files.pythonhosted.org/packages/94/59/2e87300fe67ab820b5428580a53cad894272dbb97f38a7a814a2a1ac1011/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f819d5fe9234f9f82d75bdfa9aef3a3d72c4d24a6e57aeaebba32a704553aa0", size = 147324, upload-time = "2025-10-14T04:40:34.961Z" },
+    { url = "https://files.pythonhosted.org/packages/07/fb/0cf61dc84b2b088391830f6274cb57c82e4da8bbc2efeac8c025edb88772/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a59cb51917aa591b1c4e6a43c132f0cdc3c76dbad6155df4e28ee626cc77a0a3", size = 142742, upload-time = "2025-10-14T04:40:36.105Z" },
+    { url = "https://files.pythonhosted.org/packages/62/8b/171935adf2312cd745d290ed93cf16cf0dfe320863ab7cbeeae1dcd6535f/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8ef3c867360f88ac904fd3f5e1f902f13307af9052646963ee08ff4f131adafc", size = 160863, upload-time = "2025-10-14T04:40:37.188Z" },
+    { url = "https://files.pythonhosted.org/packages/09/73/ad875b192bda14f2173bfc1bc9a55e009808484a4b256748d931b6948442/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d9e45d7faa48ee908174d8fe84854479ef838fc6a705c9315372eacbc2f02897", size = 157837, upload-time = "2025-10-14T04:40:38.435Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/fc/de9cce525b2c5b94b47c70a4b4fb19f871b24995c728e957ee68ab1671ea/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:840c25fb618a231545cbab0564a799f101b63b9901f2569faecd6b222ac72381", size = 151550, upload-time = "2025-10-14T04:40:40.053Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c2/43edd615fdfba8c6f2dfbd459b25a6b3b551f24ea21981e23fb768503ce1/charset_normalizer-3.4.4-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ca5862d5b3928c4940729dacc329aa9102900382fea192fc5e52eb69d6093815", size = 149162, upload-time = "2025-10-14T04:40:41.163Z" },
+    { url = "https://files.pythonhosted.org/packages/03/86/bde4ad8b4d0e9429a4e82c1e8f5c659993a9a863ad62c7df05cf7b678d75/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d9c7f57c3d666a53421049053eaacdd14bbd0a528e2186fcb2e672effd053bb0", size = 150019, upload-time = "2025-10-14T04:40:42.276Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/86/a151eb2af293a7e7bac3a739b81072585ce36ccfb4493039f49f1d3cae8c/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:277e970e750505ed74c832b4bf75dac7476262ee2a013f5574dd49075879e161", size = 143310, upload-time = "2025-10-14T04:40:43.439Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/fe/43dae6144a7e07b87478fdfc4dbe9efd5defb0e7ec29f5f58a55aeef7bf7/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:31fd66405eaf47bb62e8cd575dc621c56c668f27d46a61d975a249930dd5e2a4", size = 162022, upload-time = "2025-10-14T04:40:44.547Z" },
+    { url = "https://files.pythonhosted.org/packages/80/e6/7aab83774f5d2bca81f42ac58d04caf44f0cc2b65fc6db2b3b2e8a05f3b3/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:0d3d8f15c07f86e9ff82319b3d9ef6f4bf907608f53fe9d92b28ea9ae3d1fd89", size = 149383, upload-time = "2025-10-14T04:40:46.018Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/e8/b289173b4edae05c0dde07f69f8db476a0b511eac556dfe0d6bda3c43384/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:9f7fcd74d410a36883701fafa2482a6af2ff5ba96b9a620e9e0721e28ead5569", size = 159098, upload-time = "2025-10-14T04:40:47.081Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/df/fe699727754cae3f8478493c7f45f777b17c3ef0600e28abfec8619eb49c/charset_normalizer-3.4.4-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ebf3e58c7ec8a8bed6d66a75d7fb37b55e5015b03ceae72a8e7c74495551e224", size = 152991, upload-time = "2025-10-14T04:40:48.246Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/86/584869fe4ddb6ffa3bd9f491b87a01568797fb9bd8933f557dba9771beaf/charset_normalizer-3.4.4-cp311-cp311-win32.whl", hash = "sha256:eecbc200c7fd5ddb9a7f16c7decb07b566c29fa2161a16cf67b8d068bd21690a", size = 99456, upload-time = "2025-10-14T04:40:49.376Z" },
+    { url = "https://files.pythonhosted.org/packages/65/f6/62fdd5feb60530f50f7e38b4f6a1d5203f4d16ff4f9f0952962c044e919a/charset_normalizer-3.4.4-cp311-cp311-win_amd64.whl", hash = "sha256:5ae497466c7901d54b639cf42d5b8c1b6a4fead55215500d2f486d34db48d016", size = 106978, upload-time = "2025-10-14T04:40:50.844Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/9d/0710916e6c82948b3be62d9d398cb4fcf4e97b56d6a6aeccd66c4b2f2bd5/charset_normalizer-3.4.4-cp311-cp311-win_arm64.whl", hash = "sha256:65e2befcd84bc6f37095f5961e68a6f077bf44946771354a28ad434c2cce0ae1", size = 99969, upload-time = "2025-10-14T04:40:52.272Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/85/1637cd4af66fa687396e757dec650f28025f2a2f5a5531a3208dc0ec43f2/charset_normalizer-3.4.4-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:0a98e6759f854bd25a58a73fa88833fba3b7c491169f86ce1180c948ab3fd394", size = 208425, upload-time = "2025-10-14T04:40:53.353Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/6a/04130023fef2a0d9c62d0bae2649b69f7b7d8d24ea5536feef50551029df/charset_normalizer-3.4.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b5b290ccc2a263e8d185130284f8501e3e36c5e02750fc6b6bdeb2e9e96f1e25", size = 148162, upload-time = "2025-10-14T04:40:54.558Z" },
+    { url = "https://files.pythonhosted.org/packages/78/29/62328d79aa60da22c9e0b9a66539feae06ca0f5a4171ac4f7dc285b83688/charset_normalizer-3.4.4-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74bb723680f9f7a6234dcf67aea57e708ec1fbdf5699fb91dfd6f511b0a320ef", size = 144558, upload-time = "2025-10-14T04:40:55.677Z" },
+    { url = "https://files.pythonhosted.org/packages/86/bb/b32194a4bf15b88403537c2e120b817c61cd4ecffa9b6876e941c3ee38fe/charset_normalizer-3.4.4-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f1e34719c6ed0b92f418c7c780480b26b5d9c50349e9a9af7d76bf757530350d", size = 161497, upload-time = "2025-10-14T04:40:57.217Z" },
+    { url = "https://files.pythonhosted.org/packages/19/89/a54c82b253d5b9b111dc74aca196ba5ccfcca8242d0fb64146d4d3183ff1/charset_normalizer-3.4.4-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2437418e20515acec67d86e12bf70056a33abdacb5cb1655042f6538d6b085a8", size = 159240, upload-time = "2025-10-14T04:40:58.358Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/10/d20b513afe03acc89ec33948320a5544d31f21b05368436d580dec4e234d/charset_normalizer-3.4.4-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:11d694519d7f29d6cd09f6ac70028dba10f92f6cdd059096db198c283794ac86", size = 153471, upload-time = "2025-10-14T04:40:59.468Z" },
+    { url = "https://files.pythonhosted.org/packages/61/fa/fbf177b55bdd727010f9c0a3c49eefa1d10f960e5f09d1d887bf93c2e698/charset_normalizer-3.4.4-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ac1c4a689edcc530fc9d9aa11f5774b9e2f33f9a0c6a57864e90908f5208d30a", size = 150864, upload-time = "2025-10-14T04:41:00.623Z" },
+    { url = "https://files.pythonhosted.org/packages/05/12/9fbc6a4d39c0198adeebbde20b619790e9236557ca59fc40e0e3cebe6f40/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:21d142cc6c0ec30d2efee5068ca36c128a30b0f2c53c1c07bd78cb6bc1d3be5f", size = 150647, upload-time = "2025-10-14T04:41:01.754Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/1f/6a9a593d52e3e8c5d2b167daf8c6b968808efb57ef4c210acb907c365bc4/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:5dbe56a36425d26d6cfb40ce79c314a2e4dd6211d51d6d2191c00bed34f354cc", size = 145110, upload-time = "2025-10-14T04:41:03.231Z" },
+    { url = "https://files.pythonhosted.org/packages/30/42/9a52c609e72471b0fc54386dc63c3781a387bb4fe61c20231a4ebcd58bdd/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:5bfbb1b9acf3334612667b61bd3002196fe2a1eb4dd74d247e0f2a4d50ec9bbf", size = 162839, upload-time = "2025-10-14T04:41:04.715Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/5b/c0682bbf9f11597073052628ddd38344a3d673fda35a36773f7d19344b23/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:d055ec1e26e441f6187acf818b73564e6e6282709e9bcb5b63f5b23068356a15", size = 150667, upload-time = "2025-10-14T04:41:05.827Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/24/a41afeab6f990cf2daf6cb8c67419b63b48cf518e4f56022230840c9bfb2/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:af2d8c67d8e573d6de5bc30cdb27e9b95e49115cd9baad5ddbd1a6207aaa82a9", size = 160535, upload-time = "2025-10-14T04:41:06.938Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/e5/6a4ce77ed243c4a50a1fecca6aaaab419628c818a49434be428fe24c9957/charset_normalizer-3.4.4-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:780236ac706e66881f3b7f2f32dfe90507a09e67d1d454c762cf642e6e1586e0", size = 154816, upload-time = "2025-10-14T04:41:08.101Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ef/89297262b8092b312d29cdb2517cb1237e51db8ecef2e9af5edbe7b683b1/charset_normalizer-3.4.4-cp312-cp312-win32.whl", hash = "sha256:5833d2c39d8896e4e19b689ffc198f08ea58116bee26dea51e362ecc7cd3ed26", size = 99694, upload-time = "2025-10-14T04:41:09.23Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/2d/1e5ed9dd3b3803994c155cd9aacb60c82c331bad84daf75bcb9c91b3295e/charset_normalizer-3.4.4-cp312-cp312-win_amd64.whl", hash = "sha256:a79cfe37875f822425b89a82333404539ae63dbdddf97f84dcbc3d339aae9525", size = 107131, upload-time = "2025-10-14T04:41:10.467Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/d9/0ed4c7098a861482a7b6a95603edce4c0d9db2311af23da1fb2b75ec26fc/charset_normalizer-3.4.4-cp312-cp312-win_arm64.whl", hash = "sha256:376bec83a63b8021bb5c8ea75e21c4ccb86e7e45ca4eb81146091b56599b80c3", size = 100390, upload-time = "2025-10-14T04:41:11.915Z" },
+    { url = "https://files.pythonhosted.org/packages/97/45/4b3a1239bbacd321068ea6e7ac28875b03ab8bc0aa0966452db17cd36714/charset_normalizer-3.4.4-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:e1f185f86a6f3403aa2420e815904c67b2f9ebc443f045edd0de921108345794", size = 208091, upload-time = "2025-10-14T04:41:13.346Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/73a6d7450829655a35bb88a88fca7d736f9882a27eacdca2c6d505b57e2e/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b39f987ae8ccdf0d2642338faf2abb1862340facc796048b604ef14919e55ed", size = 147936, upload-time = "2025-10-14T04:41:14.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c5/adb8c8b3d6625bef6d88b251bbb0d95f8205831b987631ab0c8bb5d937c2/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3162d5d8ce1bb98dd51af660f2121c55d0fa541b46dff7bb9b9f86ea1d87de72", size = 144180, upload-time = "2025-10-14T04:41:15.588Z" },
+    { url = "https://files.pythonhosted.org/packages/91/ed/9706e4070682d1cc219050b6048bfd293ccf67b3d4f5a4f39207453d4b99/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:81d5eb2a312700f4ecaa977a8235b634ce853200e828fbadf3a9c50bab278328", size = 161346, upload-time = "2025-10-14T04:41:16.738Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/0d/031f0d95e4972901a2f6f09ef055751805ff541511dc1252ba3ca1f80cf5/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5bd2293095d766545ec1a8f612559f6b40abc0eb18bb2f5d1171872d34036ede", size = 158874, upload-time = "2025-10-14T04:41:17.923Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/83/6ab5883f57c9c801ce5e5677242328aa45592be8a00644310a008d04f922/charset_normalizer-3.4.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a8a8b89589086a25749f471e6a900d3f662d1d3b6e2e59dcecf787b1cc3a1894", size = 153076, upload-time = "2025-10-14T04:41:19.106Z" },
+    { url = "https://files.pythonhosted.org/packages/75/1e/5ff781ddf5260e387d6419959ee89ef13878229732732ee73cdae01800f2/charset_normalizer-3.4.4-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc7637e2f80d8530ee4a78e878bce464f70087ce73cf7c1caf142416923b98f1", size = 150601, upload-time = "2025-10-14T04:41:20.245Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/57/71be810965493d3510a6ca79b90c19e48696fb1ff964da319334b12677f0/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f8bf04158c6b607d747e93949aa60618b61312fe647a6369f88ce2ff16043490", size = 150376, upload-time = "2025-10-14T04:41:21.398Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/d5/c3d057a78c181d007014feb7e9f2e65905a6c4ef182c0ddf0de2924edd65/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:554af85e960429cf30784dd47447d5125aaa3b99a6f0683589dbd27e2f45da44", size = 144825, upload-time = "2025-10-14T04:41:22.583Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8c/d0406294828d4976f275ffbe66f00266c4b3136b7506941d87c00cab5272/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:74018750915ee7ad843a774364e13a3db91682f26142baddf775342c3f5b1133", size = 162583, upload-time = "2025-10-14T04:41:23.754Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/24/e2aa1f18c8f15c4c0e932d9287b8609dd30ad56dbe41d926bd846e22fb8d/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c0463276121fdee9c49b98908b3a89c39be45d86d1dbaa22957e38f6321d4ce3", size = 150366, upload-time = "2025-10-14T04:41:25.27Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/5b/1e6160c7739aad1e2df054300cc618b06bf784a7a164b0f238360721ab86/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:362d61fd13843997c1c446760ef36f240cf81d3ebf74ac62652aebaf7838561e", size = 160300, upload-time = "2025-10-14T04:41:26.725Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/10/f882167cd207fbdd743e55534d5d9620e095089d176d55cb22d5322f2afd/charset_normalizer-3.4.4-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9a26f18905b8dd5d685d6d07b0cdf98a79f3c7a918906af7cc143ea2e164c8bc", size = 154465, upload-time = "2025-10-14T04:41:28.322Z" },
+    { url = "https://files.pythonhosted.org/packages/89/66/c7a9e1b7429be72123441bfdbaf2bc13faab3f90b933f664db506dea5915/charset_normalizer-3.4.4-cp313-cp313-win32.whl", hash = "sha256:9b35f4c90079ff2e2edc5b26c0c77925e5d2d255c42c74fdb70fb49b172726ac", size = 99404, upload-time = "2025-10-14T04:41:29.95Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/26/b9924fa27db384bdcd97ab83b4f0a8058d96ad9626ead570674d5e737d90/charset_normalizer-3.4.4-cp313-cp313-win_amd64.whl", hash = "sha256:b435cba5f4f750aa6c0a0d92c541fb79f69a387c91e61f1795227e4ed9cece14", size = 107092, upload-time = "2025-10-14T04:41:31.188Z" },
+    { url = "https://files.pythonhosted.org/packages/af/8f/3ed4bfa0c0c72a7ca17f0380cd9e4dd842b09f664e780c13cff1dcf2ef1b/charset_normalizer-3.4.4-cp313-cp313-win_arm64.whl", hash = "sha256:542d2cee80be6f80247095cc36c418f7bddd14f4a6de45af91dfad36d817bba2", size = 100408, upload-time = "2025-10-14T04:41:32.624Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/35/7051599bd493e62411d6ede36fd5af83a38f37c4767b92884df7301db25d/charset_normalizer-3.4.4-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:da3326d9e65ef63a817ecbcc0df6e94463713b754fe293eaa03da99befb9a5bd", size = 207746, upload-time = "2025-10-14T04:41:33.773Z" },
+    { url = "https://files.pythonhosted.org/packages/10/9a/97c8d48ef10d6cd4fcead2415523221624bf58bcf68a802721a6bc807c8f/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8af65f14dc14a79b924524b1e7fffe304517b2bff5a58bf64f30b98bbc5079eb", size = 147889, upload-time = "2025-10-14T04:41:34.897Z" },
+    { url = "https://files.pythonhosted.org/packages/10/bf/979224a919a1b606c82bd2c5fa49b5c6d5727aa47b4312bb27b1734f53cd/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:74664978bb272435107de04e36db5a9735e78232b85b77d45cfb38f758efd33e", size = 143641, upload-time = "2025-10-14T04:41:36.116Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/33/0ad65587441fc730dc7bd90e9716b30b4702dc7b617e6ba4997dc8651495/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:752944c7ffbfdd10c074dc58ec2d5a8a4cd9493b314d367c14d24c17684ddd14", size = 160779, upload-time = "2025-10-14T04:41:37.229Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ed/331d6b249259ee71ddea93f6f2f0a56cfebd46938bde6fcc6f7b9a3d0e09/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d1f13550535ad8cff21b8d757a3257963e951d96e20ec82ab44bc64aeb62a191", size = 159035, upload-time = "2025-10-14T04:41:38.368Z" },
+    { url = "https://files.pythonhosted.org/packages/67/ff/f6b948ca32e4f2a4576aa129d8bed61f2e0543bf9f5f2b7fc3758ed005c9/charset_normalizer-3.4.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ecaae4149d99b1c9e7b88bb03e3221956f68fd6d50be2ef061b2381b61d20838", size = 152542, upload-time = "2025-10-14T04:41:39.862Z" },
+    { url = "https://files.pythonhosted.org/packages/16/85/276033dcbcc369eb176594de22728541a925b2632f9716428c851b149e83/charset_normalizer-3.4.4-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cb6254dc36b47a990e59e1068afacdcd02958bdcce30bb50cc1700a8b9d624a6", size = 149524, upload-time = "2025-10-14T04:41:41.319Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/f2/6a2a1f722b6aba37050e626530a46a68f74e63683947a8acff92569f979a/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:c8ae8a0f02f57a6e61203a31428fa1d677cbe50c93622b4149d5c0f319c1d19e", size = 150395, upload-time = "2025-10-14T04:41:42.539Z" },
+    { url = "https://files.pythonhosted.org/packages/60/bb/2186cb2f2bbaea6338cad15ce23a67f9b0672929744381e28b0592676824/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:47cc91b2f4dd2833fddaedd2893006b0106129d4b94fdb6af1f4ce5a9965577c", size = 143680, upload-time = "2025-10-14T04:41:43.661Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/a5/bf6f13b772fbb2a90360eb620d52ed8f796f3c5caee8398c3b2eb7b1c60d/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:82004af6c302b5d3ab2cfc4cc5f29db16123b1a8417f2e25f9066f91d4411090", size = 162045, upload-time = "2025-10-14T04:41:44.821Z" },
+    { url = "https://files.pythonhosted.org/packages/df/c5/d1be898bf0dc3ef9030c3825e5d3b83f2c528d207d246cbabe245966808d/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7d8f6c26245217bd2ad053761201e9f9680f8ce52f0fcd8d0755aeae5b2152", size = 149687, upload-time = "2025-10-14T04:41:46.442Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/42/90c1f7b9341eef50c8a1cb3f098ac43b0508413f33affd762855f67a410e/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:799a7a5e4fb2d5898c60b640fd4981d6a25f1c11790935a44ce38c54e985f828", size = 160014, upload-time = "2025-10-14T04:41:47.631Z" },
+    { url = "https://files.pythonhosted.org/packages/76/be/4d3ee471e8145d12795ab655ece37baed0929462a86e72372fd25859047c/charset_normalizer-3.4.4-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:99ae2cffebb06e6c22bdc25801d7b30f503cc87dbd283479e7b606f70aff57ec", size = 154044, upload-time = "2025-10-14T04:41:48.81Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6f/8f7af07237c34a1defe7defc565a9bc1807762f672c0fde711a4b22bf9c0/charset_normalizer-3.4.4-cp314-cp314-win32.whl", hash = "sha256:f9d332f8c2a2fcbffe1378594431458ddbef721c1769d78e2cbc06280d8155f9", size = 99940, upload-time = "2025-10-14T04:41:49.946Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/51/8ade005e5ca5b0d80fb4aff72a3775b325bdc3d27408c8113811a7cbe640/charset_normalizer-3.4.4-cp314-cp314-win_amd64.whl", hash = "sha256:8a6562c3700cce886c5be75ade4a5db4214fda19fede41d9792d100288d8f94c", size = 107104, upload-time = "2025-10-14T04:41:51.051Z" },
+    { url = "https://files.pythonhosted.org/packages/da/5f/6b8f83a55bb8278772c5ae54a577f3099025f9ade59d0136ac24a0df4bde/charset_normalizer-3.4.4-cp314-cp314-win_arm64.whl", hash = "sha256:de00632ca48df9daf77a2c65a484531649261ec9f25489917f09e455cb09ddb2", size = 100743, upload-time = "2025-10-14T04:41:52.122Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/4c/925909008ed5a988ccbb72dcc897407e5d6d3bd72410d69e051fc0c14647/charset_normalizer-3.4.4-py3-none-any.whl", hash = "sha256:7a32c560861a02ff789ad905a2fe94e3f840803362c84fecf1851cb4cf3dc37f", size = 53402, upload-time = "2025-10-14T04:42:31.76Z" },
 ]
 
 [[package]]
 name = "click"
-version = "8.2.1"
+version = "8.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/60/6c/8ca2efa64cf75a977a0d7fac081354553ebe483345c734fb6b6515d96bbc/click-8.2.1.tar.gz", hash = "sha256:27c491cc05d968d271d5a1db13e3b5a184636d9d930f148c50b038f0d0646202", size = 286342, upload-time = "2025-05-20T23:19:49.832Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3d/fa/656b739db8587d7b5dfa22e22ed02566950fbfbcdc20311993483657a5c0/click-8.3.1.tar.gz", hash = "sha256:12ff4785d337a1bb490bb7e9c2b1ee5da3112e94a8622f26a6c77f5d2fc6842a", size = 295065, upload-time = "2025-11-15T20:45:42.706Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/85/32/10bb5764d90a8eee674e9dc6f4db6a0ab47c8c4d0d83c27f7c39ac415a4d/click-8.2.1-py3-none-any.whl", hash = "sha256:61a3265b914e850b85317d0b3109c7f8cd35a670f963866005d6ef1d5175a12b", size = 102215, upload-time = "2025-05-20T23:19:47.796Z" },
+    { url = "https://files.pythonhosted.org/packages/98/78/01c019cdb5d6498122777c1a43056ebb3ebfeef2076d9d026bfe15583b2b/click-8.3.1-py3-none-any.whl", hash = "sha256:981153a64e25f12d547d3426c367a4857371575ee7ad18df2a6183ab0545b2a6", size = 108274, upload-time = "2025-11-15T20:45:41.139Z" },
 ]
 
 [[package]]
@@ -206,87 +347,101 @@ wheels = [
 
 [[package]]
 name = "coverage"
-version = "7.10.5"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/61/83/153f54356c7c200013a752ce1ed5448573dca546ce125801afca9e1ac1a4/coverage-7.10.5.tar.gz", hash = "sha256:f2e57716a78bc3ae80b2207be0709a3b2b63b9f2dcf9740ee6ac03588a2015b6", size = 821662, upload-time = "2025-08-23T14:42:44.78Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/af/70/e77b0061a6c7157bfce645c6b9a715a08d4c86b3360a7b3252818080b817/coverage-7.10.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:c6a5c3414bfc7451b879141ce772c546985163cf553f08e0f135f0699a911801", size = 216774, upload-time = "2025-08-23T14:40:26.301Z" },
-    { url = "https://files.pythonhosted.org/packages/91/08/2a79de5ecf37ee40f2d898012306f11c161548753391cec763f92647837b/coverage-7.10.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:bc8e4d99ce82f1710cc3c125adc30fd1487d3cf6c2cd4994d78d68a47b16989a", size = 217175, upload-time = "2025-08-23T14:40:29.142Z" },
-    { url = "https://files.pythonhosted.org/packages/64/57/0171d69a699690149a6ba6a4eb702814448c8d617cf62dbafa7ce6bfdf63/coverage-7.10.5-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:02252dc1216e512a9311f596b3169fad54abcb13827a8d76d5630c798a50a754", size = 243931, upload-time = "2025-08-23T14:40:30.735Z" },
-    { url = "https://files.pythonhosted.org/packages/15/06/3a67662c55656702bd398a727a7f35df598eb11104fcb34f1ecbb070291a/coverage-7.10.5-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:73269df37883e02d460bee0cc16be90509faea1e3bd105d77360b512d5bb9c33", size = 245740, upload-time = "2025-08-23T14:40:32.302Z" },
-    { url = "https://files.pythonhosted.org/packages/00/f4/f8763aabf4dc30ef0d0012522d312f0b7f9fede6246a1f27dbcc4a1e523c/coverage-7.10.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1f8a81b0614642f91c9effd53eec284f965577591f51f547a1cbeb32035b4c2f", size = 247600, upload-time = "2025-08-23T14:40:33.66Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/31/6632219a9065e1b83f77eda116fed4c76fb64908a6a9feae41816dab8237/coverage-7.10.5-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:6a29f8e0adb7f8c2b95fa2d4566a1d6e6722e0a637634c6563cb1ab844427dd9", size = 245640, upload-time = "2025-08-23T14:40:35.248Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/e2/3dba9b86037b81649b11d192bb1df11dde9a81013e434af3520222707bc8/coverage-7.10.5-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:fcf6ab569436b4a647d4e91accba12509ad9f2554bc93d3aee23cc596e7f99c3", size = 243659, upload-time = "2025-08-23T14:40:36.815Z" },
-    { url = "https://files.pythonhosted.org/packages/02/b9/57170bd9f3e333837fc24ecc88bc70fbc2eb7ccfd0876854b0c0407078c3/coverage-7.10.5-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:90dc3d6fb222b194a5de60af8d190bedeeddcbc7add317e4a3cd333ee6b7c879", size = 244537, upload-time = "2025-08-23T14:40:38.737Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/1c/93ac36ef1e8b06b8d5777393a3a40cb356f9f3dab980be40a6941e443588/coverage-7.10.5-cp310-cp310-win32.whl", hash = "sha256:414a568cd545f9dc75f0686a0049393de8098414b58ea071e03395505b73d7a8", size = 219285, upload-time = "2025-08-23T14:40:40.342Z" },
-    { url = "https://files.pythonhosted.org/packages/30/95/23252277e6e5fe649d6cd3ed3f35d2307e5166de4e75e66aa7f432abc46d/coverage-7.10.5-cp310-cp310-win_amd64.whl", hash = "sha256:e551f9d03347196271935fd3c0c165f0e8c049220280c1120de0084d65e9c7ff", size = 220185, upload-time = "2025-08-23T14:40:42.026Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/f2/336d34d2fc1291ca7c18eeb46f64985e6cef5a1a7ef6d9c23720c6527289/coverage-7.10.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:c177e6ffe2ebc7c410785307758ee21258aa8e8092b44d09a2da767834f075f2", size = 216890, upload-time = "2025-08-23T14:40:43.627Z" },
-    { url = "https://files.pythonhosted.org/packages/39/ea/92448b07cc1cf2b429d0ce635f59cf0c626a5d8de21358f11e92174ff2a6/coverage-7.10.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:14d6071c51ad0f703d6440827eaa46386169b5fdced42631d5a5ac419616046f", size = 217287, upload-time = "2025-08-23T14:40:45.214Z" },
-    { url = "https://files.pythonhosted.org/packages/96/ba/ad5b36537c5179c808d0ecdf6e4aa7630b311b3c12747ad624dcd43a9b6b/coverage-7.10.5-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:61f78c7c3bc272a410c5ae3fde7792b4ffb4acc03d35a7df73ca8978826bb7ab", size = 247683, upload-time = "2025-08-23T14:40:46.791Z" },
-    { url = "https://files.pythonhosted.org/packages/28/e5/fe3bbc8d097029d284b5fb305b38bb3404895da48495f05bff025df62770/coverage-7.10.5-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f39071caa126f69d63f99b324fb08c7b1da2ec28cbb1fe7b5b1799926492f65c", size = 249614, upload-time = "2025-08-23T14:40:48.082Z" },
-    { url = "https://files.pythonhosted.org/packages/69/9c/a1c89a8c8712799efccb32cd0a1ee88e452f0c13a006b65bb2271f1ac767/coverage-7.10.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:343a023193f04d46edc46b2616cdbee68c94dd10208ecd3adc56fcc54ef2baa1", size = 251719, upload-time = "2025-08-23T14:40:49.349Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/be/5576b5625865aa95b5633315f8f4142b003a70c3d96e76f04487c3b5cc95/coverage-7.10.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:585ffe93ae5894d1ebdee69fc0b0d4b7c75d8007983692fb300ac98eed146f78", size = 249411, upload-time = "2025-08-23T14:40:50.624Z" },
-    { url = "https://files.pythonhosted.org/packages/94/0a/e39a113d4209da0dbbc9385608cdb1b0726a4d25f78672dc51c97cfea80f/coverage-7.10.5-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:b0ef4e66f006ed181df29b59921bd8fc7ed7cd6a9289295cd8b2824b49b570df", size = 247466, upload-time = "2025-08-23T14:40:52.362Z" },
-    { url = "https://files.pythonhosted.org/packages/40/cb/aebb2d8c9e3533ee340bea19b71c5b76605a0268aa49808e26fe96ec0a07/coverage-7.10.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:eb7b0bbf7cc1d0453b843eca7b5fa017874735bef9bfdfa4121373d2cc885ed6", size = 248104, upload-time = "2025-08-23T14:40:54.064Z" },
-    { url = "https://files.pythonhosted.org/packages/08/e6/26570d6ccce8ff5de912cbfd268e7f475f00597cb58da9991fa919c5e539/coverage-7.10.5-cp311-cp311-win32.whl", hash = "sha256:1d043a8a06987cc0c98516e57c4d3fc2c1591364831e9deb59c9e1b4937e8caf", size = 219327, upload-time = "2025-08-23T14:40:55.424Z" },
-    { url = "https://files.pythonhosted.org/packages/79/79/5f48525e366e518b36e66167e3b6e5db6fd54f63982500c6a5abb9d3dfbd/coverage-7.10.5-cp311-cp311-win_amd64.whl", hash = "sha256:fefafcca09c3ac56372ef64a40f5fe17c5592fab906e0fdffd09543f3012ba50", size = 220213, upload-time = "2025-08-23T14:40:56.724Z" },
-    { url = "https://files.pythonhosted.org/packages/40/3c/9058128b7b0bf333130c320b1eb1ae485623014a21ee196d68f7737f8610/coverage-7.10.5-cp311-cp311-win_arm64.whl", hash = "sha256:7e78b767da8b5fc5b2faa69bb001edafcd6f3995b42a331c53ef9572c55ceb82", size = 218893, upload-time = "2025-08-23T14:40:58.011Z" },
-    { url = "https://files.pythonhosted.org/packages/27/8e/40d75c7128f871ea0fd829d3e7e4a14460cad7c3826e3b472e6471ad05bd/coverage-7.10.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:c2d05c7e73c60a4cecc7d9b60dbfd603b4ebc0adafaef371445b47d0f805c8a9", size = 217077, upload-time = "2025-08-23T14:40:59.329Z" },
-    { url = "https://files.pythonhosted.org/packages/18/a8/f333f4cf3fb5477a7f727b4d603a2eb5c3c5611c7fe01329c2e13b23b678/coverage-7.10.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:32ddaa3b2c509778ed5373b177eb2bf5662405493baeff52278a0b4f9415188b", size = 217310, upload-time = "2025-08-23T14:41:00.628Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/2c/fbecd8381e0a07d1547922be819b4543a901402f63930313a519b937c668/coverage-7.10.5-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:dd382410039fe062097aa0292ab6335a3f1e7af7bba2ef8d27dcda484918f20c", size = 248802, upload-time = "2025-08-23T14:41:02.012Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/bc/1011da599b414fb6c9c0f34086736126f9ff71f841755786a6b87601b088/coverage-7.10.5-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:7fa22800f3908df31cea6fb230f20ac49e343515d968cc3a42b30d5c3ebf9b5a", size = 251550, upload-time = "2025-08-23T14:41:03.438Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/6f/b5c03c0c721c067d21bc697accc3642f3cef9f087dac429c918c37a37437/coverage-7.10.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f366a57ac81f5e12797136552f5b7502fa053c861a009b91b80ed51f2ce651c6", size = 252684, upload-time = "2025-08-23T14:41:04.85Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/50/d474bc300ebcb6a38a1047d5c465a227605d6473e49b4e0d793102312bc5/coverage-7.10.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:5f1dc8f1980a272ad4a6c84cba7981792344dad33bf5869361576b7aef42733a", size = 250602, upload-time = "2025-08-23T14:41:06.719Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/2d/548c8e04249cbba3aba6bd799efdd11eee3941b70253733f5d355d689559/coverage-7.10.5-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:2285c04ee8676f7938b02b4936d9b9b672064daab3187c20f73a55f3d70e6b4a", size = 248724, upload-time = "2025-08-23T14:41:08.429Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/96/a7c3c0562266ac39dcad271d0eec8fc20ab576e3e2f64130a845ad2a557b/coverage-7.10.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c2492e4dd9daab63f5f56286f8a04c51323d237631eb98505d87e4c4ff19ec34", size = 250158, upload-time = "2025-08-23T14:41:09.749Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/75/74d4be58c70c42ef0b352d597b022baf12dbe2b43e7cb1525f56a0fb1d4b/coverage-7.10.5-cp312-cp312-win32.whl", hash = "sha256:38a9109c4ee8135d5df5505384fc2f20287a47ccbe0b3f04c53c9a1989c2bbaf", size = 219493, upload-time = "2025-08-23T14:41:11.095Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/08/364e6012d1d4d09d1e27437382967efed971d7613f94bca9add25f0c1f2b/coverage-7.10.5-cp312-cp312-win_amd64.whl", hash = "sha256:6b87f1ad60b30bc3c43c66afa7db6b22a3109902e28c5094957626a0143a001f", size = 220302, upload-time = "2025-08-23T14:41:12.449Z" },
-    { url = "https://files.pythonhosted.org/packages/db/d5/7c8a365e1f7355c58af4fe5faf3f90cc8e587590f5854808d17ccb4e7077/coverage-7.10.5-cp312-cp312-win_arm64.whl", hash = "sha256:672a6c1da5aea6c629819a0e1461e89d244f78d7b60c424ecf4f1f2556c041d8", size = 218936, upload-time = "2025-08-23T14:41:13.872Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/08/4166ecfb60ba011444f38a5a6107814b80c34c717bc7a23be0d22e92ca09/coverage-7.10.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:ef3b83594d933020f54cf65ea1f4405d1f4e41a009c46df629dd964fcb6e907c", size = 217106, upload-time = "2025-08-23T14:41:15.268Z" },
-    { url = "https://files.pythonhosted.org/packages/25/d7/b71022408adbf040a680b8c64bf6ead3be37b553e5844f7465643979f7ca/coverage-7.10.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2b96bfdf7c0ea9faebce088a3ecb2382819da4fbc05c7b80040dbc428df6af44", size = 217353, upload-time = "2025-08-23T14:41:16.656Z" },
-    { url = "https://files.pythonhosted.org/packages/74/68/21e0d254dbf8972bb8dd95e3fe7038f4be037ff04ba47d6d1b12b37510ba/coverage-7.10.5-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:63df1fdaffa42d914d5c4d293e838937638bf75c794cf20bee12978fc8c4e3bc", size = 248350, upload-time = "2025-08-23T14:41:18.128Z" },
-    { url = "https://files.pythonhosted.org/packages/90/65/28752c3a896566ec93e0219fc4f47ff71bd2b745f51554c93e8dcb659796/coverage-7.10.5-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8002dc6a049aac0e81ecec97abfb08c01ef0c1fbf962d0c98da3950ace89b869", size = 250955, upload-time = "2025-08-23T14:41:19.577Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/eb/ca6b7967f57f6fef31da8749ea20417790bb6723593c8cd98a987be20423/coverage-7.10.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:63d4bb2966d6f5f705a6b0c6784c8969c468dbc4bcf9d9ded8bff1c7e092451f", size = 252230, upload-time = "2025-08-23T14:41:20.959Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/29/17a411b2a2a18f8b8c952aa01c00f9284a1fbc677c68a0003b772ea89104/coverage-7.10.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:1f672efc0731a6846b157389b6e6d5d5e9e59d1d1a23a5c66a99fd58339914d5", size = 250387, upload-time = "2025-08-23T14:41:22.644Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/89/97a9e271188c2fbb3db82235c33980bcbc733da7da6065afbaa1d685a169/coverage-7.10.5-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:3f39cef43d08049e8afc1fde4a5da8510fc6be843f8dea350ee46e2a26b2f54c", size = 248280, upload-time = "2025-08-23T14:41:24.061Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/c6/0ad7d0137257553eb4706b4ad6180bec0a1b6a648b092c5bbda48d0e5b2c/coverage-7.10.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2968647e3ed5a6c019a419264386b013979ff1fb67dd11f5c9886c43d6a31fc2", size = 249894, upload-time = "2025-08-23T14:41:26.165Z" },
-    { url = "https://files.pythonhosted.org/packages/84/56/fb3aba936addb4c9e5ea14f5979393f1c2466b4c89d10591fd05f2d6b2aa/coverage-7.10.5-cp313-cp313-win32.whl", hash = "sha256:0d511dda38595b2b6934c2b730a1fd57a3635c6aa2a04cb74714cdfdd53846f4", size = 219536, upload-time = "2025-08-23T14:41:27.694Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/54/baacb8f2f74431e3b175a9a2881feaa8feb6e2f187a0e7e3046f3c7742b2/coverage-7.10.5-cp313-cp313-win_amd64.whl", hash = "sha256:9a86281794a393513cf117177fd39c796b3f8e3759bb2764259a2abba5cce54b", size = 220330, upload-time = "2025-08-23T14:41:29.081Z" },
-    { url = "https://files.pythonhosted.org/packages/64/8a/82a3788f8e31dee51d350835b23d480548ea8621f3effd7c3ba3f7e5c006/coverage-7.10.5-cp313-cp313-win_arm64.whl", hash = "sha256:cebd8e906eb98bb09c10d1feed16096700b1198d482267f8bf0474e63a7b8d84", size = 218961, upload-time = "2025-08-23T14:41:30.511Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/a1/590154e6eae07beee3b111cc1f907c30da6fc8ce0a83ef756c72f3c7c748/coverage-7.10.5-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0520dff502da5e09d0d20781df74d8189ab334a1e40d5bafe2efaa4158e2d9e7", size = 217819, upload-time = "2025-08-23T14:41:31.962Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/ff/436ffa3cfc7741f0973c5c89405307fe39b78dcf201565b934e6616fc4ad/coverage-7.10.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:d9cd64aca68f503ed3f1f18c7c9174cbb797baba02ca8ab5112f9d1c0328cd4b", size = 218040, upload-time = "2025-08-23T14:41:33.472Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/ca/5787fb3d7820e66273913affe8209c534ca11241eb34ee8c4fd2aaa9dd87/coverage-7.10.5-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0913dd1613a33b13c4f84aa6e3f4198c1a21ee28ccb4f674985c1f22109f0aae", size = 259374, upload-time = "2025-08-23T14:41:34.914Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/89/21af956843896adc2e64fc075eae3c1cadb97ee0a6960733e65e696f32dd/coverage-7.10.5-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1b7181c0feeb06ed8a02da02792f42f829a7b29990fef52eff257fef0885d760", size = 261551, upload-time = "2025-08-23T14:41:36.333Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/96/390a69244ab837e0ac137989277879a084c786cf036c3c4a3b9637d43a89/coverage-7.10.5-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d42b7396b605f774d4372dd9c49bed71cbabce4ae1ccd074d155709dd8f235", size = 263776, upload-time = "2025-08-23T14:41:38.25Z" },
-    { url = "https://files.pythonhosted.org/packages/00/32/cfd6ae1da0a521723349f3129b2455832fc27d3f8882c07e5b6fefdd0da2/coverage-7.10.5-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:b4fdc777e05c4940b297bf47bf7eedd56a39a61dc23ba798e4b830d585486ca5", size = 261326, upload-time = "2025-08-23T14:41:40.343Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/c4/bf8d459fb4ce2201e9243ce6c015936ad283a668774430a3755f467b39d1/coverage-7.10.5-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:42144e8e346de44a6f1dbd0a56575dd8ab8dfa7e9007da02ea5b1c30ab33a7db", size = 259090, upload-time = "2025-08-23T14:41:42.106Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/5d/a234f7409896468e5539d42234016045e4015e857488b0b5b5f3f3fa5f2b/coverage-7.10.5-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:66c644cbd7aed8fe266d5917e2c9f65458a51cfe5eeff9c05f15b335f697066e", size = 260217, upload-time = "2025-08-23T14:41:43.591Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/ad/87560f036099f46c2ddd235be6476dd5c1d6be6bb57569a9348d43eeecea/coverage-7.10.5-cp313-cp313t-win32.whl", hash = "sha256:2d1b73023854068c44b0c554578a4e1ef1b050ed07cf8b431549e624a29a66ee", size = 220194, upload-time = "2025-08-23T14:41:45.051Z" },
-    { url = "https://files.pythonhosted.org/packages/36/a8/04a482594fdd83dc677d4a6c7e2d62135fff5a1573059806b8383fad9071/coverage-7.10.5-cp313-cp313t-win_amd64.whl", hash = "sha256:54a1532c8a642d8cc0bd5a9a51f5a9dcc440294fd06e9dda55e743c5ec1a8f14", size = 221258, upload-time = "2025-08-23T14:41:46.44Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/ad/7da28594ab66fe2bc720f1bc9b131e62e9b4c6e39f044d9a48d18429cc21/coverage-7.10.5-cp313-cp313t-win_arm64.whl", hash = "sha256:74d5b63fe3f5f5d372253a4ef92492c11a4305f3550631beaa432fc9df16fcff", size = 219521, upload-time = "2025-08-23T14:41:47.882Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/7f/c8b6e4e664b8a95254c35a6c8dd0bf4db201ec681c169aae2f1256e05c85/coverage-7.10.5-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:68c5e0bc5f44f68053369fa0d94459c84548a77660a5f2561c5e5f1e3bed7031", size = 217090, upload-time = "2025-08-23T14:41:49.327Z" },
-    { url = "https://files.pythonhosted.org/packages/44/74/3ee14ede30a6e10a94a104d1d0522d5fb909a7c7cac2643d2a79891ff3b9/coverage-7.10.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:cf33134ffae93865e32e1e37df043bef15a5e857d8caebc0099d225c579b0fa3", size = 217365, upload-time = "2025-08-23T14:41:50.796Z" },
-    { url = "https://files.pythonhosted.org/packages/41/5f/06ac21bf87dfb7620d1f870dfa3c2cae1186ccbcdc50b8b36e27a0d52f50/coverage-7.10.5-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:ad8fa9d5193bafcf668231294241302b5e683a0518bf1e33a9a0dfb142ec3031", size = 248413, upload-time = "2025-08-23T14:41:52.5Z" },
-    { url = "https://files.pythonhosted.org/packages/21/bc/cc5bed6e985d3a14228539631573f3863be6a2587381e8bc5fdf786377a1/coverage-7.10.5-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:146fa1531973d38ab4b689bc764592fe6c2f913e7e80a39e7eeafd11f0ef6db2", size = 250943, upload-time = "2025-08-23T14:41:53.922Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/43/6a9fc323c2c75cd80b18d58db4a25dc8487f86dd9070f9592e43e3967363/coverage-7.10.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6013a37b8a4854c478d3219ee8bc2392dea51602dd0803a12d6f6182a0061762", size = 252301, upload-time = "2025-08-23T14:41:56.528Z" },
-    { url = "https://files.pythonhosted.org/packages/69/7c/3e791b8845f4cd515275743e3775adb86273576596dc9f02dca37357b4f2/coverage-7.10.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:eb90fe20db9c3d930fa2ad7a308207ab5b86bf6a76f54ab6a40be4012d88fcae", size = 250302, upload-time = "2025-08-23T14:41:58.171Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/bc/5099c1e1cb0c9ac6491b281babea6ebbf999d949bf4aa8cdf4f2b53505e8/coverage-7.10.5-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:384b34482272e960c438703cafe63316dfbea124ac62006a455c8410bf2a2262", size = 248237, upload-time = "2025-08-23T14:41:59.703Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/51/d346eb750a0b2f1e77f391498b753ea906fde69cc11e4b38dca28c10c88c/coverage-7.10.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:467dc74bd0a1a7de2bedf8deaf6811f43602cb532bd34d81ffd6038d6d8abe99", size = 249726, upload-time = "2025-08-23T14:42:01.343Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/85/eebcaa0edafe427e93286b94f56ea7e1280f2c49da0a776a6f37e04481f9/coverage-7.10.5-cp314-cp314-win32.whl", hash = "sha256:556d23d4e6393ca898b2e63a5bca91e9ac2d5fb13299ec286cd69a09a7187fde", size = 219825, upload-time = "2025-08-23T14:42:03.263Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/f7/6d43e037820742603f1e855feb23463979bf40bd27d0cde1f761dcc66a3e/coverage-7.10.5-cp314-cp314-win_amd64.whl", hash = "sha256:f4446a9547681533c8fa3e3c6cf62121eeee616e6a92bd9201c6edd91beffe13", size = 220618, upload-time = "2025-08-23T14:42:05.037Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/b0/ed9432e41424c51509d1da603b0393404b828906236fb87e2c8482a93468/coverage-7.10.5-cp314-cp314-win_arm64.whl", hash = "sha256:5e78bd9cf65da4c303bf663de0d73bf69f81e878bf72a94e9af67137c69b9fe9", size = 219199, upload-time = "2025-08-23T14:42:06.662Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/54/5a7ecfa77910f22b659c820f67c16fc1e149ed132ad7117f0364679a8fa9/coverage-7.10.5-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:5661bf987d91ec756a47c7e5df4fbcb949f39e32f9334ccd3f43233bbb65e508", size = 217833, upload-time = "2025-08-23T14:42:08.262Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/0e/25672d917cc57857d40edf38f0b867fb9627115294e4f92c8fcbbc18598d/coverage-7.10.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:a46473129244db42a720439a26984f8c6f834762fc4573616c1f37f13994b357", size = 218048, upload-time = "2025-08-23T14:42:10.247Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/7c/0b2b4f1c6f71885d4d4b2b8608dcfc79057adb7da4143eb17d6260389e42/coverage-7.10.5-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:1f64b8d3415d60f24b058b58d859e9512624bdfa57a2d1f8aff93c1ec45c429b", size = 259549, upload-time = "2025-08-23T14:42:11.811Z" },
-    { url = "https://files.pythonhosted.org/packages/94/73/abb8dab1609abec7308d83c6aec547944070526578ee6c833d2da9a0ad42/coverage-7.10.5-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:44d43de99a9d90b20e0163f9770542357f58860a26e24dc1d924643bd6aa7cb4", size = 261715, upload-time = "2025-08-23T14:42:13.505Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/d1/abf31de21ec92731445606b8d5e6fa5144653c2788758fcf1f47adb7159a/coverage-7.10.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a931a87e5ddb6b6404e65443b742cb1c14959622777f2a4efd81fba84f5d91ba", size = 263969, upload-time = "2025-08-23T14:42:15.422Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/b3/ef274927f4ebede96056173b620db649cc9cb746c61ffc467946b9d0bc67/coverage-7.10.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:f9559b906a100029274448f4c8b8b0a127daa4dade5661dfd821b8c188058842", size = 261408, upload-time = "2025-08-23T14:42:16.971Z" },
-    { url = "https://files.pythonhosted.org/packages/20/fc/83ca2812be616d69b4cdd4e0c62a7bc526d56875e68fd0f79d47c7923584/coverage-7.10.5-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:b08801e25e3b4526ef9ced1aa29344131a8f5213c60c03c18fe4c6170ffa2874", size = 259168, upload-time = "2025-08-23T14:42:18.512Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/4f/e0779e5716f72d5c9962e709d09815d02b3b54724e38567308304c3fc9df/coverage-7.10.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ed9749bb8eda35f8b636fb7632f1c62f735a236a5d4edadd8bbcc5ea0542e732", size = 260317, upload-time = "2025-08-23T14:42:20.005Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/fe/4247e732f2234bb5eb9984a0888a70980d681f03cbf433ba7b48f08ca5d5/coverage-7.10.5-cp314-cp314t-win32.whl", hash = "sha256:609b60d123fc2cc63ccee6d17e4676699075db72d14ac3c107cc4976d516f2df", size = 220600, upload-time = "2025-08-23T14:42:22.027Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/a0/f294cff6d1034b87839987e5b6ac7385bec599c44d08e0857ac7f164ad0c/coverage-7.10.5-cp314-cp314t-win_amd64.whl", hash = "sha256:0666cf3d2c1626b5a3463fd5b05f5e21f99e6aec40a3192eee4d07a15970b07f", size = 221714, upload-time = "2025-08-23T14:42:23.616Z" },
-    { url = "https://files.pythonhosted.org/packages/23/18/fa1afdc60b5528d17416df440bcbd8fd12da12bfea9da5b6ae0f7a37d0f7/coverage-7.10.5-cp314-cp314t-win_arm64.whl", hash = "sha256:bc85eb2d35e760120540afddd3044a5bf69118a91a296a8b3940dfc4fdcfe1e2", size = 219735, upload-time = "2025-08-23T14:42:25.156Z" },
-    { url = "https://files.pythonhosted.org/packages/08/b6/fff6609354deba9aeec466e4bcaeb9d1ed3e5d60b14b57df2a36fb2273f2/coverage-7.10.5-py3-none-any.whl", hash = "sha256:0be24d35e4db1d23d0db5c0f6a74a962e2ec83c426b5cac09f4234aadef38e4a", size = 208736, upload-time = "2025-08-23T14:42:43.145Z" },
+version = "7.13.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b6/45/2c665ca77ec32ad67e25c77daf1cee28ee4558f3bc571cdbaf88a00b9f23/coverage-7.13.0.tar.gz", hash = "sha256:a394aa27f2d7ff9bc04cf703817773a59ad6dfbd577032e690f961d2460ee936", size = 820905, upload-time = "2025-12-08T13:14:38.055Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/db/08/bdd7ccca14096f7eb01412b87ac11e5d16e4cb54b6e328afc9dee8bdaec1/coverage-7.13.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:02d9fb9eccd48f6843c98a37bd6817462f130b86da8660461e8f5e54d4c06070", size = 217979, upload-time = "2025-12-08T13:12:14.505Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/f0/d1302e3416298a28b5663ae1117546a745d9d19fde7e28402b2c5c3e2109/coverage-7.13.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:367449cf07d33dc216c083f2036bb7d976c6e4903ab31be400ad74ad9f85ce98", size = 218496, upload-time = "2025-12-08T13:12:16.237Z" },
+    { url = "https://files.pythonhosted.org/packages/07/26/d36c354c8b2a320819afcea6bffe72839efd004b98d1d166b90801d49d57/coverage-7.13.0-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:cdb3c9f8fef0a954c632f64328a3935988d33a6604ce4bf67ec3e39670f12ae5", size = 245237, upload-time = "2025-12-08T13:12:17.858Z" },
+    { url = "https://files.pythonhosted.org/packages/91/52/be5e85631e0eec547873d8b08dd67a5f6b111ecfe89a86e40b89b0c1c61c/coverage-7.13.0-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:d10fd186aac2316f9bbb46ef91977f9d394ded67050ad6d84d94ed6ea2e8e54e", size = 247061, upload-time = "2025-12-08T13:12:19.132Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/45/a5e8fa0caf05fbd8fa0402470377bff09cc1f026d21c05c71e01295e55ab/coverage-7.13.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f88ae3e69df2ab62fb0bc5219a597cb890ba5c438190ffa87490b315190bb33", size = 248928, upload-time = "2025-12-08T13:12:20.702Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/42/ffb5069b6fd1b95fae482e02f3fecf380d437dd5a39bae09f16d2e2e7e01/coverage-7.13.0-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c4be718e51e86f553bcf515305a158a1cd180d23b72f07ae76d6017c3cc5d791", size = 245931, upload-time = "2025-12-08T13:12:22.243Z" },
+    { url = "https://files.pythonhosted.org/packages/95/6e/73e809b882c2858f13e55c0c36e94e09ce07e6165d5644588f9517efe333/coverage-7.13.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:a00d3a393207ae12f7c49bb1c113190883b500f48979abb118d8b72b8c95c032", size = 246968, upload-time = "2025-12-08T13:12:23.52Z" },
+    { url = "https://files.pythonhosted.org/packages/87/08/64ebd9e64b6adb8b4a4662133d706fbaccecab972e0b3ccc23f64e2678ad/coverage-7.13.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:3a7b1cd820e1b6116f92c6128f1188e7afe421c7e1b35fa9836b11444e53ebd9", size = 244972, upload-time = "2025-12-08T13:12:24.781Z" },
+    { url = "https://files.pythonhosted.org/packages/12/97/f4d27c6fe0cb375a5eced4aabcaef22de74766fb80a3d5d2015139e54b22/coverage-7.13.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:37eee4e552a65866f15dedd917d5e5f3d59805994260720821e2c1b51ac3248f", size = 245241, upload-time = "2025-12-08T13:12:28.041Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/94/42f8ae7f633bf4c118bf1038d80472f9dade88961a466f290b81250f7ab7/coverage-7.13.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:62d7c4f13102148c78d7353c6052af6d899a7f6df66a32bddcc0c0eb7c5326f8", size = 245847, upload-time = "2025-12-08T13:12:29.337Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/2f/6369ca22b6b6d933f4f4d27765d313d8914cc4cce84f82a16436b1a233db/coverage-7.13.0-cp310-cp310-win32.whl", hash = "sha256:24e4e56304fdb56f96f80eabf840eab043b3afea9348b88be680ec5986780a0f", size = 220573, upload-time = "2025-12-08T13:12:30.905Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/dc/a6a741e519acceaeccc70a7f4cfe5d030efc4b222595f0677e101af6f1f3/coverage-7.13.0-cp310-cp310-win_amd64.whl", hash = "sha256:74c136e4093627cf04b26a35dab8cbfc9b37c647f0502fc313376e11726ba303", size = 221509, upload-time = "2025-12-08T13:12:32.09Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/dc/888bf90d8b1c3d0b4020a40e52b9f80957d75785931ec66c7dfaccc11c7d/coverage-7.13.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0dfa3855031070058add1a59fdfda0192fd3e8f97e7c81de0596c145dea51820", size = 218104, upload-time = "2025-12-08T13:12:33.333Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/ea/069d51372ad9c380214e86717e40d1a743713a2af191cfba30a0911b0a4a/coverage-7.13.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4fdb6f54f38e334db97f72fa0c701e66d8479af0bc3f9bfb5b90f1c30f54500f", size = 218606, upload-time = "2025-12-08T13:12:34.498Z" },
+    { url = "https://files.pythonhosted.org/packages/68/09/77b1c3a66c2aa91141b6c4471af98e5b1ed9b9e6d17255da5eb7992299e3/coverage-7.13.0-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7e442c013447d1d8d195be62852270b78b6e255b79b8675bad8479641e21fd96", size = 248999, upload-time = "2025-12-08T13:12:36.02Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/32/2e2f96e9d5691eaf1181d9040f850b8b7ce165ea10810fd8e2afa534cef7/coverage-7.13.0-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1ed5630d946859de835a85e9a43b721123a8a44ec26e2830b296d478c7fd4259", size = 250925, upload-time = "2025-12-08T13:12:37.221Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/45/b88ddac1d7978859b9a39a8a50ab323186148f1d64bc068f86fc77706321/coverage-7.13.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f15a931a668e58087bc39d05d2b4bf4b14ff2875b49c994bbdb1c2217a8daeb", size = 253032, upload-time = "2025-12-08T13:12:38.763Z" },
+    { url = "https://files.pythonhosted.org/packages/71/cb/e15513f94c69d4820a34b6bf3d2b1f9f8755fa6021be97c7065442d7d653/coverage-7.13.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:30a3a201a127ea57f7e14ba43c93c9c4be8b7d17a26e03bb49e6966d019eede9", size = 249134, upload-time = "2025-12-08T13:12:40.382Z" },
+    { url = "https://files.pythonhosted.org/packages/09/61/d960ff7dc9e902af3310ce632a875aaa7860f36d2bc8fc8b37ee7c1b82a5/coverage-7.13.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7a485ff48fbd231efa32d58f479befce52dcb6bfb2a88bb7bf9a0b89b1bc8030", size = 250731, upload-time = "2025-12-08T13:12:41.992Z" },
+    { url = "https://files.pythonhosted.org/packages/98/34/c7c72821794afc7c7c2da1db8f00c2c98353078aa7fb6b5ff36aac834b52/coverage-7.13.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:22486cdafba4f9e471c816a2a5745337742a617fef68e890d8baf9f3036d7833", size = 248795, upload-time = "2025-12-08T13:12:43.331Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/5b/e0f07107987a43b2def9aa041c614ddb38064cbf294a71ef8c67d43a0cdd/coverage-7.13.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:263c3dbccc78e2e331e59e90115941b5f53e85cfcc6b3b2fbff1fd4e3d2c6ea8", size = 248514, upload-time = "2025-12-08T13:12:44.546Z" },
+    { url = "https://files.pythonhosted.org/packages/71/c2/c949c5d3b5e9fc6dd79e1b73cdb86a59ef14f3709b1d72bf7668ae12e000/coverage-7.13.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:e5330fa0cc1f5c3c4c3bb8e101b742025933e7848989370a1d4c8c5e401ea753", size = 249424, upload-time = "2025-12-08T13:12:45.759Z" },
+    { url = "https://files.pythonhosted.org/packages/11/f1/bbc009abd6537cec0dffb2cc08c17a7f03de74c970e6302db4342a6e05af/coverage-7.13.0-cp311-cp311-win32.whl", hash = "sha256:0f4872f5d6c54419c94c25dd6ae1d015deeb337d06e448cd890a1e89a8ee7f3b", size = 220597, upload-time = "2025-12-08T13:12:47.378Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f6/d9977f2fb51c10fbaed0718ce3d0a8541185290b981f73b1d27276c12d91/coverage-7.13.0-cp311-cp311-win_amd64.whl", hash = "sha256:51a202e0f80f241ccb68e3e26e19ab5b3bf0f813314f2c967642f13ebcf1ddfe", size = 221536, upload-time = "2025-12-08T13:12:48.7Z" },
+    { url = "https://files.pythonhosted.org/packages/be/ad/3fcf43fd96fb43e337a3073dea63ff148dcc5c41ba7a14d4c7d34efb2216/coverage-7.13.0-cp311-cp311-win_arm64.whl", hash = "sha256:d2a9d7f1c11487b1c69367ab3ac2d81b9b3721f097aa409a3191c3e90f8f3dd7", size = 220206, upload-time = "2025-12-08T13:12:50.365Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/f1/2619559f17f31ba00fc40908efd1fbf1d0a5536eb75dc8341e7d660a08de/coverage-7.13.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:0b3d67d31383c4c68e19a88e28fc4c2e29517580f1b0ebec4a069d502ce1e0bf", size = 218274, upload-time = "2025-12-08T13:12:52.095Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/11/30d71ae5d6e949ff93b2a79a2c1b4822e00423116c5c6edfaeef37301396/coverage-7.13.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:581f086833d24a22c89ae0fe2142cfaa1c92c930adf637ddf122d55083fb5a0f", size = 218638, upload-time = "2025-12-08T13:12:53.418Z" },
+    { url = "https://files.pythonhosted.org/packages/79/c2/fce80fc6ded8d77e53207489d6065d0fed75db8951457f9213776615e0f5/coverage-7.13.0-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0a3a30f0e257df382f5f9534d4ce3d4cf06eafaf5192beb1a7bd066cb10e78fb", size = 250129, upload-time = "2025-12-08T13:12:54.744Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/b6/51b5d1eb6fcbb9a1d5d6984e26cbe09018475c2922d554fd724dd0f056ee/coverage-7.13.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:583221913fbc8f53b88c42e8dbb8fca1d0f2e597cb190ce45916662b8b9d9621", size = 252885, upload-time = "2025-12-08T13:12:56.401Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/f8/972a5affea41de798691ab15d023d3530f9f56a72e12e243f35031846ff7/coverage-7.13.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f5d9bd30756fff3e7216491a0d6d520c448d5124d3d8e8f56446d6412499e74", size = 253974, upload-time = "2025-12-08T13:12:57.718Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/56/116513aee860b2c7968aa3506b0f59b22a959261d1dbf3aea7b4450a7520/coverage-7.13.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a23e5a1f8b982d56fa64f8e442e037f6ce29322f1f9e6c2344cd9e9f4407ee57", size = 250538, upload-time = "2025-12-08T13:12:59.254Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/75/074476d64248fbadf16dfafbf93fdcede389ec821f74ca858d7c87d2a98c/coverage-7.13.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:9b01c22bc74a7fb44066aaf765224c0d933ddf1f5047d6cdfe4795504a4493f8", size = 251912, upload-time = "2025-12-08T13:13:00.604Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/d2/aa4f8acd1f7c06024705c12609d8698c51b27e4d635d717cd1934c9668e2/coverage-7.13.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:898cce66d0836973f48dda4e3514d863d70142bdf6dfab932b9b6a90ea5b222d", size = 250054, upload-time = "2025-12-08T13:13:01.892Z" },
+    { url = "https://files.pythonhosted.org/packages/19/98/8df9e1af6a493b03694a1e8070e024e7d2cdc77adedc225a35e616d505de/coverage-7.13.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:3ab483ea0e251b5790c2aac03acde31bff0c736bf8a86829b89382b407cd1c3b", size = 249619, upload-time = "2025-12-08T13:13:03.236Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/71/f8679231f3353018ca66ef647fa6fe7b77e6bff7845be54ab84f86233363/coverage-7.13.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:1d84e91521c5e4cb6602fe11ece3e1de03b2760e14ae4fcf1a4b56fa3c801fcd", size = 251496, upload-time = "2025-12-08T13:13:04.511Z" },
+    { url = "https://files.pythonhosted.org/packages/04/86/9cb406388034eaf3c606c22094edbbb82eea1fa9d20c0e9efadff20d0733/coverage-7.13.0-cp312-cp312-win32.whl", hash = "sha256:193c3887285eec1dbdb3f2bd7fbc351d570ca9c02ca756c3afbc71b3c98af6ef", size = 220808, upload-time = "2025-12-08T13:13:06.422Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/59/af483673df6455795daf5f447c2f81a3d2fcfc893a22b8ace983791f6f34/coverage-7.13.0-cp312-cp312-win_amd64.whl", hash = "sha256:4f3e223b2b2db5e0db0c2b97286aba0036ca000f06aca9b12112eaa9af3d92ae", size = 221616, upload-time = "2025-12-08T13:13:07.95Z" },
+    { url = "https://files.pythonhosted.org/packages/64/b0/959d582572b30a6830398c60dd419c1965ca4b5fb38ac6b7093a0d50ca8d/coverage-7.13.0-cp312-cp312-win_arm64.whl", hash = "sha256:086cede306d96202e15a4b77ace8472e39d9f4e5f9fd92dd4fecdfb2313b2080", size = 220261, upload-time = "2025-12-08T13:13:09.581Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/cc/bce226595eb3bf7d13ccffe154c3c487a22222d87ff018525ab4dd2e9542/coverage-7.13.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:28ee1c96109974af104028a8ef57cec21447d42d0e937c0275329272e370ebcf", size = 218297, upload-time = "2025-12-08T13:13:10.977Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/9f/73c4d34600aae03447dff3d7ad1d0ac649856bfb87d1ca7d681cfc913f9e/coverage-7.13.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d1e97353dcc5587b85986cda4ff3ec98081d7e84dd95e8b2a6d59820f0545f8a", size = 218673, upload-time = "2025-12-08T13:13:12.562Z" },
+    { url = "https://files.pythonhosted.org/packages/63/ab/8fa097db361a1e8586535ae5073559e6229596b3489ec3ef2f5b38df8cb2/coverage-7.13.0-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:99acd4dfdfeb58e1937629eb1ab6ab0899b131f183ee5f23e0b5da5cba2fec74", size = 249652, upload-time = "2025-12-08T13:13:13.909Z" },
+    { url = "https://files.pythonhosted.org/packages/90/3a/9bfd4de2ff191feb37ef9465855ca56a6f2f30a3bca172e474130731ac3d/coverage-7.13.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:ff45e0cd8451e293b63ced93161e189780baf444119391b3e7d25315060368a6", size = 252251, upload-time = "2025-12-08T13:13:15.553Z" },
+    { url = "https://files.pythonhosted.org/packages/df/61/b5d8105f016e1b5874af0d7c67542da780ccd4a5f2244a433d3e20ceb1ad/coverage-7.13.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f4f72a85316d8e13234cafe0a9f81b40418ad7a082792fa4165bd7d45d96066b", size = 253492, upload-time = "2025-12-08T13:13:16.849Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/b8/0fad449981803cc47a4694768b99823fb23632150743f9c83af329bb6090/coverage-7.13.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:11c21557d0e0a5a38632cbbaca5f008723b26a89d70db6315523df6df77d6232", size = 249850, upload-time = "2025-12-08T13:13:18.142Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/e9/8d68337c3125014d918cf4327d5257553a710a2995a6a6de2ac77e5aa429/coverage-7.13.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:76541dc8d53715fb4f7a3a06b34b0dc6846e3c69bc6204c55653a85dd6220971", size = 251633, upload-time = "2025-12-08T13:13:19.56Z" },
+    { url = "https://files.pythonhosted.org/packages/55/14/d4112ab26b3a1bc4b3c1295d8452dcf399ed25be4cf649002fb3e64b2d93/coverage-7.13.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:6e9e451dee940a86789134b6b0ffbe31c454ade3b849bb8a9d2cca2541a8e91d", size = 249586, upload-time = "2025-12-08T13:13:20.883Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/a9/22b0000186db663b0d82f86c2f1028099ae9ac202491685051e2a11a5218/coverage-7.13.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:5c67dace46f361125e6b9cace8fe0b729ed8479f47e70c89b838d319375c8137", size = 249412, upload-time = "2025-12-08T13:13:22.22Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/2e/42d8e0d9e7527fba439acdc6ed24a2b97613b1dc85849b1dd935c2cffef0/coverage-7.13.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f59883c643cb19630500f57016f76cfdcd6845ca8c5b5ea1f6e17f74c8e5f511", size = 251191, upload-time = "2025-12-08T13:13:23.899Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/af/8c7af92b1377fd8860536aadd58745119252aaaa71a5213e5a8e8007a9f5/coverage-7.13.0-cp313-cp313-win32.whl", hash = "sha256:58632b187be6f0be500f553be41e277712baa278147ecb7559983c6d9faf7ae1", size = 220829, upload-time = "2025-12-08T13:13:25.182Z" },
+    { url = "https://files.pythonhosted.org/packages/58/f9/725e8bf16f343d33cbe076c75dc8370262e194ff10072c0608b8e5cf33a3/coverage-7.13.0-cp313-cp313-win_amd64.whl", hash = "sha256:73419b89f812f498aca53f757dd834919b48ce4799f9d5cad33ca0ae442bdb1a", size = 221640, upload-time = "2025-12-08T13:13:26.836Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/ff/e98311000aa6933cc79274e2b6b94a2fe0fe3434fca778eba82003675496/coverage-7.13.0-cp313-cp313-win_arm64.whl", hash = "sha256:eb76670874fdd6091eedcc856128ee48c41a9bbbb9c3f1c7c3cf169290e3ffd6", size = 220269, upload-time = "2025-12-08T13:13:28.116Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/cf/bbaa2e1275b300343ea865f7d424cc0a2e2a1df6925a070b2b2d5d765330/coverage-7.13.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6e63ccc6e0ad8986386461c3c4b737540f20426e7ec932f42e030320896c311a", size = 218990, upload-time = "2025-12-08T13:13:29.463Z" },
+    { url = "https://files.pythonhosted.org/packages/21/1d/82f0b3323b3d149d7672e7744c116e9c170f4957e0c42572f0366dbb4477/coverage-7.13.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:494f5459ffa1bd45e18558cd98710c36c0b8fbfa82a5eabcbe671d80ecffbfe8", size = 219340, upload-time = "2025-12-08T13:13:31.524Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/e3/fe3fd4702a3832a255f4d43013eacb0ef5fc155a5960ea9269d8696db28b/coverage-7.13.0-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:06cac81bf10f74034e055e903f5f946e3e26fc51c09fc9f584e4a1605d977053", size = 260638, upload-time = "2025-12-08T13:13:32.965Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/01/63186cb000307f2b4da463f72af9b85d380236965574c78e7e27680a2593/coverage-7.13.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f2ffc92b46ed6e6760f1d47a71e56b5664781bc68986dbd1836b2b70c0ce2071", size = 262705, upload-time = "2025-12-08T13:13:34.378Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/a1/c0dacef0cc865f2455d59eed3548573ce47ed603205ffd0735d1d78b5906/coverage-7.13.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0602f701057c6823e5db1b74530ce85f17c3c5be5c85fc042ac939cbd909426e", size = 265125, upload-time = "2025-12-08T13:13:35.73Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/92/82b99223628b61300bd382c205795533bed021505eab6dd86e11fb5d7925/coverage-7.13.0-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:25dc33618d45456ccb1d37bce44bc78cf269909aa14c4db2e03d63146a8a1493", size = 259844, upload-time = "2025-12-08T13:13:37.69Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/2c/89b0291ae4e6cd59ef042708e1c438e2290f8c31959a20055d8768349ee2/coverage-7.13.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:71936a8b3b977ddd0b694c28c6a34f4fff2e9dd201969a4ff5d5fc7742d614b0", size = 262700, upload-time = "2025-12-08T13:13:39.525Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/f9/a5f992efae1996245e796bae34ceb942b05db275e4b34222a9a40b9fbd3b/coverage-7.13.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:936bc20503ce24770c71938d1369461f0c5320830800933bc3956e2a4ded930e", size = 260321, upload-time = "2025-12-08T13:13:41.172Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/89/a29f5d98c64fedbe32e2ac3c227fbf78edc01cc7572eee17d61024d89889/coverage-7.13.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:af0a583efaacc52ae2521f8d7910aff65cdb093091d76291ac5820d5e947fc1c", size = 259222, upload-time = "2025-12-08T13:13:43.282Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/c3/940fe447aae302a6701ee51e53af7e08b86ff6eed7631e5740c157ee22b9/coverage-7.13.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:f1c23e24a7000da892a312fb17e33c5f94f8b001de44b7cf8ba2e36fbd15859e", size = 261411, upload-time = "2025-12-08T13:13:44.72Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/31/12a4aec689cb942a89129587860ed4d0fd522d5fda81237147fde554b8ae/coverage-7.13.0-cp313-cp313t-win32.whl", hash = "sha256:5f8a0297355e652001015e93be345ee54393e45dc3050af4a0475c5a2b767d46", size = 221505, upload-time = "2025-12-08T13:13:46.332Z" },
+    { url = "https://files.pythonhosted.org/packages/65/8c/3b5fe3259d863572d2b0827642c50c3855d26b3aefe80bdc9eba1f0af3b0/coverage-7.13.0-cp313-cp313t-win_amd64.whl", hash = "sha256:6abb3a4c52f05e08460bd9acf04fec027f8718ecaa0d09c40ffbc3fbd70ecc39", size = 222569, upload-time = "2025-12-08T13:13:47.79Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/39/f71fa8316a96ac72fc3908839df651e8eccee650001a17f2c78cdb355624/coverage-7.13.0-cp313-cp313t-win_arm64.whl", hash = "sha256:3ad968d1e3aa6ce5be295ab5fe3ae1bf5bb4769d0f98a80a0252d543a2ef2e9e", size = 220841, upload-time = "2025-12-08T13:13:49.243Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/4b/9b54bedda55421449811dcd5263a2798a63f48896c24dfb92b0f1b0845bd/coverage-7.13.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:453b7ec753cf5e4356e14fe858064e5520c460d3bbbcb9c35e55c0d21155c256", size = 218343, upload-time = "2025-12-08T13:13:50.811Z" },
+    { url = "https://files.pythonhosted.org/packages/59/df/c3a1f34d4bba2e592c8979f924da4d3d4598b0df2392fbddb7761258e3dc/coverage-7.13.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:af827b7cbb303e1befa6c4f94fd2bf72f108089cfa0f8abab8f4ca553cf5ca5a", size = 218672, upload-time = "2025-12-08T13:13:52.284Z" },
+    { url = "https://files.pythonhosted.org/packages/07/62/eec0659e47857698645ff4e6ad02e30186eb8afd65214fd43f02a76537cb/coverage-7.13.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:9987a9e4f8197a1000280f7cc089e3ea2c8b3c0a64d750537809879a7b4ceaf9", size = 249715, upload-time = "2025-12-08T13:13:53.791Z" },
+    { url = "https://files.pythonhosted.org/packages/23/2d/3c7ff8b2e0e634c1f58d095f071f52ed3c23ff25be524b0ccae8b71f99f8/coverage-7.13.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:3188936845cd0cb114fa6a51842a304cdbac2958145d03be2377ec41eb285d19", size = 252225, upload-time = "2025-12-08T13:13:55.274Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/ac/fb03b469d20e9c9a81093575003f959cf91a4a517b783aab090e4538764b/coverage-7.13.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2bdb3babb74079f021696cb46b8bb5f5661165c385d3a238712b031a12355be", size = 253559, upload-time = "2025-12-08T13:13:57.161Z" },
+    { url = "https://files.pythonhosted.org/packages/29/62/14afa9e792383c66cc0a3b872a06ded6e4ed1079c7d35de274f11d27064e/coverage-7.13.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7464663eaca6adba4175f6c19354feea61ebbdd735563a03d1e472c7072d27bb", size = 249724, upload-time = "2025-12-08T13:13:58.692Z" },
+    { url = "https://files.pythonhosted.org/packages/31/b7/333f3dab2939070613696ab3ee91738950f0467778c6e5a5052e840646b7/coverage-7.13.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8069e831f205d2ff1f3d355e82f511eb7c5522d7d413f5db5756b772ec8697f8", size = 251582, upload-time = "2025-12-08T13:14:00.642Z" },
+    { url = "https://files.pythonhosted.org/packages/81/cb/69162bda9381f39b2287265d7e29ee770f7c27c19f470164350a38318764/coverage-7.13.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:6fb2d5d272341565f08e962cce14cdf843a08ac43bd621783527adb06b089c4b", size = 249538, upload-time = "2025-12-08T13:14:02.556Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/76/350387b56a30f4970abe32b90b2a434f87d29f8b7d4ae40d2e8a85aacfb3/coverage-7.13.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:5e70f92ef89bac1ac8a99b3324923b4749f008fdbd7aa9cb35e01d7a284a04f9", size = 249349, upload-time = "2025-12-08T13:14:04.015Z" },
+    { url = "https://files.pythonhosted.org/packages/86/0d/7f6c42b8d59f4c7e43ea3059f573c0dcfed98ba46eb43c68c69e52ae095c/coverage-7.13.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:4b5de7d4583e60d5fd246dd57fcd3a8aa23c6e118a8c72b38adf666ba8e7e927", size = 251011, upload-time = "2025-12-08T13:14:05.505Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/f1/4bb2dff379721bb0b5c649d5c5eaf438462cad824acf32eb1b7ca0c7078e/coverage-7.13.0-cp314-cp314-win32.whl", hash = "sha256:a6c6e16b663be828a8f0b6c5027d36471d4a9f90d28444aa4ced4d48d7d6ae8f", size = 221091, upload-time = "2025-12-08T13:14:07.127Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/44/c239da52f373ce379c194b0ee3bcc121020e397242b85f99e0afc8615066/coverage-7.13.0-cp314-cp314-win_amd64.whl", hash = "sha256:0900872f2fdb3ee5646b557918d02279dc3af3dfb39029ac4e945458b13f73bc", size = 221904, upload-time = "2025-12-08T13:14:08.542Z" },
+    { url = "https://files.pythonhosted.org/packages/89/1f/b9f04016d2a29c2e4a0307baefefad1a4ec5724946a2b3e482690486cade/coverage-7.13.0-cp314-cp314-win_arm64.whl", hash = "sha256:3a10260e6a152e5f03f26db4a407c4c62d3830b9af9b7c0450b183615f05d43b", size = 220480, upload-time = "2025-12-08T13:14:10.958Z" },
+    { url = "https://files.pythonhosted.org/packages/16/d4/364a1439766c8e8647860584171c36010ca3226e6e45b1753b1b249c5161/coverage-7.13.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:9097818b6cc1cfb5f174e3263eba4a62a17683bcfe5c4b5d07f4c97fa51fbf28", size = 219074, upload-time = "2025-12-08T13:14:13.345Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/f4/71ba8be63351e099911051b2089662c03d5671437a0ec2171823c8e03bec/coverage-7.13.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0018f73dfb4301a89292c73be6ba5f58722ff79f51593352759c1790ded1cabe", size = 219342, upload-time = "2025-12-08T13:14:15.02Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/25/127d8ed03d7711a387d96f132589057213e3aef7475afdaa303412463f22/coverage-7.13.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:166ad2a22ee770f5656e1257703139d3533b4a0b6909af67c6b4a3adc1c98657", size = 260713, upload-time = "2025-12-08T13:14:16.907Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/db/559fbb6def07d25b2243663b46ba9eb5a3c6586c0c6f4e62980a68f0ee1c/coverage-7.13.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f6aaef16d65d1787280943f1c8718dc32e9cf141014e4634d64446702d26e0ff", size = 262825, upload-time = "2025-12-08T13:14:18.68Z" },
+    { url = "https://files.pythonhosted.org/packages/37/99/6ee5bf7eff884766edb43bd8736b5e1c5144d0fe47498c3779326fe75a35/coverage-7.13.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e999e2dcc094002d6e2c7bbc1fb85b58ba4f465a760a8014d97619330cdbbbf3", size = 265233, upload-time = "2025-12-08T13:14:20.55Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/90/92f18fe0356ea69e1f98f688ed80cec39f44e9f09a1f26a1bbf017cc67f2/coverage-7.13.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:00c3d22cf6fb1cf3bf662aaaa4e563be8243a5ed2630339069799835a9cc7f9b", size = 259779, upload-time = "2025-12-08T13:14:22.367Z" },
+    { url = "https://files.pythonhosted.org/packages/90/5d/b312a8b45b37a42ea7d27d7d3ff98ade3a6c892dd48d1d503e773503373f/coverage-7.13.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:22ccfe8d9bb0d6134892cbe1262493a8c70d736b9df930f3f3afae0fe3ac924d", size = 262700, upload-time = "2025-12-08T13:14:24.309Z" },
+    { url = "https://files.pythonhosted.org/packages/63/f8/b1d0de5c39351eb71c366f872376d09386640840a2e09b0d03973d791e20/coverage-7.13.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:9372dff5ea15930fea0445eaf37bbbafbc771a49e70c0aeed8b4e2c2614cc00e", size = 260302, upload-time = "2025-12-08T13:14:26.068Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/7c/d42f4435bc40c55558b3109a39e2d456cddcec37434f62a1f1230991667a/coverage-7.13.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:69ac2c492918c2461bc6ace42d0479638e60719f2a4ef3f0815fa2df88e9f940", size = 259136, upload-time = "2025-12-08T13:14:27.604Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/d3/23413241dc04d47cfe19b9a65b32a2edd67ecd0b817400c2843ebc58c847/coverage-7.13.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:739c6c051a7540608d097b8e13c76cfa85263ced467168dc6b477bae3df7d0e2", size = 261467, upload-time = "2025-12-08T13:14:29.09Z" },
+    { url = "https://files.pythonhosted.org/packages/13/e6/6e063174500eee216b96272c0d1847bf215926786f85c2bd024cf4d02d2f/coverage-7.13.0-cp314-cp314t-win32.whl", hash = "sha256:fe81055d8c6c9de76d60c94ddea73c290b416e061d40d542b24a5871bad498b7", size = 221875, upload-time = "2025-12-08T13:14:31.106Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/46/f4fb293e4cbe3620e3ac2a3e8fd566ed33affb5861a9b20e3dd6c1896cbc/coverage-7.13.0-cp314-cp314t-win_amd64.whl", hash = "sha256:445badb539005283825959ac9fa4a28f712c214b65af3a2c464f1adc90f5fcbc", size = 222982, upload-time = "2025-12-08T13:14:33.1Z" },
+    { url = "https://files.pythonhosted.org/packages/68/62/5b3b9018215ed9733fbd1ae3b2ed75c5de62c3b55377a52cae732e1b7805/coverage-7.13.0-cp314-cp314t-win_arm64.whl", hash = "sha256:de7f6748b890708578fc4b7bb967d810aeb6fcc9bff4bb77dbca77dab2f9df6a", size = 221016, upload-time = "2025-12-08T13:14:34.601Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/4c/1968f32fb9a2604645827e11ff84a31e59d532e01995f904723b4f5328b3/coverage-7.13.0-py3-none-any.whl", hash = "sha256:850d2998f380b1e266459ca5b47bc9e7daf9af1d070f66317972f382d46f1904", size = 210068, upload-time = "2025-12-08T13:14:36.236Z" },
 ]
 
 [package.optional-dependencies]
@@ -296,39 +451,51 @@ toml = [
 
 [[package]]
 name = "cryptography"
-version = "45.0.6"
+version = "46.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d6/0d/d13399c94234ee8f3df384819dc67e0c5ce215fb751d567a55a1f4b028c7/cryptography-45.0.6.tar.gz", hash = "sha256:5c966c732cf6e4a276ce83b6e4c729edda2df6929083a952cc7da973c539c719", size = 744949, upload-time = "2025-08-05T23:59:27.93Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/b3/b6/cabd07410f222f32c8d55486c464f432808abaa1f12af9afcbe8f2f19030/cryptography-45.0.6-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:44647c5d796f5fc042bbc6d61307d04bf29bccb74d188f18051b635f20a9c75f", size = 4206483, upload-time = "2025-08-05T23:58:27.132Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/9e/f9c7d36a38b1cfeb1cc74849aabe9bf817990f7603ff6eb485e0d70e0b27/cryptography-45.0.6-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:e40b80ecf35ec265c452eea0ba94c9587ca763e739b8e559c128d23bff7ebbbf", size = 4429679, upload-time = "2025-08-05T23:58:29.152Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/2a/4434c17eb32ef30b254b9e8b9830cee4e516f08b47fdd291c5b1255b8101/cryptography-45.0.6-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:00e8724bdad672d75e6f069b27970883179bd472cd24a63f6e620ca7e41cc0c5", size = 4210553, upload-time = "2025-08-05T23:58:30.596Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/1d/09a5df8e0c4b7970f5d1f3aff1b640df6d4be28a64cae970d56c6cf1c772/cryptography-45.0.6-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7a3085d1b319d35296176af31c90338eeb2ddac8104661df79f80e1d9787b8b2", size = 3894499, upload-time = "2025-08-05T23:58:32.03Z" },
-    { url = "https://files.pythonhosted.org/packages/79/62/120842ab20d9150a9d3a6bdc07fe2870384e82f5266d41c53b08a3a96b34/cryptography-45.0.6-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1b7fa6a1c1188c7ee32e47590d16a5a0646270921f8020efc9a511648e1b2e08", size = 4458484, upload-time = "2025-08-05T23:58:33.526Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/80/1bc3634d45ddfed0871bfba52cf8f1ad724761662a0c792b97a951fb1b30/cryptography-45.0.6-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:275ba5cc0d9e320cd70f8e7b96d9e59903c815ca579ab96c1e37278d231fc402", size = 4210281, upload-time = "2025-08-05T23:58:35.445Z" },
-    { url = "https://files.pythonhosted.org/packages/7d/fe/ffb12c2d83d0ee625f124880a1f023b5878f79da92e64c37962bbbe35f3f/cryptography-45.0.6-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:f4028f29a9f38a2025abedb2e409973709c660d44319c61762202206ed577c42", size = 4456890, upload-time = "2025-08-05T23:58:36.923Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/8e/b3f3fe0dc82c77a0deb5f493b23311e09193f2268b77196ec0f7a36e3f3e/cryptography-45.0.6-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ee411a1b977f40bd075392c80c10b58025ee5c6b47a822a33c1198598a7a5f05", size = 4333247, upload-time = "2025-08-05T23:58:38.781Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/a6/c3ef2ab9e334da27a1d7b56af4a2417d77e7806b2e0f90d6267ce120d2e4/cryptography-45.0.6-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:e2a21a8eda2d86bb604934b6b37691585bd095c1f788530c1fcefc53a82b3453", size = 4565045, upload-time = "2025-08-05T23:58:40.415Z" },
-    { url = "https://files.pythonhosted.org/packages/98/c6/ea5173689e014f1a8470899cd5beeb358e22bb3cf5a876060f9d1ca78af4/cryptography-45.0.6-cp37-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0d9ef57b6768d9fa58e92f4947cea96ade1233c0e236db22ba44748ffedca394", size = 4198169, upload-time = "2025-08-05T23:58:47.121Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/73/b12995edc0c7e2311ffb57ebd3b351f6b268fed37d93bfc6f9856e01c473/cryptography-45.0.6-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ea3c42f2016a5bbf71825537c2ad753f2870191134933196bee408aac397b3d9", size = 4421273, upload-time = "2025-08-05T23:58:48.557Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/6e/286894f6f71926bc0da67408c853dd9ba953f662dcb70993a59fd499f111/cryptography-45.0.6-cp37-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:20ae4906a13716139d6d762ceb3e0e7e110f7955f3bc3876e3a07f5daadec5f3", size = 4199211, upload-time = "2025-08-05T23:58:50.139Z" },
-    { url = "https://files.pythonhosted.org/packages/de/34/a7f55e39b9623c5cb571d77a6a90387fe557908ffc44f6872f26ca8ae270/cryptography-45.0.6-cp37-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2dac5ec199038b8e131365e2324c03d20e97fe214af051d20c49db129844e8b3", size = 3883732, upload-time = "2025-08-05T23:58:52.253Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/b9/c6d32edbcba0cd9f5df90f29ed46a65c4631c4fbe11187feb9169c6ff506/cryptography-45.0.6-cp37-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:18f878a34b90d688982e43f4b700408b478102dd58b3e39de21b5ebf6509c301", size = 4450655, upload-time = "2025-08-05T23:58:53.848Z" },
-    { url = "https://files.pythonhosted.org/packages/77/2d/09b097adfdee0227cfd4c699b3375a842080f065bab9014248933497c3f9/cryptography-45.0.6-cp37-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5bd6020c80c5b2b2242d6c48487d7b85700f5e0038e67b29d706f98440d66eb5", size = 4198956, upload-time = "2025-08-05T23:58:55.209Z" },
-    { url = "https://files.pythonhosted.org/packages/55/66/061ec6689207d54effdff535bbdf85cc380d32dd5377173085812565cf38/cryptography-45.0.6-cp37-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:eccddbd986e43014263eda489abbddfbc287af5cddfd690477993dbb31e31016", size = 4449859, upload-time = "2025-08-05T23:58:56.639Z" },
-    { url = "https://files.pythonhosted.org/packages/41/ff/e7d5a2ad2d035e5a2af116e1a3adb4d8fcd0be92a18032917a089c6e5028/cryptography-45.0.6-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:550ae02148206beb722cfe4ef0933f9352bab26b087af00e48fdfb9ade35c5b3", size = 4320254, upload-time = "2025-08-05T23:58:58.833Z" },
-    { url = "https://files.pythonhosted.org/packages/82/27/092d311af22095d288f4db89fcaebadfb2f28944f3d790a4cf51fe5ddaeb/cryptography-45.0.6-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5b64e668fc3528e77efa51ca70fadcd6610e8ab231e3e06ae2bab3b31c2b8ed9", size = 4554815, upload-time = "2025-08-05T23:59:00.283Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/24/55fc238fcaa122855442604b8badb2d442367dfbd5a7ca4bb0bd346e263a/cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:826b46dae41a1155a0c0e66fafba43d0ede1dc16570b95e40c4d83bfcf0a451d", size = 4141694, upload-time = "2025-08-05T23:59:06.66Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/7e/3ea4fa6fbe51baf3903806a0241c666b04c73d2358a3ecce09ebee8b9622/cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:cc4d66f5dc4dc37b89cfef1bd5044387f7a1f6f0abb490815628501909332d5d", size = 4375010, upload-time = "2025-08-05T23:59:08.14Z" },
-    { url = "https://files.pythonhosted.org/packages/50/42/ec5a892d82d2a2c29f80fc19ced4ba669bca29f032faf6989609cff1f8dc/cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:f68f833a9d445cc49f01097d95c83a850795921b3f7cc6488731e69bde3288da", size = 4141377, upload-time = "2025-08-05T23:59:09.584Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/d7/246c4c973a22b9c2931999da953a2c19cae7c66b9154c2d62ffed811225e/cryptography-45.0.6-pp310-pypy310_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:3b5bf5267e98661b9b888a9250d05b063220dfa917a8203744454573c7eb79db", size = 4374609, upload-time = "2025-08-05T23:59:11.923Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/fe/deea71e9f310a31fe0a6bfee670955152128d309ea2d1c79e2a5ae0f0401/cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:3de77e4df42ac8d4e4d6cdb342d989803ad37707cf8f3fbf7b088c9cbdd46427", size = 4153022, upload-time = "2025-08-05T23:59:16.954Z" },
-    { url = "https://files.pythonhosted.org/packages/60/45/a77452f5e49cb580feedba6606d66ae7b82c128947aa754533b3d1bd44b0/cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:599c8d7df950aa68baa7e98f7b73f4f414c9f02d0e8104a30c0182a07732638b", size = 4386802, upload-time = "2025-08-05T23:59:18.55Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/b9/a2f747d2acd5e3075fdf5c145c7c3568895daaa38b3b0c960ef830db6cdc/cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:31a2b9a10530a1cb04ffd6aa1cd4d3be9ed49f7d77a4dafe198f3b382f41545c", size = 4152706, upload-time = "2025-08-05T23:59:20.044Z" },
-    { url = "https://files.pythonhosted.org/packages/81/ec/381b3e8d0685a3f3f304a382aa3dfce36af2d76467da0fd4bb21ddccc7b2/cryptography-45.0.6-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:e5b3dda1b00fb41da3af4c5ef3f922a200e33ee5ba0f0bc9ecf0b0c173958385", size = 4386740, upload-time = "2025-08-05T23:59:21.525Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/9f/33/c00162f49c0e2fe8064a62cb92b93e50c74a72bc370ab92f86112b33ff62/cryptography-46.0.3.tar.gz", hash = "sha256:a8b17438104fed022ce745b362294d9ce35b4c2e45c1d958ad4a4b019285f4a1", size = 749258, upload-time = "2025-10-15T23:18:31.74Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1c/67/38769ca6b65f07461eb200e85fc1639b438bdc667be02cf7f2cd6a64601c/cryptography-46.0.3-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:09859af8466b69bc3c27bdf4f5d84a665e0f7ab5088412e9e2ec49758eca5cbc", size = 4296667, upload-time = "2025-10-15T23:16:54.369Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/49/498c86566a1d80e978b42f0d702795f69887005548c041636df6ae1ca64c/cryptography-46.0.3-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:01ca9ff2885f3acc98c29f1860552e37f6d7c7d013d7334ff2a9de43a449315d", size = 4450807, upload-time = "2025-10-15T23:16:56.414Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/0a/863a3604112174c8624a2ac3c038662d9e59970c7f926acdcfaed8d61142/cryptography-46.0.3-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:6eae65d4c3d33da080cff9c4ab1f711b15c1d9760809dad6ea763f3812d254cb", size = 4299615, upload-time = "2025-10-15T23:16:58.442Z" },
+    { url = "https://files.pythonhosted.org/packages/64/02/b73a533f6b64a69f3cd3872acb6ebc12aef924d8d103133bb3ea750dc703/cryptography-46.0.3-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5bf0ed4490068a2e72ac03d786693adeb909981cc596425d09032d372bcc849", size = 4016800, upload-time = "2025-10-15T23:17:00.378Z" },
+    { url = "https://files.pythonhosted.org/packages/25/d5/16e41afbfa450cde85a3b7ec599bebefaef16b5c6ba4ec49a3532336ed72/cryptography-46.0.3-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:5ecfccd2329e37e9b7112a888e76d9feca2347f12f37918facbb893d7bb88ee8", size = 4984707, upload-time = "2025-10-15T23:17:01.98Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/56/e7e69b427c3878352c2fb9b450bd0e19ed552753491d39d7d0a2f5226d41/cryptography-46.0.3-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a2c0cd47381a3229c403062f764160d57d4d175e022c1df84e168c6251a22eec", size = 4482541, upload-time = "2025-10-15T23:17:04.078Z" },
+    { url = "https://files.pythonhosted.org/packages/78/f6/50736d40d97e8483172f1bb6e698895b92a223dba513b0ca6f06b2365339/cryptography-46.0.3-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:549e234ff32571b1f4076ac269fcce7a808d3bf98b76c8dd560e42dbc66d7d91", size = 4299464, upload-time = "2025-10-15T23:17:05.483Z" },
+    { url = "https://files.pythonhosted.org/packages/00/de/d8e26b1a855f19d9994a19c702fa2e93b0456beccbcfe437eda00e0701f2/cryptography-46.0.3-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:c0a7bb1a68a5d3471880e264621346c48665b3bf1c3759d682fc0864c540bd9e", size = 4950838, upload-time = "2025-10-15T23:17:07.425Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/29/798fc4ec461a1c9e9f735f2fc58741b0daae30688f41b2497dcbc9ed1355/cryptography-46.0.3-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:10b01676fc208c3e6feeb25a8b83d81767e8059e1fe86e1dc62d10a3018fa926", size = 4481596, upload-time = "2025-10-15T23:17:09.343Z" },
+    { url = "https://files.pythonhosted.org/packages/15/8d/03cd48b20a573adfff7652b76271078e3045b9f49387920e7f1f631d125e/cryptography-46.0.3-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:0abf1ffd6e57c67e92af68330d05760b7b7efb243aab8377e583284dbab72c71", size = 4426782, upload-time = "2025-10-15T23:17:11.22Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/b1/ebacbfe53317d55cf33165bda24c86523497a6881f339f9aae5c2e13e57b/cryptography-46.0.3-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a04bee9ab6a4da801eb9b51f1b708a1b5b5c9eb48c03f74198464c66f0d344ac", size = 4698381, upload-time = "2025-10-15T23:17:12.829Z" },
+    { url = "https://files.pythonhosted.org/packages/73/dc/9aa866fbdbb95b02e7f9d086f1fccfeebf8953509b87e3f28fff927ff8a0/cryptography-46.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c8daeb2d2174beb4575b77482320303f3d39b8e81153da4f0fb08eb5fe86a6c5", size = 4288728, upload-time = "2025-10-15T23:17:21.527Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/fd/bc1daf8230eaa075184cbbf5f8cd00ba9db4fd32d63fb83da4671b72ed8a/cryptography-46.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:39b6755623145ad5eff1dab323f4eae2a32a77a7abef2c5089a04a3d04366715", size = 4435078, upload-time = "2025-10-15T23:17:23.042Z" },
+    { url = "https://files.pythonhosted.org/packages/82/98/d3bd5407ce4c60017f8ff9e63ffee4200ab3e23fe05b765cab805a7db008/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:db391fa7c66df6762ee3f00c95a89e6d428f4d60e7abc8328f4fe155b5ac6e54", size = 4293460, upload-time = "2025-10-15T23:17:24.885Z" },
+    { url = "https://files.pythonhosted.org/packages/26/e9/e23e7900983c2b8af7a08098db406cf989d7f09caea7897e347598d4cd5b/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:78a97cf6a8839a48c49271cdcbd5cf37ca2c1d6b7fdd86cc864f302b5e9bf459", size = 3995237, upload-time = "2025-10-15T23:17:26.449Z" },
+    { url = "https://files.pythonhosted.org/packages/91/15/af68c509d4a138cfe299d0d7ddb14afba15233223ebd933b4bbdbc7155d3/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:dfb781ff7eaa91a6f7fd41776ec37c5853c795d3b358d4896fdbb5df168af422", size = 4967344, upload-time = "2025-10-15T23:17:28.06Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/e3/8643d077c53868b681af077edf6b3cb58288b5423610f21c62aadcbe99f4/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:6f61efb26e76c45c4a227835ddeae96d83624fb0d29eb5df5b96e14ed1a0afb7", size = 4466564, upload-time = "2025-10-15T23:17:29.665Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/43/c1e8726fa59c236ff477ff2b5dc071e54b21e5a1e51aa2cee1676f1c986f/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:23b1a8f26e43f47ceb6d6a43115f33a5a37d57df4ea0ca295b780ae8546e8044", size = 4292415, upload-time = "2025-10-15T23:17:31.686Z" },
+    { url = "https://files.pythonhosted.org/packages/42/f9/2f8fefdb1aee8a8e3256a0568cffc4e6d517b256a2fe97a029b3f1b9fe7e/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b419ae593c86b87014b9be7396b385491ad7f320bde96826d0dd174459e54665", size = 4931457, upload-time = "2025-10-15T23:17:33.478Z" },
+    { url = "https://files.pythonhosted.org/packages/79/30/9b54127a9a778ccd6d27c3da7563e9f2d341826075ceab89ae3b41bf5be2/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:50fc3343ac490c6b08c0cf0d704e881d0d660be923fd3076db3e932007e726e3", size = 4466074, upload-time = "2025-10-15T23:17:35.158Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/68/b4f4a10928e26c941b1b6a179143af9f4d27d88fe84a6a3c53592d2e76bf/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:22d7e97932f511d6b0b04f2bfd818d73dcd5928db509460aaf48384778eb6d20", size = 4420569, upload-time = "2025-10-15T23:17:37.188Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/49/3746dab4c0d1979888f125226357d3262a6dd40e114ac29e3d2abdf1ec55/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d55f3dffadd674514ad19451161118fd010988540cee43d8bc20675e775925de", size = 4681941, upload-time = "2025-10-15T23:17:39.236Z" },
+    { url = "https://files.pythonhosted.org/packages/27/32/b68d27471372737054cbd34c84981f9edbc24fe67ca225d389799614e27f/cryptography-46.0.3-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:4b7387121ac7d15e550f5cb4a43aef2559ed759c35df7336c402bb8275ac9683", size = 4294089, upload-time = "2025-10-15T23:17:48.269Z" },
+    { url = "https://files.pythonhosted.org/packages/26/42/fa8389d4478368743e24e61eea78846a0006caffaf72ea24a15159215a14/cryptography-46.0.3-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:15ab9b093e8f09daab0f2159bb7e47532596075139dd74365da52ecc9cb46c5d", size = 4440029, upload-time = "2025-10-15T23:17:49.837Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/eb/f483db0ec5ac040824f269e93dd2bd8a21ecd1027e77ad7bdf6914f2fd80/cryptography-46.0.3-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:46acf53b40ea38f9c6c229599a4a13f0d46a6c3fa9ef19fc1a124d62e338dfa0", size = 4297222, upload-time = "2025-10-15T23:17:51.357Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/cf/da9502c4e1912cb1da3807ea3618a6829bee8207456fbbeebc361ec38ba3/cryptography-46.0.3-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:10ca84c4668d066a9878890047f03546f3ae0a6b8b39b697457b7757aaf18dbc", size = 4012280, upload-time = "2025-10-15T23:17:52.964Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/8f/9adb86b93330e0df8b3dcf03eae67c33ba89958fc2e03862ef1ac2b42465/cryptography-46.0.3-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:36e627112085bb3b81b19fed209c05ce2a52ee8b15d161b7c643a7d5a88491f3", size = 4978958, upload-time = "2025-10-15T23:17:54.965Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a0/5fa77988289c34bdb9f913f5606ecc9ada1adb5ae870bd0d1054a7021cc4/cryptography-46.0.3-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1000713389b75c449a6e979ffc7dcc8ac90b437048766cef052d4d30b8220971", size = 4473714, upload-time = "2025-10-15T23:17:56.754Z" },
+    { url = "https://files.pythonhosted.org/packages/14/e5/fc82d72a58d41c393697aa18c9abe5ae1214ff6f2a5c18ac470f92777895/cryptography-46.0.3-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:b02cf04496f6576afffef5ddd04a0cb7d49cf6be16a9059d793a30b035f6b6ac", size = 4296970, upload-time = "2025-10-15T23:17:58.588Z" },
+    { url = "https://files.pythonhosted.org/packages/78/06/5663ed35438d0b09056973994f1aec467492b33bd31da36e468b01ec1097/cryptography-46.0.3-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:71e842ec9bc7abf543b47cf86b9a743baa95f4677d22baa4c7d5c69e49e9bc04", size = 4940236, upload-time = "2025-10-15T23:18:00.897Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/59/873633f3f2dcd8a053b8dd1d38f783043b5fce589c0f6988bf55ef57e43e/cryptography-46.0.3-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:402b58fc32614f00980b66d6e56a5b4118e6cb362ae8f3fda141ba4689bd4506", size = 4472642, upload-time = "2025-10-15T23:18:02.749Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/39/8e71f3930e40f6877737d6f69248cf74d4e34b886a3967d32f919cc50d3b/cryptography-46.0.3-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ef639cb3372f69ec44915fafcd6698b6cc78fbe0c2ea41be867f6ed612811963", size = 4423126, upload-time = "2025-10-15T23:18:04.85Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/c7/f65027c2810e14c3e7268353b1681932b87e5a48e65505d8cc17c99e36ae/cryptography-46.0.3-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3b51b8ca4f1c6453d8829e1eb7299499ca7f313900dd4d89a24b8b87c0a780d4", size = 4686573, upload-time = "2025-10-15T23:18:06.908Z" },
+    { url = "https://files.pythonhosted.org/packages/da/38/f59940ec4ee91e93d3311f7532671a5cef5570eb04a144bf203b58552d11/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:191bb60a7be5e6f54e30ba16fdfae78ad3a342a0599eb4193ba88e3f3d6e185b", size = 4243992, upload-time = "2025-10-15T23:18:18.695Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/0c/35b3d92ddebfdfda76bb485738306545817253d0a3ded0bfe80ef8e67aa5/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c70cc23f12726be8f8bc72e41d5065d77e4515efae3690326764ea1b07845cfb", size = 4409944, upload-time = "2025-10-15T23:18:20.597Z" },
+    { url = "https://files.pythonhosted.org/packages/99/55/181022996c4063fc0e7666a47049a1ca705abb9c8a13830f074edb347495/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:9394673a9f4de09e28b5356e7fff97d778f8abad85c9d5ac4a4b7e25a0de7717", size = 4242957, upload-time = "2025-10-15T23:18:22.18Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/af/72cd6ef29f9c5f731251acadaeb821559fe25f10852f44a63374c9ca08c1/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:94cd0549accc38d1494e1f8de71eca837d0509d0d44bf11d158524b0e12cebf9", size = 4409447, upload-time = "2025-10-15T23:18:24.209Z" },
 ]
 
 [[package]]
@@ -348,32 +515,32 @@ sdist = { url = "https://files.pythonhosted.org/packages/a2/55/8f8cab2afd404cf57
 
 [[package]]
 name = "docutils"
-version = "0.22"
+version = "0.22.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e9/86/5b41c32ecedcfdb4c77b28b6cb14234f252075f8cdb254531727a35547dd/docutils-0.22.tar.gz", hash = "sha256:ba9d57750e92331ebe7c08a1bbf7a7f8143b86c476acd51528b042216a6aad0f", size = 2277984, upload-time = "2025-07-29T15:20:31.06Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d9/02/111134bfeb6e6c7ac4c74594e39a59f6c0195dc4846afbeac3cba60f1927/docutils-0.22.3.tar.gz", hash = "sha256:21486ae730e4ca9f622677b1412b879af1791efcfba517e4c6f60be543fc8cdd", size = 2290153, upload-time = "2025-11-06T02:35:55.655Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/44/57/8db39bc5f98f042e0153b1de9fb88e1a409a33cda4dd7f723c2ed71e01f6/docutils-0.22-py3-none-any.whl", hash = "sha256:4ed966a0e96a0477d852f7af31bdcb3adc049fbb35ccba358c2ea8a03287615e", size = 630709, upload-time = "2025-07-29T15:20:28.335Z" },
+    { url = "https://files.pythonhosted.org/packages/11/a8/c6a4b901d17399c77cd81fb001ce8961e9f5e04d3daf27e8925cb012e163/docutils-0.22.3-py3-none-any.whl", hash = "sha256:bd772e4aca73aff037958d44f2be5229ded4c09927fcf8690c577b66234d6ceb", size = 633032, upload-time = "2025-11-06T02:35:52.391Z" },
 ]
 
 [[package]]
 name = "exceptiongroup"
-version = "1.3.0"
+version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/0b/9f/a65090624ecf468cdca03533906e7c69ed7588582240cfe7cc9e770b50eb/exceptiongroup-1.3.0.tar.gz", hash = "sha256:b241f5885f560bc56a59ee63ca4c6a8bfa46ae4ad651af316d4e81817bb9fd88", size = 29749, upload-time = "2025-05-10T17:42:51.123Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/36/f4/c6e662dade71f56cd2f3735141b265c3c79293c109549c1e6933b0651ffc/exceptiongroup-1.3.0-py3-none-any.whl", hash = "sha256:4d111e6e0c13d0644cad6ddaa7ed0261a0b36971f6d23e7ec9b4b9097da78a10", size = 16674, upload-time = "2025-05-10T17:42:49.33Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/0e/97c33bf5009bdbac74fd2beace167cab3f978feb69cc36f1ef79360d6c4e/exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598", size = 16740, upload-time = "2025-11-21T23:01:53.443Z" },
 ]
 
 [[package]]
 name = "filelock"
-version = "3.19.1"
+version = "3.20.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/40/bb/0ab3e58d22305b6f5440629d20683af28959bf793d98d11950e305c1c326/filelock-3.19.1.tar.gz", hash = "sha256:66eda1888b0171c998b35be2bcc0f6d75c388a7ce20c3f3f37aa8e96c2dddf58", size = 17687, upload-time = "2025-08-14T16:56:03.016Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/58/46/0028a82567109b5ef6e4d2a1f04a583fb513e6cf9527fcdd09afd817deeb/filelock-3.20.0.tar.gz", hash = "sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4", size = 18922, upload-time = "2025-10-08T18:03:50.056Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/42/14/42b2651a2f46b022ccd948bca9f2d5af0fd8929c4eec235b8d6d844fbe67/filelock-3.19.1-py3-none-any.whl", hash = "sha256:d38e30481def20772f5baf097c122c3babc4fcdb7e14e57049eb9d88c6dc017d", size = 15988, upload-time = "2025-08-14T16:56:01.633Z" },
+    { url = "https://files.pythonhosted.org/packages/76/91/7216b27286936c16f5b4d0c530087e4a54eead683e6b0b73dd0c64844af6/filelock-3.20.0-py3-none-any.whl", hash = "sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2", size = 16054, upload-time = "2025-10-08T18:03:48.35Z" },
 ]
 
 [[package]]
@@ -411,9 +578,10 @@ wheels = [
 
 [[package]]
 name = "hatch"
-version = "1.14.1"
+version = "1.16.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "backports-zstd", marker = "python_full_version < '3.14'" },
     { name = "click" },
     { name = "hatchling" },
     { name = "httpx" },
@@ -422,6 +590,7 @@ dependencies = [
     { name = "packaging" },
     { name = "pexpect" },
     { name = "platformdirs" },
+    { name = "pyproject-hooks" },
     { name = "rich" },
     { name = "shellingham" },
     { name = "tomli-w" },
@@ -429,16 +598,15 @@ dependencies = [
     { name = "userpath" },
     { name = "uv" },
     { name = "virtualenv" },
-    { name = "zstandard" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1f/43/c0b37db0e857a44ce5ffdb7e8a9b8fa6425d0b74dea698fafcd9bddb50d1/hatch-1.14.1.tar.gz", hash = "sha256:ca1aff788f8596b0dd1f8f8dfe776443d2724a86b1976fabaf087406ba3d0713", size = 5188180, upload-time = "2025-04-07T04:16:04.522Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b9/c1/8598996a6f264d430c530799dc65fb13942fb29092e35505039a5f2fb5dc/hatch-1.16.2.tar.gz", hash = "sha256:f288938da85b4b90e47d94788e19e9976dcd6fd53b48343ea251a2a37256a980", size = 5216569, upload-time = "2025-12-06T19:18:12.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a5/40/19c0935bf9f25808541a0e3144ac459de696c5b6b6d4511a98d456c69604/hatch-1.14.1-py3-none-any.whl", hash = "sha256:39cdaa59e47ce0c5505d88a951f4324a9c5aafa17e4a877e2fde79b36ab66c21", size = 125770, upload-time = "2025-04-07T04:16:02.525Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/7c/bbed5611b1cd7b0b42b2dadb0721d9ccfa4fa9d03abc05e0f57c85a319c6/hatch-1.16.2-py3-none-any.whl", hash = "sha256:827eaf9813c63119f172b85975c5c27110a2306b07e5304c9d38527b0239052a", size = 140658, upload-time = "2025-12-06T19:18:10.573Z" },
 ]
 
 [[package]]
 name = "hatchling"
-version = "1.27.0"
+version = "1.28.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "packaging" },
@@ -447,9 +615,9 @@ dependencies = [
     { name = "tomli", marker = "python_full_version < '3.11'" },
     { name = "trove-classifiers" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/8f/8a/cc1debe3514da292094f1c3a700e4ca25442489731ef7c0814358816bb03/hatchling-1.27.0.tar.gz", hash = "sha256:971c296d9819abb3811112fc52c7a9751c8d381898f36533bb16f9791e941fd6", size = 54983, upload-time = "2024-12-15T17:08:11.894Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0b/8e/e480359492affde4119a131da729dd26da742c2c9b604dff74836e47eef9/hatchling-1.28.0.tar.gz", hash = "sha256:4d50b02aece6892b8cd0b3ce6c82cb218594d3ec5836dbde75bf41a21ab004c8", size = 55365, upload-time = "2025-11-27T00:31:13.766Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/08/e7/ae38d7a6dfba0533684e0b2136817d667588ae3ec984c1a4e5df5eb88482/hatchling-1.27.0-py3-none-any.whl", hash = "sha256:d3a2f3567c4f926ea39849cdf924c7e99e6686c9c8e288ae1037c8fa2a5d937b", size = 75794, upload-time = "2024-12-15T17:08:10.364Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/a5/48cb7efb8b4718b1a4c0c331e3364a3a33f614ff0d6afd2b93ee883d3c47/hatchling-1.28.0-py3-none-any.whl", hash = "sha256:dc48722b68b3f4bbfa3ff618ca07cdea6750e7d03481289ffa8be1521d18a961", size = 76075, upload-time = "2025-11-27T00:31:12.544Z" },
 ]
 
 [[package]]
@@ -506,20 +674,20 @@ wheels = [
 
 [[package]]
 name = "identify"
-version = "2.6.13"
+version = "2.6.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/82/ca/ffbabe3635bb839aa36b3a893c91a9b0d368cb4d8073e03a12896970af82/identify-2.6.13.tar.gz", hash = "sha256:da8d6c828e773620e13bfa86ea601c5a5310ba4bcd65edf378198b56a1f9fb32", size = 99243, upload-time = "2025-08-09T19:35:00.6Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ff/e7/685de97986c916a6d93b3876139e00eef26ad5bbbd61925d670ae8013449/identify-2.6.15.tar.gz", hash = "sha256:e4f4864b96c6557ef2a1e1c951771838f4edc9df3a72ec7118b338801b11c7bf", size = 99311, upload-time = "2025-10-02T17:43:40.631Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e7/ce/461b60a3ee109518c055953729bf9ed089a04db895d47e95444071dcdef2/identify-2.6.13-py2.py3-none-any.whl", hash = "sha256:60381139b3ae39447482ecc406944190f690d4a2997f2584062089848361b33b", size = 99153, upload-time = "2025-08-09T19:34:59.1Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/1c/e5fd8f973d4f375adb21565739498e2e9a1e54c858a97b9a8ccfdc81da9b/identify-2.6.15-py2.py3-none-any.whl", hash = "sha256:1181ef7608e00704db228516541eb83a88a9f94433a8c80bb9b5bd54b1d81757", size = 99183, upload-time = "2025-10-02T17:43:39.137Z" },
 ]
 
 [[package]]
 name = "idna"
-version = "3.10"
+version = "3.11"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f1/70/7703c29685631f5a7590aa73f1f1d3fa9a380e654b86af429e0934a32f7d/idna-3.10.tar.gz", hash = "sha256:12f65c9b470abda6dc35cf8e63cc574b1c52b11df2c86030af0ac09b01b13ea9", size = 190490, upload-time = "2024-09-15T18:07:39.745Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/c6/c88e154df9c4e1a2a66ccf0005a88dfb2650c1dffb6f5ce603dfbd452ce3/idna-3.10-py3-none-any.whl", hash = "sha256:946d195a0d259cbba61165e88e65941f16e9b36ea6ddb97f00452bae8b1287d3", size = 70442, upload-time = "2024-09-15T18:07:37.964Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
 ]
 
 [[package]]
@@ -536,11 +704,11 @@ wheels = [
 
 [[package]]
 name = "iniconfig"
-version = "2.1.0"
+version = "2.3.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f2/97/ebf4da567aa6827c909642694d71c9fcf53e5b504f2d96afea02718862f3/iniconfig-2.1.0.tar.gz", hash = "sha256:3abbd2e30b36733fee78f9c7f7308f2d0050e88f0087fd25c2645f63c773e1c7", size = 4793, upload-time = "2025-03-19T20:09:59.721Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2c/e1/e6716421ea10d38022b952c159d5161ca1193197fb744506875fbb87ea7b/iniconfig-2.1.0-py3-none-any.whl", hash = "sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760", size = 6050, upload-time = "2025-03-19T20:10:01.071Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
 ]
 
 [[package]]
@@ -590,7 +758,7 @@ wheels = [
 
 [[package]]
 name = "keyring"
-version = "25.6.0"
+version = "25.7.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "importlib-metadata", marker = "python_full_version < '3.12'" },
@@ -601,9 +769,9 @@ dependencies = [
     { name = "pywin32-ctypes", marker = "sys_platform == 'win32'" },
     { name = "secretstorage", marker = "sys_platform == 'linux'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/70/09/d904a6e96f76ff214be59e7aa6ef7190008f52a0ab6689760a98de0bf37d/keyring-25.6.0.tar.gz", hash = "sha256:0b39998aa941431eb3d9b0d4b2460bc773b9df6fed7621c2dfb291a7e0187a66", size = 62750, upload-time = "2024-12-25T15:26:45.782Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/4b/674af6ef2f97d56f0ab5153bf0bfa28ccb6c3ed4d1babf4305449668807b/keyring-25.7.0.tar.gz", hash = "sha256:fe01bd85eb3f8fb3dd0405defdeac9a5b4f6f0439edbb3149577f244a2e8245b", size = 63516, upload-time = "2025-11-16T16:26:09.482Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d3/32/da7f44bcb1105d3e88a0b74ebdca50c59121d2ddf71c9e34ba47df7f3a56/keyring-25.6.0-py3-none-any.whl", hash = "sha256:552a3f7af126ece7ed5c89753650eec89c7eaae8617d0aa4d9ad2b75111266bd", size = 39085, upload-time = "2024-12-25T15:26:44.377Z" },
+    { url = "https://files.pythonhosted.org/packages/81/db/e655086b7f3a705df045bf0933bdd9c2f79bb3c97bfef1384598bb79a217/keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f", size = 39160, upload-time = "2025-11-16T16:26:08.402Z" },
 ]
 
 [[package]]
@@ -629,53 +797,53 @@ wheels = [
 
 [[package]]
 name = "mdutils"
-version = "1.8.0"
+version = "1.8.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/28/4b/df40d441a280f20fa173f224577fbbb2477851a73736080c89a61ff8a4dd/mdutils-1.8.0.tar.gz", hash = "sha256:091b605b4b550465a304f1c66d37647b6008b4a19e7b5154a7d39a148e903f6d", size = 23909, upload-time = "2025-07-10T19:09:41.194Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8a/44/73810a6af37f57ec00f6e480bbb0f24ea1e25e85923025eb8ddabc54fe68/mdutils-1.8.1.tar.gz", hash = "sha256:cdce6bde79822a7fea3c8fd6426cea0acfadd0f94ee3d3ebfa09aa38b561af35", size = 24077, upload-time = "2025-10-18T15:30:14.546Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9c/6b/d4c6e92daf6123696797e9914e4a3d36e2ba24a2ff1aad00c2d6d2afb82d/mdutils-1.8.0-py3-none-any.whl", hash = "sha256:0d3cf9af4a958f3bbd184c1097985bb1d1f9489887e1f7329942ada14359c7ba", size = 21647, upload-time = "2025-07-10T19:09:40.063Z" },
+    { url = "https://files.pythonhosted.org/packages/06/38/f2eeaa5d1c13e64a4dc18b5c6e28b9d5f8b20f5450ba8c3a694e4a78893d/mdutils-1.8.1-py3-none-any.whl", hash = "sha256:3d62d0a4d19fcd68d1daf956d1832f4a598663c73022bd95b09fae69c994b5ac", size = 21656, upload-time = "2025-10-18T15:30:13.129Z" },
 ]
 
 [[package]]
 name = "more-itertools"
-version = "10.7.0"
+version = "10.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ce/a0/834b0cebabbfc7e311f30b46c8188790a37f89fc8d756660346fe5abfd09/more_itertools-10.7.0.tar.gz", hash = "sha256:9fddd5403be01a94b204faadcff459ec3568cf110265d3c54323e1e866ad29d3", size = 127671, upload-time = "2025-04-22T14:17:41.838Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ea/5d/38b681d3fce7a266dd9ab73c66959406d565b3e85f21d5e66e1181d93721/more_itertools-10.8.0.tar.gz", hash = "sha256:f638ddf8a1a0d134181275fb5d58b086ead7c6a72429ad725c67503f13ba30bd", size = 137431, upload-time = "2025-09-02T15:23:11.018Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2b/9f/7ba6f94fc1e9ac3d2b853fdff3035fb2fa5afbed898c4a72b8a020610594/more_itertools-10.7.0-py3-none-any.whl", hash = "sha256:d43980384673cb07d2f7d2d918c616b30c659c089ee23953f601d6609c67510e", size = 65278, upload-time = "2025-04-22T14:17:40.49Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/8e/469e5a4a2f5855992e425f3cb33804cc07bf18d48f2db061aec61ce50270/more_itertools-10.8.0-py3-none-any.whl", hash = "sha256:52d4362373dcf7c52546bc4af9a86ee7c4579df9a8dc268be0a2f949d376cc9b", size = 69667, upload-time = "2025-09-02T15:23:09.635Z" },
 ]
 
 [[package]]
 name = "nh3"
-version = "0.3.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c3/a4/96cff0977357f60f06ec4368c4c7a7a26cccfe7c9fcd54f5378bf0428fd3/nh3-0.3.0.tar.gz", hash = "sha256:d8ba24cb31525492ea71b6aac11a4adac91d828aadeff7c4586541bf5dc34d2f", size = 19655, upload-time = "2025-07-17T14:43:37.05Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/b4/11/340b7a551916a4b2b68c54799d710f86cf3838a4abaad8e74d35360343bb/nh3-0.3.0-cp313-cp313t-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:a537ece1bf513e5a88d8cff8a872e12fe8d0f42ef71dd15a5e7520fecd191bbb", size = 1427992, upload-time = "2025-07-17T14:43:06.848Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/7f/7c6b8358cf1222921747844ab0eef81129e9970b952fcb814df417159fb9/nh3-0.3.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7c915060a2c8131bef6a29f78debc29ba40859b6dbe2362ef9e5fd44f11487c2", size = 798194, upload-time = "2025-07-17T14:43:08.263Z" },
-    { url = "https://files.pythonhosted.org/packages/63/da/c5fd472b700ba37d2df630a9e0d8cc156033551ceb8b4c49cc8a5f606b68/nh3-0.3.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:ba0caa8aa184196daa6e574d997a33867d6d10234018012d35f86d46024a2a95", size = 837884, upload-time = "2025-07-17T14:43:09.233Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/3c/cba7b26ccc0ef150c81646478aa32f9c9535234f54845603c838a1dc955c/nh3-0.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:80fe20171c6da69c7978ecba33b638e951b85fb92059259edd285ff108b82a6d", size = 996365, upload-time = "2025-07-17T14:43:10.243Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/ba/59e204d90727c25b253856e456ea61265ca810cda8ee802c35f3fadaab00/nh3-0.3.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:e90883f9f85288f423c77b3f5a6f4486375636f25f793165112679a7b6363b35", size = 1071042, upload-time = "2025-07-17T14:43:11.57Z" },
-    { url = "https://files.pythonhosted.org/packages/10/71/2fb1834c10fab6d9291d62c95192ea2f4c7518bd32ad6c46aab5d095cb87/nh3-0.3.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:0649464ac8eee018644aacbc103874ccbfac80e3035643c3acaab4287e36e7f5", size = 995737, upload-time = "2025-07-17T14:43:12.659Z" },
-    { url = "https://files.pythonhosted.org/packages/33/c1/8f8ccc2492a000b6156dce68a43253fcff8b4ce70ab4216d08f90a2ac998/nh3-0.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:1adeb1062a1c2974bc75b8d1ecb014c5fd4daf2df646bbe2831f7c23659793f9", size = 980552, upload-time = "2025-07-17T14:43:13.763Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/d6/f1c6e091cbe8700401c736c2bc3980c46dca770a2cf6a3b48a175114058e/nh3-0.3.0-cp313-cp313t-win32.whl", hash = "sha256:7275fdffaab10cc5801bf026e3c089d8de40a997afc9e41b981f7ac48c5aa7d5", size = 593618, upload-time = "2025-07-17T14:43:15.098Z" },
-    { url = "https://files.pythonhosted.org/packages/23/1e/80a8c517655dd40bb13363fc4d9e66b2f13245763faab1a20f1df67165a7/nh3-0.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:423201bbdf3164a9e09aa01e540adbb94c9962cc177d5b1cbb385f5e1e79216e", size = 598948, upload-time = "2025-07-17T14:43:16.064Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/e0/af86d2a974c87a4ba7f19bc3b44a8eaa3da480de264138fec82fe17b340b/nh3-0.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:16f8670201f7e8e0e05ed1a590eb84bfa51b01a69dd5caf1d3ea57733de6a52f", size = 580479, upload-time = "2025-07-17T14:43:17.038Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/e0/cf1543e798ba86d838952e8be4cb8d18e22999be2a24b112a671f1c04fd6/nh3-0.3.0-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:ec6cfdd2e0399cb79ba4dcffb2332b94d9696c52272ff9d48a630c5dca5e325a", size = 1442218, upload-time = "2025-07-17T14:43:18.087Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/86/a96b1453c107b815f9ab8fac5412407c33cc5c7580a4daf57aabeb41b774/nh3-0.3.0-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce5e7185599f89b0e391e2f29cc12dc2e206167380cea49b33beda4891be2fe1", size = 823791, upload-time = "2025-07-17T14:43:19.721Z" },
-    { url = "https://files.pythonhosted.org/packages/97/33/11e7273b663839626f714cb68f6eb49899da5a0d9b6bc47b41fe870259c2/nh3-0.3.0-cp38-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:389d93d59b8214d51c400fb5b07866c2a4f79e4e14b071ad66c92184fec3a392", size = 811143, upload-time = "2025-07-17T14:43:20.779Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/1b/b15bd1ce201a1a610aeb44afd478d55ac018b4475920a3118ffd806e2483/nh3-0.3.0-cp38-abi3-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:e9e6a7e4d38f7e8dda9edd1433af5170c597336c1a74b4693c5cb75ab2b30f2a", size = 1064661, upload-time = "2025-07-17T14:43:21.839Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/14/079670fb2e848c4ba2476c5a7a2d1319826053f4f0368f61fca9bb4227ae/nh3-0.3.0-cp38-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7852f038a054e0096dac12b8141191e02e93e0b4608c4b993ec7d4ffafea4e49", size = 997061, upload-time = "2025-07-17T14:43:23.179Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/e5/ac7fc565f5d8bce7f979d1afd68e8cb415020d62fa6507133281c7d49f91/nh3-0.3.0-cp38-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:af5aa8127f62bbf03d68f67a956627b1bd0469703a35b3dad28d0c1195e6c7fb", size = 924761, upload-time = "2025-07-17T14:43:24.23Z" },
-    { url = "https://files.pythonhosted.org/packages/39/2c/6394301428b2017a9d5644af25f487fa557d06bc8a491769accec7524d9a/nh3-0.3.0-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f416c35efee3e6a6c9ab7716d9e57aa0a49981be915963a82697952cba1353e1", size = 803959, upload-time = "2025-07-17T14:43:26.377Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/9a/344b9f9c4bd1c2413a397f38ee6a3d5db30f1a507d4976e046226f12b297/nh3-0.3.0-cp38-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:37d3003d98dedca6cd762bf88f2e70b67f05100f6b949ffe540e189cc06887f9", size = 844073, upload-time = "2025-07-17T14:43:27.375Z" },
-    { url = "https://files.pythonhosted.org/packages/66/3f/cd37f76c8ca277b02a84aa20d7bd60fbac85b4e2cbdae77cb759b22de58b/nh3-0.3.0-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:634e34e6162e0408e14fb61d5e69dbaea32f59e847cfcfa41b66100a6b796f62", size = 1000680, upload-time = "2025-07-17T14:43:28.452Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/db/7aa11b44bae4e7474feb1201d8dee04fabe5651c7cb51409ebda94a4ed67/nh3-0.3.0-cp38-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:b0612ccf5de8a480cf08f047b08f9d3fecc12e63d2ee91769cb19d7290614c23", size = 1076613, upload-time = "2025-07-17T14:43:30.031Z" },
-    { url = "https://files.pythonhosted.org/packages/97/03/03f79f7e5178eb1ad5083af84faff471e866801beb980cc72943a4397368/nh3-0.3.0-cp38-abi3-musllinux_1_2_i686.whl", hash = "sha256:c7a32a7f0d89f7d30cb8f4a84bdbd56d1eb88b78a2434534f62c71dac538c450", size = 1001418, upload-time = "2025-07-17T14:43:31.429Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/55/1974bcc16884a397ee699cebd3914e1f59be64ab305533347ca2d983756f/nh3-0.3.0-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3f1b4f8a264a0c86ea01da0d0c390fe295ea0bcacc52c2103aca286f6884f518", size = 986499, upload-time = "2025-07-17T14:43:32.459Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/50/76936ec021fe1f3270c03278b8af5f2079038116b5d0bfe8538ffe699d69/nh3-0.3.0-cp38-abi3-win32.whl", hash = "sha256:6d68fa277b4a3cf04e5c4b84dd0c6149ff7d56c12b3e3fab304c525b850f613d", size = 599000, upload-time = "2025-07-17T14:43:33.852Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/ae/324b165d904dc1672eee5f5661c0a68d4bab5b59fbb07afb6d8d19a30b45/nh3-0.3.0-cp38-abi3-win_amd64.whl", hash = "sha256:bae63772408fd63ad836ec569a7c8f444dd32863d0c67f6e0b25ebbd606afa95", size = 604530, upload-time = "2025-07-17T14:43:34.95Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/76/3165e84e5266d146d967a6cc784ff2fbf6ddd00985a55ec006b72bc39d5d/nh3-0.3.0-cp38-abi3-win_arm64.whl", hash = "sha256:d97d3efd61404af7e5721a0e74d81cdbfc6e5f97e11e731bb6d090e30a7b62b2", size = 585971, upload-time = "2025-07-17T14:43:35.936Z" },
+version = "0.3.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/a5/34c26015d3a434409f4d2a1cd8821a06c05238703f49283ffeb937bef093/nh3-0.3.2.tar.gz", hash = "sha256:f394759a06df8b685a4ebfb1874fb67a9cbfd58c64fc5ed587a663c0e63ec376", size = 19288, upload-time = "2025-10-30T11:17:45.948Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5b/01/a1eda067c0ba823e5e2bb033864ae4854549e49fb6f3407d2da949106bfb/nh3-0.3.2-cp314-cp314t-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:d18957a90806d943d141cc5e4a0fefa1d77cf0d7a156878bf9a66eed52c9cc7d", size = 1419839, upload-time = "2025-10-30T11:17:09.956Z" },
+    { url = "https://files.pythonhosted.org/packages/30/57/07826ff65d59e7e9cc789ef1dc405f660cabd7458a1864ab58aefa17411b/nh3-0.3.2-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:45c953e57028c31d473d6b648552d9cab1efe20a42ad139d78e11d8f42a36130", size = 791183, upload-time = "2025-10-30T11:17:11.99Z" },
+    { url = "https://files.pythonhosted.org/packages/af/2f/e8a86f861ad83f3bb5455f596d5c802e34fcdb8c53a489083a70fd301333/nh3-0.3.2-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:2c9850041b77a9147d6bbd6dbbf13eeec7009eb60b44e83f07fcb2910075bf9b", size = 829127, upload-time = "2025-10-30T11:17:13.192Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/97/77aef4daf0479754e8e90c7f8f48f3b7b8725a3b8c0df45f2258017a6895/nh3-0.3.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:403c11563e50b915d0efdb622866d1d9e4506bce590ef7da57789bf71dd148b5", size = 997131, upload-time = "2025-10-30T11:17:14.677Z" },
+    { url = "https://files.pythonhosted.org/packages/41/ee/fd8140e4df9d52143e89951dd0d797f5546004c6043285289fbbe3112293/nh3-0.3.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:0dca4365db62b2d71ff1620ee4f800c4729849906c5dd504ee1a7b2389558e31", size = 1068783, upload-time = "2025-10-30T11:17:15.861Z" },
+    { url = "https://files.pythonhosted.org/packages/87/64/bdd9631779e2d588b08391f7555828f352e7f6427889daf2fa424bfc90c9/nh3-0.3.2-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:0fe7ee035dd7b2290715baf29cb27167dddd2ff70ea7d052c958dbd80d323c99", size = 994732, upload-time = "2025-10-30T11:17:17.155Z" },
+    { url = "https://files.pythonhosted.org/packages/79/66/90190033654f1f28ca98e3d76b8be1194505583f9426b0dcde782a3970a2/nh3-0.3.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a40202fd58e49129764f025bbaae77028e420f1d5b3c8e6f6fd3a6490d513868", size = 975997, upload-time = "2025-10-30T11:17:18.77Z" },
+    { url = "https://files.pythonhosted.org/packages/34/30/ebf8e2e8d71fdb5a5d5d8836207177aed1682df819cbde7f42f16898946c/nh3-0.3.2-cp314-cp314t-win32.whl", hash = "sha256:1f9ba555a797dbdcd844b89523f29cdc90973d8bd2e836ea6b962cf567cadd93", size = 583364, upload-time = "2025-10-30T11:17:20.286Z" },
+    { url = "https://files.pythonhosted.org/packages/94/ae/95c52b5a75da429f11ca8902c2128f64daafdc77758d370e4cc310ecda55/nh3-0.3.2-cp314-cp314t-win_amd64.whl", hash = "sha256:dce4248edc427c9b79261f3e6e2b3ecbdd9b88c267012168b4a7b3fc6fd41d13", size = 589982, upload-time = "2025-10-30T11:17:21.384Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/bd/c7d862a4381b95f2469704de32c0ad419def0f4a84b7a138a79532238114/nh3-0.3.2-cp314-cp314t-win_arm64.whl", hash = "sha256:019ecbd007536b67fdf76fab411b648fb64e2257ca3262ec80c3425c24028c80", size = 577126, upload-time = "2025-10-30T11:17:22.755Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/3e/f5a5cc2885c24be13e9b937441bd16a012ac34a657fe05e58927e8af8b7a/nh3-0.3.2-cp38-abi3-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:7064ccf5ace75825bd7bf57859daaaf16ed28660c1c6b306b649a9eda4b54b1e", size = 1431980, upload-time = "2025-10-30T11:17:25.457Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/f7/529a99324d7ef055de88b690858f4189379708abae92ace799365a797b7f/nh3-0.3.2-cp38-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c8745454cdd28bbbc90861b80a0111a195b0e3961b9fa2e672be89eb199fa5d8", size = 820805, upload-time = "2025-10-30T11:17:26.98Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/62/19b7c50ccd1fa7d0764822d2cea8f2a320f2fd77474c7a1805cb22cf69b0/nh3-0.3.2-cp38-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:72d67c25a84579f4a432c065e8b4274e53b7cf1df8f792cf846abfe2c3090866", size = 803527, upload-time = "2025-10-30T11:17:28.284Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/ca/f022273bab5440abff6302731a49410c5ef66b1a9502ba3fbb2df998d9ff/nh3-0.3.2-cp38-abi3-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:13398e676a14d6233f372c75f52d5ae74f98210172991f7a3142a736bd92b131", size = 1051674, upload-time = "2025-10-30T11:17:29.909Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/f7/5728e3b32a11daf5bd21cf71d91c463f74305938bc3eb9e0ac1ce141646e/nh3-0.3.2-cp38-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:03d617e5c8aa7331bd2659c654e021caf9bba704b109e7b2b28b039a00949fe5", size = 1004737, upload-time = "2025-10-30T11:17:31.205Z" },
+    { url = "https://files.pythonhosted.org/packages/53/7f/f17e0dba0a99cee29e6cee6d4d52340ef9cb1f8a06946d3a01eb7ec2fb01/nh3-0.3.2-cp38-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f2f55c4d2d5a207e74eefe4d828067bbb01300e06e2a7436142f915c5928de07", size = 911745, upload-time = "2025-10-30T11:17:32.945Z" },
+    { url = "https://files.pythonhosted.org/packages/42/0f/c76bf3dba22c73c38e9b1113b017cf163f7696f50e003404ec5ecdb1e8a6/nh3-0.3.2-cp38-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7bb18403f02b655a1bbe4e3a4696c2ae1d6ae8f5991f7cacb684b1ae27e6c9f7", size = 797184, upload-time = "2025-10-30T11:17:34.226Z" },
+    { url = "https://files.pythonhosted.org/packages/08/a1/73d8250f888fb0ddf1b119b139c382f8903d8bb0c5bd1f64afc7e38dad1d/nh3-0.3.2-cp38-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:6d66f41672eb4060cf87c037f760bdbc6847852ca9ef8e9c5a5da18f090abf87", size = 838556, upload-time = "2025-10-30T11:17:35.875Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/09/deb57f1fb656a7a5192497f4a287b0ade5a2ff6b5d5de4736d13ef6d2c1f/nh3-0.3.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f97f8b25cb2681d25e2338148159447e4d689aafdccfcf19e61ff7db3905768a", size = 1006695, upload-time = "2025-10-30T11:17:37.071Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/61/8f4d41c4ccdac30e4b1a4fa7be4b0f9914d8314a5058472f84c8e101a418/nh3-0.3.2-cp38-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:2ab70e8c6c7d2ce953d2a58102eefa90c2d0a5ed7aa40c7e29a487bc5e613131", size = 1075471, upload-time = "2025-10-30T11:17:38.225Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/c6/966aec0cb4705e69f6c3580422c239205d5d4d0e50fac380b21e87b6cf1b/nh3-0.3.2-cp38-abi3-musllinux_1_2_i686.whl", hash = "sha256:1710f3901cd6440ca92494ba2eb6dc260f829fa8d9196b659fa10de825610ce0", size = 1002439, upload-time = "2025-10-30T11:17:39.553Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/c8/97a2d5f7a314cce2c5c49f30c6f161b7f3617960ade4bfc2fd1ee092cb20/nh3-0.3.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:91e9b001101fb4500a2aafe3e7c92928d85242d38bf5ac0aba0b7480da0a4cd6", size = 987439, upload-time = "2025-10-30T11:17:40.81Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/95/2d6fc6461687d7a171f087995247dec33e8749a562bfadd85fb5dbf37a11/nh3-0.3.2-cp38-abi3-win32.whl", hash = "sha256:169db03df90da63286e0560ea0efa9b6f3b59844a9735514a1d47e6bb2c8c61b", size = 589826, upload-time = "2025-10-30T11:17:42.239Z" },
+    { url = "https://files.pythonhosted.org/packages/64/9a/1a1c154f10a575d20dd634e5697805e589bbdb7673a0ad00e8da90044ba7/nh3-0.3.2-cp38-abi3-win_amd64.whl", hash = "sha256:562da3dca7a17f9077593214a9781a94b8d76de4f158f8c895e62f09573945fe", size = 596406, upload-time = "2025-10-30T11:17:43.773Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/7e/a96255f63b7aef032cbee8fc4d6e37def72e3aaedc1f72759235e8f13cb1/nh3-0.3.2-cp38-abi3-win_arm64.whl", hash = "sha256:cf5964d54edd405e68583114a7cba929468bcd7db5e676ae38ee954de1cfc104", size = 584162, upload-time = "2025-10-30T11:17:44.96Z" },
 ]
 
 [[package]]
@@ -719,11 +887,11 @@ wheels = [
 
 [[package]]
 name = "platformdirs"
-version = "4.3.8"
+version = "4.5.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fe/8b/3c73abc9c759ecd3f1f7ceff6685840859e8070c4d947c93fae71f6a0bf2/platformdirs-4.3.8.tar.gz", hash = "sha256:3d512d96e16bcb959a814c9f348431070822a6496326a4be0911c40b5a74c2bc", size = 21362, upload-time = "2025-05-07T22:47:42.121Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cf/86/0248f086a84f01b37aaec0fa567b397df1a119f73c16f6c7a9aac73ea309/platformdirs-4.5.1.tar.gz", hash = "sha256:61d5cdcc6065745cdd94f0f878977f8de9437be93de97c1c12f853c9c0cdcbda", size = 21715, upload-time = "2025-12-05T13:52:58.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fe/39/979e8e21520d4e47a0bbe349e2713c0aac6f3d853d0e5b34d76206c439aa/platformdirs-4.3.8-py3-none-any.whl", hash = "sha256:ff7059bb7eb1179e2685604f4aaf157cfd9535242bd23742eadc3c13542139b4", size = 18567, upload-time = "2025-05-07T22:47:40.376Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/28/3bfe2fa5a7b9c46fe7e13c97bda14c895fb10fa2ebf1d0abb90e0cea7ee1/platformdirs-4.5.1-py3-none-any.whl", hash = "sha256:d03afa3963c806a9bed9d5125c8f4cb2fdaf74a55ab60e5d59b3fde758104d31", size = 18731, upload-time = "2025-12-05T13:52:56.823Z" },
 ]
 
 [[package]]
@@ -737,7 +905,7 @@ wheels = [
 
 [[package]]
 name = "pre-commit"
-version = "4.3.0"
+version = "4.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cfgv" },
@@ -746,21 +914,21 @@ dependencies = [
     { name = "pyyaml" },
     { name = "virtualenv" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ff/29/7cf5bbc236333876e4b41f56e06857a87937ce4bf91e117a6991a2dbb02a/pre_commit-4.3.0.tar.gz", hash = "sha256:499fe450cc9d42e9d58e606262795ecb64dd05438943c62b66f6a8673da30b16", size = 193792, upload-time = "2025-08-09T18:56:14.651Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f4/9b/6a4ffb4ed980519da959e1cf3122fc6cb41211daa58dbae1c73c0e519a37/pre_commit-4.5.0.tar.gz", hash = "sha256:dc5a065e932b19fc1d4c653c6939068fe54325af8e741e74e88db4d28a4dd66b", size = 198428, upload-time = "2025-11-22T21:02:42.304Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5b/a5/987a405322d78a73b66e39e4a90e4ef156fd7141bf71df987e50717c321b/pre_commit-4.3.0-py2.py3-none-any.whl", hash = "sha256:2b0747ad7e6e967169136edffee14c16e148a778a54e4f967921aa1ebf2308d8", size = 220965, upload-time = "2025-08-09T18:56:13.192Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/c4/b2d28e9d2edf4f1713eb3c29307f1a63f3d67cf09bdda29715a36a68921a/pre_commit-4.5.0-py2.py3-none-any.whl", hash = "sha256:25e2ce09595174d9c97860a95609f9f852c0614ba602de3561e267547f2335e1", size = 226429, upload-time = "2025-11-22T21:02:40.836Z" },
 ]
 
 [[package]]
 name = "prettytable"
-version = "3.16.0"
+version = "3.17.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "wcwidth" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/99/b1/85e18ac92afd08c533603e3393977b6bc1443043115a47bb094f3b98f94f/prettytable-3.16.0.tar.gz", hash = "sha256:3c64b31719d961bf69c9a7e03d0c1e477320906a98da63952bc6698d6164ff57", size = 66276, upload-time = "2025-03-24T19:39:04.008Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/79/45/b0847d88d6cfeb4413566738c8bbf1e1995fad3d42515327ff32cc1eb578/prettytable-3.17.0.tar.gz", hash = "sha256:59f2590776527f3c9e8cf9fe7b66dd215837cca96a9c39567414cbc632e8ddb0", size = 67892, upload-time = "2025-11-14T17:33:20.212Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/02/c7/5613524e606ea1688b3bdbf48aa64bafb6d0a4ac3750274c43b6158a390f/prettytable-3.16.0-py3-none-any.whl", hash = "sha256:b5eccfabb82222f5aa46b798ff02a8452cf530a352c31bddfa29be41242863aa", size = 33863, upload-time = "2025-03-24T19:39:02.359Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/8c/83087ebc47ab0396ce092363001fa37c17153119ee282700c0713a195853/prettytable-3.17.0-py3-none-any.whl", hash = "sha256:aad69b294ddbe3e1f95ef8886a060ed1666a0b83018bbf56295f6f226c43d287", size = 34433, upload-time = "2025-11-14T17:33:19.093Z" },
 ]
 
 [[package]]
@@ -774,11 +942,11 @@ wheels = [
 
 [[package]]
 name = "pycparser"
-version = "2.22"
+version = "2.23"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1d/b2/31537cf4b1ca988837256c910a668b553fceb8f069bedc4b1c826024b52c/pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6", size = 172736, upload-time = "2024-03-30T13:22:22.564Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fe/cf/d2d3b9f5699fb1e4615c8e32ff220203e43b248e1dfcc6736ad9057731ca/pycparser-2.23.tar.gz", hash = "sha256:78816d4f24add8f10a06d6f05b4d424ad9e96cfebf68a4ddc99c65c0720d00c2", size = 173734, upload-time = "2025-09-09T13:23:47.91Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/13/a3/a812df4e2dd5696d1f351d58b8fe16a405b234ad2886a0dab9183fb78109/pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc", size = 117552, upload-time = "2024-03-30T13:22:20.476Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e3/59cd50310fc9b59512193629e1984c1f95e5c8ae6e5d8c69532ccc65a7fe/pycparser-2.23-py3-none-any.whl", hash = "sha256:e5c6e8d3fbad53479cab09ac03729e0a9faf2bee3db8208a550daf5af81a5934", size = 118140, upload-time = "2025-09-09T13:23:46.651Z" },
 ]
 
 [[package]]
@@ -790,9 +958,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
 ]
 
+[[package]]
+name = "pyproject-hooks"
+version = "1.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e7/82/28175b2414effca1cdac8dc99f76d660e7a4fb0ceefa4b4ab8f5f6742925/pyproject_hooks-1.2.0.tar.gz", hash = "sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8", size = 19228, upload-time = "2024-09-29T09:24:13.293Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bd/24/12818598c362d7f300f18e74db45963dbcb85150324092410c8b49405e42/pyproject_hooks-1.2.0-py3-none-any.whl", hash = "sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913", size = 10216, upload-time = "2024-09-29T09:24:11.978Z" },
+]
+
 [[package]]
 name = "pytest"
-version = "8.4.1"
+version = "9.0.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -803,48 +980,49 @@ dependencies = [
     { name = "pygments" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/08/ba/45911d754e8eba3d5a841a5ce61a65a685ff1798421ac054f85aa8747dfb/pytest-8.4.1.tar.gz", hash = "sha256:7c67fd69174877359ed9371ec3af8a3d2b04741818c51e5e99cc1742251fa93c", size = 1517714, upload-time = "2025-06-18T05:48:06.109Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/29/16/c8a903f4c4dffe7a12843191437d7cd8e32751d5de349d45d3fe69544e87/pytest-8.4.1-py3-none-any.whl", hash = "sha256:539c70ba6fcead8e78eebbf1115e8b589e7565830d7d006a8723f19ac8a0afb7", size = 365474, upload-time = "2025-06-18T05:48:03.955Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
 ]
 
 [[package]]
 name = "pytest-asyncio"
-version = "1.1.0"
+version = "1.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "backports-asyncio-runner", marker = "python_full_version < '3.11'" },
     { name = "pytest" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4e/51/f8794af39eeb870e87a8c8068642fc07bce0c854d6865d7dd0f2a9d338c2/pytest_asyncio-1.1.0.tar.gz", hash = "sha256:796aa822981e01b68c12e4827b8697108f7205020f24b5793b3c41555dab68ea", size = 46652, upload-time = "2025-07-16T04:29:26.393Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/90/2c/8af215c0f776415f3590cac4f9086ccefd6fd463befeae41cd4d3f193e5a/pytest_asyncio-1.3.0.tar.gz", hash = "sha256:d7f52f36d231b80ee124cd216ffb19369aa168fc10095013c6b014a34d3ee9e5", size = 50087, upload-time = "2025-11-10T16:07:47.256Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/9d/bf86eddabf8c6c9cb1ea9a869d6873b46f105a5d292d3a6f7071f5b07935/pytest_asyncio-1.1.0-py3-none-any.whl", hash = "sha256:5fe2d69607b0bd75c656d1211f969cadba035030156745ee09e7d71740e58ecf", size = 15157, upload-time = "2025-07-16T04:29:24.929Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/35/f8b19922b6a25bc0880171a2f1a003eaeb93657475193ab516fd87cac9da/pytest_asyncio-1.3.0-py3-none-any.whl", hash = "sha256:611e26147c7f77640e6d0a92a38ed17c3e9848063698d5c93d5aa7aa11cebff5", size = 15075, upload-time = "2025-11-10T16:07:45.537Z" },
 ]
 
 [[package]]
 name = "pytest-cov"
-version = "6.2.1"
+version = "7.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "coverage", extra = ["toml"] },
     { name = "pluggy" },
     { name = "pytest" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/18/99/668cade231f434aaa59bbfbf49469068d2ddd945000621d3d165d2e7dd7b/pytest_cov-6.2.1.tar.gz", hash = "sha256:25cc6cc0a5358204b8108ecedc51a9b57b34cc6b8c967cc2c01a4e00d8a67da2", size = 69432, upload-time = "2025-06-12T10:47:47.684Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5e/f7/c933acc76f5208b3b00089573cf6a2bc26dc80a8aece8f52bb7d6b1855ca/pytest_cov-7.0.0.tar.gz", hash = "sha256:33c97eda2e049a0c5298e91f519302a1334c26ac65c1a483d6206fd458361af1", size = 54328, upload-time = "2025-09-09T10:57:02.113Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bc/16/4ea354101abb1287856baa4af2732be351c7bee728065aed451b678153fd/pytest_cov-6.2.1-py3-none-any.whl", hash = "sha256:f5bc4c23f42f1cdd23c70b1dab1bbaef4fc505ba950d53e0081d0730dd7e86d5", size = 24644, upload-time = "2025-06-12T10:47:45.932Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/49/1377b49de7d0c1ce41292161ea0f721913fa8722c19fb9c1e3aa0367eecb/pytest_cov-7.0.0-py3-none-any.whl", hash = "sha256:3b8e9558b16cc1479da72058bdecf8073661c7f57f7d3c5f22a1c23507f2d861", size = 22424, upload-time = "2025-09-09T10:57:00.695Z" },
 ]
 
 [[package]]
 name = "pytest-mock"
-version = "3.14.1"
+version = "3.15.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pytest" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/71/28/67172c96ba684058a4d24ffe144d64783d2a270d0af0d9e792737bddc75c/pytest_mock-3.14.1.tar.gz", hash = "sha256:159e9edac4c451ce77a5cdb9fc5d1100708d2dd4ba3c3df572f14097351af80e", size = 33241, upload-time = "2025-05-26T13:58:45.167Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/68/14/eb014d26be205d38ad5ad20d9a80f7d201472e08167f0bb4361e251084a9/pytest_mock-3.15.1.tar.gz", hash = "sha256:1849a238f6f396da19762269de72cb1814ab44416fa73a8686deac10b0d87a0f", size = 34036, upload-time = "2025-09-16T16:37:27.081Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b2/05/77b60e520511c53d1c1ca75f1930c7dd8e971d0c4379b7f4b3f9644685ba/pytest_mock-3.14.1-py3-none-any.whl", hash = "sha256:178aefcd11307d874b4cd3100344e7e2d888d9791a6a1d9bfe90fbc1b74fd1d0", size = 9923, upload-time = "2025-05-26T13:58:43.487Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/cc/06253936f4a7fa2e0f48dfe6d851d9c56df896a9ab09ac019d70b760619c/pytest_mock-3.15.1-py3-none-any.whl", hash = "sha256:0a25e2eb88fe5168d535041d09a4529a188176ae608a6d249ee65abc0949630d", size = 10095, upload-time = "2025-09-16T16:37:25.734Z" },
 ]
 
 [[package]]
@@ -861,11 +1039,11 @@ sdist = { url = "https://files.pythonhosted.org/packages/36/47/ab65fc1d682befc31
 
 [[package]]
 name = "python-dotenv"
-version = "1.1.1"
+version = "1.2.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f6/b0/4bc07ccd3572a2f9df7e6782f52b0c6c90dcbb803ac4a167702d7d0dfe1e/python_dotenv-1.1.1.tar.gz", hash = "sha256:a8a6399716257f45be6a007360200409fce5cda2661e3dec71d23dc15f6189ab", size = 41978, upload-time = "2025-06-24T04:21:07.341Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f0/26/19cadc79a718c5edbec86fd4919a6b6d3f681039a2f6d66d14be94e75fb9/python_dotenv-1.2.1.tar.gz", hash = "sha256:42667e897e16ab0d66954af0e60a9caa94f0fd4ecf3aaf6d2d260eec1aa36ad6", size = 44221, upload-time = "2025-10-26T15:12:10.434Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5f/ed/539768cf28c661b5b068d66d96a2f155c4971a5d55684a514c1a0e0dec2f/python_dotenv-1.1.1-py3-none-any.whl", hash = "sha256:31f23644fe2602f88ff55e1f5c79ba497e01224ee7737937930c448e4d0e24dc", size = 20556, upload-time = "2025-06-24T04:21:06.073Z" },
+    { url = "https://files.pythonhosted.org/packages/14/1b/a298b06749107c305e1fe0f814c6c74aea7b2f1e10989cb30f544a1b3253/python_dotenv-1.2.1-py3-none-any.whl", hash = "sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61", size = 21230, upload-time = "2025-10-26T15:12:09.109Z" },
 ]
 
 [[package]]
@@ -879,46 +1057,66 @@ wheels = [
 
 [[package]]
 name = "pyyaml"
-version = "6.0.2"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/54/ed/79a089b6be93607fa5cdaedf301d7dfb23af5f25c398d5ead2525b063e17/pyyaml-6.0.2.tar.gz", hash = "sha256:d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e", size = 130631, upload-time = "2024-08-06T20:33:50.674Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/9b/95/a3fac87cb7158e231b5a6012e438c647e1a87f09f8e0d123acec8ab8bf71/PyYAML-6.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086", size = 184199, upload-time = "2024-08-06T20:31:40.178Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/7a/68bd47624dab8fd4afbfd3c48e3b79efe09098ae941de5b58abcbadff5cb/PyYAML-6.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:29717114e51c84ddfba879543fb232a6ed60086602313ca38cce623c1d62cfbf", size = 171758, upload-time = "2024-08-06T20:31:42.173Z" },
-    { url = "https://files.pythonhosted.org/packages/49/ee/14c54df452143b9ee9f0f29074d7ca5516a36edb0b4cc40c3f280131656f/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8824b5a04a04a047e72eea5cec3bc266db09e35de6bdfe34c9436ac5ee27d237", size = 718463, upload-time = "2024-08-06T20:31:44.263Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/61/de363a97476e766574650d742205be468921a7b532aa2499fcd886b62530/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:7c36280e6fb8385e520936c3cb3b8042851904eba0e58d277dca80a5cfed590b", size = 719280, upload-time = "2024-08-06T20:31:50.199Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/4e/1523cb902fd98355e2e9ea5e5eb237cbc5f3ad5f3075fa65087aa0ecb669/PyYAML-6.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ec031d5d2feb36d1d1a24380e4db6d43695f3748343d99434e6f5f9156aaa2ed", size = 751239, upload-time = "2024-08-06T20:31:52.292Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/33/5504b3a9a4464893c32f118a9cc045190a91637b119a9c881da1cf6b7a72/PyYAML-6.0.2-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:936d68689298c36b53b29f23c6dbb74de12b4ac12ca6cfe0e047bedceea56180", size = 695802, upload-time = "2024-08-06T20:31:53.836Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/20/8347dcabd41ef3a3cdc4f7b7a2aff3d06598c8779faa189cdbf878b626a4/PyYAML-6.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:23502f431948090f597378482b4812b0caae32c22213aecf3b55325e049a6c68", size = 720527, upload-time = "2024-08-06T20:31:55.565Z" },
-    { url = "https://files.pythonhosted.org/packages/be/aa/5afe99233fb360d0ff37377145a949ae258aaab831bde4792b32650a4378/PyYAML-6.0.2-cp310-cp310-win32.whl", hash = "sha256:2e99c6826ffa974fe6e27cdb5ed0021786b03fc98e5ee3c5bfe1fd5015f42b99", size = 144052, upload-time = "2024-08-06T20:31:56.914Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/84/0fa4b06f6d6c958d207620fc60005e241ecedceee58931bb20138e1e5776/PyYAML-6.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:a4d3091415f010369ae4ed1fc6b79def9416358877534caf6a0fdd2146c87a3e", size = 161774, upload-time = "2024-08-06T20:31:58.304Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/aa/7af4e81f7acba21a4c6be026da38fd2b872ca46226673c89a758ebdc4fd2/PyYAML-6.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:cc1c1159b3d456576af7a3e4d1ba7e6924cb39de8f67111c735f6fc832082774", size = 184612, upload-time = "2024-08-06T20:32:03.408Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/62/b9faa998fd185f65c1371643678e4d58254add437edb764a08c5a98fb986/PyYAML-6.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1e2120ef853f59c7419231f3bf4e7021f1b936f6ebd222406c3b60212205d2ee", size = 172040, upload-time = "2024-08-06T20:32:04.926Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/0c/c804f5f922a9a6563bab712d8dcc70251e8af811fce4524d57c2c0fd49a4/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5d225db5a45f21e78dd9358e58a98702a0302f2659a3c6cd320564b75b86f47c", size = 736829, upload-time = "2024-08-06T20:32:06.459Z" },
-    { url = "https://files.pythonhosted.org/packages/51/16/6af8d6a6b210c8e54f1406a6b9481febf9c64a3109c541567e35a49aa2e7/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5ac9328ec4831237bec75defaf839f7d4564be1e6b25ac710bd1a96321cc8317", size = 764167, upload-time = "2024-08-06T20:32:08.338Z" },
-    { url = "https://files.pythonhosted.org/packages/75/e4/2c27590dfc9992f73aabbeb9241ae20220bd9452df27483b6e56d3975cc5/PyYAML-6.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ad2a3decf9aaba3d29c8f537ac4b243e36bef957511b4766cb0057d32b0be85", size = 762952, upload-time = "2024-08-06T20:32:14.124Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/97/ecc1abf4a823f5ac61941a9c00fe501b02ac3ab0e373c3857f7d4b83e2b6/PyYAML-6.0.2-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:ff3824dc5261f50c9b0dfb3be22b4567a6f938ccce4587b38952d85fd9e9afe4", size = 735301, upload-time = "2024-08-06T20:32:16.17Z" },
-    { url = "https://files.pythonhosted.org/packages/45/73/0f49dacd6e82c9430e46f4a027baa4ca205e8b0a9dce1397f44edc23559d/PyYAML-6.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:797b4f722ffa07cc8d62053e4cff1486fa6dc094105d13fea7b1de7d8bf71c9e", size = 756638, upload-time = "2024-08-06T20:32:18.555Z" },
-    { url = "https://files.pythonhosted.org/packages/22/5f/956f0f9fc65223a58fbc14459bf34b4cc48dec52e00535c79b8db361aabd/PyYAML-6.0.2-cp311-cp311-win32.whl", hash = "sha256:11d8f3dd2b9c1207dcaf2ee0bbbfd5991f571186ec9cc78427ba5bd32afae4b5", size = 143850, upload-time = "2024-08-06T20:32:19.889Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/23/8da0bbe2ab9dcdd11f4f4557ccaf95c10b9811b13ecced089d43ce59c3c8/PyYAML-6.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:e10ce637b18caea04431ce14fabcf5c64a1c61ec9c56b071a4b7ca131ca52d44", size = 161980, upload-time = "2024-08-06T20:32:21.273Z" },
-    { url = "https://files.pythonhosted.org/packages/86/0c/c581167fc46d6d6d7ddcfb8c843a4de25bdd27e4466938109ca68492292c/PyYAML-6.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:c70c95198c015b85feafc136515252a261a84561b7b1d51e3384e0655ddf25ab", size = 183873, upload-time = "2024-08-06T20:32:25.131Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/0c/38374f5bb272c051e2a69281d71cba6fdb983413e6758b84482905e29a5d/PyYAML-6.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ce826d6ef20b1bc864f0a68340c8b3287705cae2f8b4b1d932177dcc76721725", size = 173302, upload-time = "2024-08-06T20:32:26.511Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/93/9916574aa8c00aa06bbac729972eb1071d002b8e158bd0e83a3b9a20a1f7/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1f71ea527786de97d1a0cc0eacd1defc0985dcf6b3f17bb77dcfc8c34bec4dc5", size = 739154, upload-time = "2024-08-06T20:32:28.363Z" },
-    { url = "https://files.pythonhosted.org/packages/95/0f/b8938f1cbd09739c6da569d172531567dbcc9789e0029aa070856f123984/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9b22676e8097e9e22e36d6b7bda33190d0d400f345f23d4065d48f4ca7ae0425", size = 766223, upload-time = "2024-08-06T20:32:30.058Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/2b/614b4752f2e127db5cc206abc23a8c19678e92b23c3db30fc86ab731d3bd/PyYAML-6.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476", size = 767542, upload-time = "2024-08-06T20:32:31.881Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/00/dd137d5bcc7efea1836d6264f049359861cf548469d18da90cd8216cf05f/PyYAML-6.0.2-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48", size = 731164, upload-time = "2024-08-06T20:32:37.083Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/1f/4f998c900485e5c0ef43838363ba4a9723ac0ad73a9dc42068b12aaba4e4/PyYAML-6.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8b9c7197f7cb2738065c481a0461e50ad02f18c78cd75775628afb4d7137fb3b", size = 756611, upload-time = "2024-08-06T20:32:38.898Z" },
-    { url = "https://files.pythonhosted.org/packages/df/d1/f5a275fdb252768b7a11ec63585bc38d0e87c9e05668a139fea92b80634c/PyYAML-6.0.2-cp312-cp312-win32.whl", hash = "sha256:ef6107725bd54b262d6dedcc2af448a266975032bc85ef0172c5f059da6325b4", size = 140591, upload-time = "2024-08-06T20:32:40.241Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/e8/4f648c598b17c3d06e8753d7d13d57542b30d56e6c2dedf9c331ae56312e/PyYAML-6.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:7e7401d0de89a9a855c839bc697c079a4af81cf878373abd7dc625847d25cbd8", size = 156338, upload-time = "2024-08-06T20:32:41.93Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/e3/3af305b830494fa85d95f6d95ef7fa73f2ee1cc8ef5b495c7c3269fb835f/PyYAML-6.0.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba", size = 181309, upload-time = "2024-08-06T20:32:43.4Z" },
-    { url = "https://files.pythonhosted.org/packages/45/9f/3b1c20a0b7a3200524eb0076cc027a970d320bd3a6592873c85c92a08731/PyYAML-6.0.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:50187695423ffe49e2deacb8cd10510bc361faac997de9efef88badc3bb9e2d1", size = 171679, upload-time = "2024-08-06T20:32:44.801Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/9a/337322f27005c33bcb656c655fa78325b730324c78620e8328ae28b64d0c/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0ffe8360bab4910ef1b9e87fb812d8bc0a308b0d0eef8c8f44e0254ab3b07133", size = 733428, upload-time = "2024-08-06T20:32:46.432Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/69/864fbe19e6c18ea3cc196cbe5d392175b4cf3d5d0ac1403ec3f2d237ebb5/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:17e311b6c678207928d649faa7cb0d7b4c26a0ba73d41e99c4fff6b6c3276484", size = 763361, upload-time = "2024-08-06T20:32:51.188Z" },
-    { url = "https://files.pythonhosted.org/packages/04/24/b7721e4845c2f162d26f50521b825fb061bc0a5afcf9a386840f23ea19fa/PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:70b189594dbe54f75ab3a1acec5f1e3faa7e8cf2f1e08d9b561cb41b845f69d5", size = 759523, upload-time = "2024-08-06T20:32:53.019Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/b2/e3234f59ba06559c6ff63c4e10baea10e5e7df868092bf9ab40e5b9c56b6/PyYAML-6.0.2-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:41e4e3953a79407c794916fa277a82531dd93aad34e29c2a514c2c0c5fe971cc", size = 726660, upload-time = "2024-08-06T20:32:54.708Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/0f/25911a9f080464c59fab9027482f822b86bf0608957a5fcc6eaac85aa515/PyYAML-6.0.2-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:68ccc6023a3400877818152ad9a1033e3db8625d899c72eacb5a668902e4d652", size = 751597, upload-time = "2024-08-06T20:32:56.985Z" },
-    { url = "https://files.pythonhosted.org/packages/14/0d/e2c3b43bbce3cf6bd97c840b46088a3031085179e596d4929729d8d68270/PyYAML-6.0.2-cp313-cp313-win32.whl", hash = "sha256:bc2fa7c6b47d6bc618dd7fb02ef6fdedb1090ec036abab80d4681424b84c1183", size = 140527, upload-time = "2024-08-06T20:33:03.001Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/de/02b54f42487e3d3c6efb3f89428677074ca7bf43aae402517bc7cca949f3/PyYAML-6.0.2-cp313-cp313-win_amd64.whl", hash = "sha256:8388ee1976c416731879ac16da0aff3f63b286ffdd57cdeb95f3f2e085687563", size = 156446, upload-time = "2024-08-06T20:33:04.33Z" },
+version = "6.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/a0/39350dd17dd6d6c6507025c0e53aef67a9293a6d37d3511f23ea510d5800/pyyaml-6.0.3-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b", size = 184227, upload-time = "2025-09-25T21:31:46.04Z" },
+    { url = "https://files.pythonhosted.org/packages/05/14/52d505b5c59ce73244f59c7a50ecf47093ce4765f116cdb98286a71eeca2/pyyaml-6.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956", size = 174019, upload-time = "2025-09-25T21:31:47.706Z" },
+    { url = "https://files.pythonhosted.org/packages/43/f7/0e6a5ae5599c838c696adb4e6330a59f463265bfa1e116cfd1fbb0abaaae/pyyaml-6.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8", size = 740646, upload-time = "2025-09-25T21:31:49.21Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/3a/61b9db1d28f00f8fd0ae760459a5c4bf1b941baf714e207b6eb0657d2578/pyyaml-6.0.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198", size = 840793, upload-time = "2025-09-25T21:31:50.735Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/1e/7acc4f0e74c4b3d9531e24739e0ab832a5edf40e64fbae1a9c01941cabd7/pyyaml-6.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b", size = 770293, upload-time = "2025-09-25T21:31:51.828Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/ef/abd085f06853af0cd59fa5f913d61a8eab65d7639ff2a658d18a25d6a89d/pyyaml-6.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0", size = 732872, upload-time = "2025-09-25T21:31:53.282Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/15/2bc9c8faf6450a8b3c9fc5448ed869c599c0a74ba2669772b1f3a0040180/pyyaml-6.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69", size = 758828, upload-time = "2025-09-25T21:31:54.807Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/00/531e92e88c00f4333ce359e50c19b8d1de9fe8d581b1534e35ccfbc5f393/pyyaml-6.0.3-cp310-cp310-win32.whl", hash = "sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e", size = 142415, upload-time = "2025-09-25T21:31:55.885Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/fa/926c003379b19fca39dd4634818b00dec6c62d87faf628d1394e137354d4/pyyaml-6.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c", size = 158561, upload-time = "2025-09-25T21:31:57.406Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/16/a95b6757765b7b031c9374925bb718d55e0a9ba8a1b6a12d25962ea44347/pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e", size = 185826, upload-time = "2025-09-25T21:31:58.655Z" },
+    { url = "https://files.pythonhosted.org/packages/16/19/13de8e4377ed53079ee996e1ab0a9c33ec2faf808a4647b7b4c0d46dd239/pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824", size = 175577, upload-time = "2025-09-25T21:32:00.088Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/62/d2eb46264d4b157dae1275b573017abec435397aa59cbcdab6fc978a8af4/pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c", size = 775556, upload-time = "2025-09-25T21:32:01.31Z" },
+    { url = "https://files.pythonhosted.org/packages/10/cb/16c3f2cf3266edd25aaa00d6c4350381c8b012ed6f5276675b9eba8d9ff4/pyyaml-6.0.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00", size = 882114, upload-time = "2025-09-25T21:32:03.376Z" },
+    { url = "https://files.pythonhosted.org/packages/71/60/917329f640924b18ff085ab889a11c763e0b573da888e8404ff486657602/pyyaml-6.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d", size = 806638, upload-time = "2025-09-25T21:32:04.553Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/6f/529b0f316a9fd167281a6c3826b5583e6192dba792dd55e3203d3f8e655a/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a", size = 767463, upload-time = "2025-09-25T21:32:06.152Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/6a/b627b4e0c1dd03718543519ffb2f1deea4a1e6d42fbab8021936a4d22589/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4", size = 794986, upload-time = "2025-09-25T21:32:07.367Z" },
+    { url = "https://files.pythonhosted.org/packages/45/91/47a6e1c42d9ee337c4839208f30d9f09caa9f720ec7582917b264defc875/pyyaml-6.0.3-cp311-cp311-win32.whl", hash = "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b", size = 142543, upload-time = "2025-09-25T21:32:08.95Z" },
+    { url = "https://files.pythonhosted.org/packages/da/e3/ea007450a105ae919a72393cb06f122f288ef60bba2dc64b26e2646fa315/pyyaml-6.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf", size = 158763, upload-time = "2025-09-25T21:32:09.96Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/33/422b98d2195232ca1826284a76852ad5a86fe23e31b009c9886b2d0fb8b2/pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196", size = 182063, upload-time = "2025-09-25T21:32:11.445Z" },
+    { url = "https://files.pythonhosted.org/packages/89/a0/6cf41a19a1f2f3feab0e9c0b74134aa2ce6849093d5517a0c550fe37a648/pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0", size = 173973, upload-time = "2025-09-25T21:32:12.492Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/23/7a778b6bd0b9a8039df8b1b1d80e2e2ad78aa04171592c8a5c43a56a6af4/pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28", size = 775116, upload-time = "2025-09-25T21:32:13.652Z" },
+    { url = "https://files.pythonhosted.org/packages/65/30/d7353c338e12baef4ecc1b09e877c1970bd3382789c159b4f89d6a70dc09/pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c", size = 844011, upload-time = "2025-09-25T21:32:15.21Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/9d/b3589d3877982d4f2329302ef98a8026e7f4443c765c46cfecc8858c6b4b/pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc", size = 807870, upload-time = "2025-09-25T21:32:16.431Z" },
+    { url = "https://files.pythonhosted.org/packages/05/c0/b3be26a015601b822b97d9149ff8cb5ead58c66f981e04fedf4e762f4bd4/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e", size = 761089, upload-time = "2025-09-25T21:32:17.56Z" },
+    { url = "https://files.pythonhosted.org/packages/be/8e/98435a21d1d4b46590d5459a22d88128103f8da4c2d4cb8f14f2a96504e1/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea", size = 790181, upload-time = "2025-09-25T21:32:18.834Z" },
+    { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" },
+    { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/8c/f4bd7f6465179953d3ac9bc44ac1a8a3e6122cf8ada906b4f96c60172d43/pyyaml-6.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac", size = 181814, upload-time = "2025-09-25T21:32:35.712Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/9c/4d95bb87eb2063d20db7b60faa3840c1b18025517ae857371c4dd55a6b3a/pyyaml-6.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310", size = 173809, upload-time = "2025-09-25T21:32:36.789Z" },
+    { url = "https://files.pythonhosted.org/packages/92/b5/47e807c2623074914e29dabd16cbbdd4bf5e9b2db9f8090fa64411fc5382/pyyaml-6.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7", size = 766454, upload-time = "2025-09-25T21:32:37.966Z" },
+    { url = "https://files.pythonhosted.org/packages/02/9e/e5e9b168be58564121efb3de6859c452fccde0ab093d8438905899a3a483/pyyaml-6.0.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788", size = 836355, upload-time = "2025-09-25T21:32:39.178Z" },
+    { url = "https://files.pythonhosted.org/packages/88/f9/16491d7ed2a919954993e48aa941b200f38040928474c9e85ea9e64222c3/pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5", size = 794175, upload-time = "2025-09-25T21:32:40.865Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/3f/5989debef34dc6397317802b527dbbafb2b4760878a53d4166579111411e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764", size = 755228, upload-time = "2025-09-25T21:32:42.084Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ce/af88a49043cd2e265be63d083fc75b27b6ed062f5f9fd6cdc223ad62f03e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35", size = 789194, upload-time = "2025-09-25T21:32:43.362Z" },
+    { url = "https://files.pythonhosted.org/packages/23/20/bb6982b26a40bb43951265ba29d4c246ef0ff59c9fdcdf0ed04e0687de4d/pyyaml-6.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac", size = 156429, upload-time = "2025-09-25T21:32:57.844Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/f4/a4541072bb9422c8a883ab55255f918fa378ecf083f5b85e87fc2b4eda1b/pyyaml-6.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3", size = 143912, upload-time = "2025-09-25T21:32:59.247Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/f9/07dd09ae774e4616edf6cda684ee78f97777bdd15847253637a6f052a62f/pyyaml-6.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3", size = 189108, upload-time = "2025-09-25T21:32:44.377Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/78/8d08c9fb7ce09ad8c38ad533c1191cf27f7ae1effe5bb9400a46d9437fcf/pyyaml-6.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba", size = 183641, upload-time = "2025-09-25T21:32:45.407Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/5b/3babb19104a46945cf816d047db2788bcaf8c94527a805610b0289a01c6b/pyyaml-6.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c", size = 831901, upload-time = "2025-09-25T21:32:48.83Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/cc/dff0684d8dc44da4d22a13f35f073d558c268780ce3c6ba1b87055bb0b87/pyyaml-6.0.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702", size = 861132, upload-time = "2025-09-25T21:32:50.149Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5e/f77dc6b9036943e285ba76b49e118d9ea929885becb0a29ba8a7c75e29fe/pyyaml-6.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c", size = 839261, upload-time = "2025-09-25T21:32:51.808Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/88/a9db1376aa2a228197c58b37302f284b5617f56a5d959fd1763fb1675ce6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065", size = 805272, upload-time = "2025-09-25T21:32:52.941Z" },
+    { url = "https://files.pythonhosted.org/packages/da/92/1446574745d74df0c92e6aa4a7b0b3130706a4142b2d1a5869f2eaa423c6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65", size = 829923, upload-time = "2025-09-25T21:32:54.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/7a/1c7270340330e575b92f397352af856a8c06f230aa3e76f86b39d01b416a/pyyaml-6.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9", size = 174062, upload-time = "2025-09-25T21:32:55.767Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
 ]
 
 [[package]]
@@ -973,54 +1171,54 @@ wheels = [
 
 [[package]]
 name = "rich"
-version = "14.1.0"
+version = "14.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "markdown-it-py" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fe/75/af448d8e52bf1d8fa6a9d089ca6c07ff4453d86c65c145d0a300bb073b9b/rich-14.1.0.tar.gz", hash = "sha256:e497a48b844b0320d45007cdebfeaeed8db2a4f4bcf49f15e455cfc4af11eaa8", size = 224441, upload-time = "2025-07-25T07:32:58.125Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fb/d2/8920e102050a0de7bfabeb4c4614a49248cf8d5d7a8d01885fbb24dc767a/rich-14.2.0.tar.gz", hash = "sha256:73ff50c7c0c1c77c8243079283f4edb376f0f6442433aecb8ce7e6d0b92d1fe4", size = 219990, upload-time = "2025-10-09T14:16:53.064Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/30/3c4d035596d3cf444529e0b2953ad0466f6049528a879d27534700580395/rich-14.1.0-py3-none-any.whl", hash = "sha256:536f5f1785986d6dbdea3c75205c473f970777b4a0d6c6dd1b696aa05a3fa04f", size = 243368, upload-time = "2025-07-25T07:32:56.73Z" },
+    { url = "https://files.pythonhosted.org/packages/25/7a/b0178788f8dc6cafce37a212c99565fa1fe7872c70c6c9c1e1a372d9d88f/rich-14.2.0-py3-none-any.whl", hash = "sha256:76bc51fe2e57d2b1be1f96c524b890b816e334ab4c1e45888799bfaab0021edd", size = 243393, upload-time = "2025-10-09T14:16:51.245Z" },
 ]
 
 [[package]]
 name = "ruff"
-version = "0.12.10"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/eb/8c073deb376e46ae767f4961390d17545e8535921d2f65101720ed8bd434/ruff-0.12.10.tar.gz", hash = "sha256:189ab65149d11ea69a2d775343adf5f49bb2426fc4780f65ee33b423ad2e47f9", size = 5310076, upload-time = "2025-08-21T18:23:22.595Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/24/e7/560d049d15585d6c201f9eeacd2fd130def3741323e5ccf123786e0e3c95/ruff-0.12.10-py3-none-linux_armv6l.whl", hash = "sha256:8b593cb0fb55cc8692dac7b06deb29afda78c721c7ccfed22db941201b7b8f7b", size = 11935161, upload-time = "2025-08-21T18:22:26.965Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/b0/ad2464922a1113c365d12b8f80ed70fcfb39764288ac77c995156080488d/ruff-0.12.10-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:ebb7333a45d56efc7c110a46a69a1b32365d5c5161e7244aaf3aa20ce62399c1", size = 12660884, upload-time = "2025-08-21T18:22:30.925Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/f1/97f509b4108d7bae16c48389f54f005b62ce86712120fd8b2d8e88a7cb49/ruff-0.12.10-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d59e58586829f8e4a9920788f6efba97a13d1fa320b047814e8afede381c6839", size = 11872754, upload-time = "2025-08-21T18:22:34.035Z" },
-    { url = "https://files.pythonhosted.org/packages/12/ad/44f606d243f744a75adc432275217296095101f83f966842063d78eee2d3/ruff-0.12.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:822d9677b560f1fdeab69b89d1f444bf5459da4aa04e06e766cf0121771ab844", size = 12092276, upload-time = "2025-08-21T18:22:36.764Z" },
-    { url = "https://files.pythonhosted.org/packages/06/1f/ed6c265e199568010197909b25c896d66e4ef2c5e1c3808caf461f6f3579/ruff-0.12.10-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:37b4a64f4062a50c75019c61c7017ff598cb444984b638511f48539d3a1c98db", size = 11734700, upload-time = "2025-08-21T18:22:39.822Z" },
-    { url = "https://files.pythonhosted.org/packages/63/c5/b21cde720f54a1d1db71538c0bc9b73dee4b563a7dd7d2e404914904d7f5/ruff-0.12.10-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:2c6f4064c69d2542029b2a61d39920c85240c39837599d7f2e32e80d36401d6e", size = 13468783, upload-time = "2025-08-21T18:22:42.559Z" },
-    { url = "https://files.pythonhosted.org/packages/02/9e/39369e6ac7f2a1848f22fb0b00b690492f20811a1ac5c1fd1d2798329263/ruff-0.12.10-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:059e863ea3a9ade41407ad71c1de2badfbe01539117f38f763ba42a1206f7559", size = 14436642, upload-time = "2025-08-21T18:22:45.612Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/03/5da8cad4b0d5242a936eb203b58318016db44f5c5d351b07e3f5e211bb89/ruff-0.12.10-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1bef6161e297c68908b7218fa6e0e93e99a286e5ed9653d4be71e687dff101cf", size = 13859107, upload-time = "2025-08-21T18:22:48.886Z" },
-    { url = "https://files.pythonhosted.org/packages/19/19/dd7273b69bf7f93a070c9cec9494a94048325ad18fdcf50114f07e6bf417/ruff-0.12.10-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4f1345fbf8fb0531cd722285b5f15af49b2932742fc96b633e883da8d841896b", size = 12886521, upload-time = "2025-08-21T18:22:51.567Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/1d/b4207ec35e7babaee62c462769e77457e26eb853fbdc877af29417033333/ruff-0.12.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1f68433c4fbc63efbfa3ba5db31727db229fa4e61000f452c540474b03de52a9", size = 13097528, upload-time = "2025-08-21T18:22:54.609Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/00/58f7b873b21114456e880b75176af3490d7a2836033779ca42f50de3b47a/ruff-0.12.10-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:141ce3d88803c625257b8a6debf4a0473eb6eed9643a6189b68838b43e78165a", size = 13080443, upload-time = "2025-08-21T18:22:57.413Z" },
-    { url = "https://files.pythonhosted.org/packages/12/8c/9e6660007fb10189ccb78a02b41691288038e51e4788bf49b0a60f740604/ruff-0.12.10-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:f3fc21178cd44c98142ae7590f42ddcb587b8e09a3b849cbc84edb62ee95de60", size = 11896759, upload-time = "2025-08-21T18:23:00.473Z" },
-    { url = "https://files.pythonhosted.org/packages/67/4c/6d092bb99ea9ea6ebda817a0e7ad886f42a58b4501a7e27cd97371d0ba54/ruff-0.12.10-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:7d1a4e0bdfafcd2e3e235ecf50bf0176f74dd37902f241588ae1f6c827a36c56", size = 11701463, upload-time = "2025-08-21T18:23:03.211Z" },
-    { url = "https://files.pythonhosted.org/packages/59/80/d982c55e91df981f3ab62559371380616c57ffd0172d96850280c2b04fa8/ruff-0.12.10-py3-none-musllinux_1_2_i686.whl", hash = "sha256:e67d96827854f50b9e3e8327b031647e7bcc090dbe7bb11101a81a3a2cbf1cc9", size = 12691603, upload-time = "2025-08-21T18:23:06.935Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/37/63a9c788bbe0b0850611669ec6b8589838faf2f4f959647f2d3e320383ae/ruff-0.12.10-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:ae479e1a18b439c59138f066ae79cc0f3ee250712a873d00dbafadaad9481e5b", size = 13164356, upload-time = "2025-08-21T18:23:10.225Z" },
-    { url = "https://files.pythonhosted.org/packages/47/d4/1aaa7fb201a74181989970ebccd12f88c0fc074777027e2a21de5a90657e/ruff-0.12.10-py3-none-win32.whl", hash = "sha256:9de785e95dc2f09846c5e6e1d3a3d32ecd0b283a979898ad427a9be7be22b266", size = 11896089, upload-time = "2025-08-21T18:23:14.232Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/14/2ad38fd4037daab9e023456a4a40ed0154e9971f8d6aed41bdea390aabd9/ruff-0.12.10-py3-none-win_amd64.whl", hash = "sha256:7837eca8787f076f67aba2ca559cefd9c5cbc3a9852fd66186f4201b87c1563e", size = 13004616, upload-time = "2025-08-21T18:23:17.422Z" },
-    { url = "https://files.pythonhosted.org/packages/24/3c/21cf283d67af33a8e6ed242396863af195a8a6134ec581524fd22b9811b6/ruff-0.12.10-py3-none-win_arm64.whl", hash = "sha256:cc138cc06ed9d4bfa9d667a65af7172b47840e1a98b02ce7011c391e54635ffc", size = 12074225, upload-time = "2025-08-21T18:23:20.137Z" },
+version = "0.14.8"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ed/d9/f7a0c4b3a2bf2556cd5d99b05372c29980249ef71e8e32669ba77428c82c/ruff-0.14.8.tar.gz", hash = "sha256:774ed0dd87d6ce925e3b8496feb3a00ac564bea52b9feb551ecd17e0a23d1eed", size = 5765385, upload-time = "2025-12-04T15:06:17.669Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/48/b8/9537b52010134b1d2b72870cc3f92d5fb759394094741b09ceccae183fbe/ruff-0.14.8-py3-none-linux_armv6l.whl", hash = "sha256:ec071e9c82eca417f6111fd39f7043acb53cd3fde9b1f95bbed745962e345afb", size = 13441540, upload-time = "2025-12-04T15:06:14.896Z" },
+    { url = "https://files.pythonhosted.org/packages/24/00/99031684efb025829713682012b6dd37279b1f695ed1b01725f85fd94b38/ruff-0.14.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:8cdb162a7159f4ca36ce980a18c43d8f036966e7f73f866ac8f493b75e0c27e9", size = 13669384, upload-time = "2025-12-04T15:06:51.809Z" },
+    { url = "https://files.pythonhosted.org/packages/72/64/3eb5949169fc19c50c04f28ece2c189d3b6edd57e5b533649dae6ca484fe/ruff-0.14.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:2e2fcbefe91f9fad0916850edf0854530c15bd1926b6b779de47e9ab619ea38f", size = 12806917, upload-time = "2025-12-04T15:06:08.925Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/08/5250babb0b1b11910f470370ec0cbc67470231f7cdc033cee57d4976f941/ruff-0.14.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a9d70721066a296f45786ec31916dc287b44040f553da21564de0ab4d45a869b", size = 13256112, upload-time = "2025-12-04T15:06:23.498Z" },
+    { url = "https://files.pythonhosted.org/packages/78/4c/6c588e97a8e8c2d4b522c31a579e1df2b4d003eddfbe23d1f262b1a431ff/ruff-0.14.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2c87e09b3cd9d126fc67a9ecd3b5b1d3ded2b9c7fce3f16e315346b9d05cfb52", size = 13227559, upload-time = "2025-12-04T15:06:33.432Z" },
+    { url = "https://files.pythonhosted.org/packages/23/ce/5f78cea13eda8eceac71b5f6fa6e9223df9b87bb2c1891c166d1f0dce9f1/ruff-0.14.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d62cb310c4fbcb9ee4ac023fe17f984ae1e12b8a4a02e3d21489f9a2a5f730c", size = 13896379, upload-time = "2025-12-04T15:06:02.687Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/79/13de4517c4dadce9218a20035b21212a4c180e009507731f0d3b3f5df85a/ruff-0.14.8-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:1af35c2d62633d4da0521178e8a2641c636d2a7153da0bac1b30cfd4ccd91344", size = 15372786, upload-time = "2025-12-04T15:06:29.828Z" },
+    { url = "https://files.pythonhosted.org/packages/00/06/33df72b3bb42be8a1c3815fd4fae83fa2945fc725a25d87ba3e42d1cc108/ruff-0.14.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:25add4575ffecc53d60eed3f24b1e934493631b48ebbc6ebaf9d8517924aca4b", size = 14990029, upload-time = "2025-12-04T15:06:36.812Z" },
+    { url = "https://files.pythonhosted.org/packages/64/61/0f34927bd90925880394de0e081ce1afab66d7b3525336f5771dcf0cb46c/ruff-0.14.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4c943d847b7f02f7db4201a0600ea7d244d8a404fbb639b439e987edcf2baf9a", size = 14407037, upload-time = "2025-12-04T15:06:39.979Z" },
+    { url = "https://files.pythonhosted.org/packages/96/bc/058fe0aefc0fbf0d19614cb6d1a3e2c048f7dc77ca64957f33b12cfdc5ef/ruff-0.14.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cb6e8bf7b4f627548daa1b69283dac5a296bfe9ce856703b03130732e20ddfe2", size = 14102390, upload-time = "2025-12-04T15:06:46.372Z" },
+    { url = "https://files.pythonhosted.org/packages/af/a4/e4f77b02b804546f4c17e8b37a524c27012dd6ff05855d2243b49a7d3cb9/ruff-0.14.8-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:7aaf2974f378e6b01d1e257c6948207aec6a9b5ba53fab23d0182efb887a0e4a", size = 14230793, upload-time = "2025-12-04T15:06:20.497Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/52/bb8c02373f79552e8d087cedaffad76b8892033d2876c2498a2582f09dcf/ruff-0.14.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:e5758ca513c43ad8a4ef13f0f081f80f08008f410790f3611a21a92421ab045b", size = 13160039, upload-time = "2025-12-04T15:06:49.06Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/ad/b69d6962e477842e25c0b11622548df746290cc6d76f9e0f4ed7456c2c31/ruff-0.14.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:f74f7ba163b6e85a8d81a590363bf71618847e5078d90827749bfda1d88c9cdf", size = 13205158, upload-time = "2025-12-04T15:06:54.574Z" },
+    { url = "https://files.pythonhosted.org/packages/06/63/54f23da1315c0b3dfc1bc03fbc34e10378918a20c0b0f086418734e57e74/ruff-0.14.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:eed28f6fafcc9591994c42254f5a5c5ca40e69a30721d2ab18bb0bb3baac3ab6", size = 13469550, upload-time = "2025-12-04T15:05:59.209Z" },
+    { url = "https://files.pythonhosted.org/packages/70/7d/a4d7b1961e4903bc37fffb7ddcfaa7beb250f67d97cfd1ee1d5cddb1ec90/ruff-0.14.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:21d48fa744c9d1cb8d71eb0a740c4dd02751a5de9db9a730a8ef75ca34cf138e", size = 14211332, upload-time = "2025-12-04T15:06:06.027Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/93/2a5063341fa17054e5c86582136e9895db773e3c2ffb770dde50a09f35f0/ruff-0.14.8-py3-none-win32.whl", hash = "sha256:15f04cb45c051159baebb0f0037f404f1dc2f15a927418f29730f411a79bc4e7", size = 13151890, upload-time = "2025-12-04T15:06:11.668Z" },
+    { url = "https://files.pythonhosted.org/packages/02/1c/65c61a0859c0add13a3e1cbb6024b42de587456a43006ca2d4fd3d1618fe/ruff-0.14.8-py3-none-win_amd64.whl", hash = "sha256:9eeb0b24242b5bbff3011409a739929f497f3fb5fe3b5698aba5e77e8c833097", size = 14537826, upload-time = "2025-12-04T15:06:26.409Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/63/8b41cea3afd7f58eb64ac9251668ee0073789a3bc9ac6f816c8c6fef986d/ruff-0.14.8-py3-none-win_arm64.whl", hash = "sha256:965a582c93c63fe715fd3e3f8aa37c4b776777203d8e1d8aa3cc0c14424a4b99", size = 13634522, upload-time = "2025-12-04T15:06:43.212Z" },
 ]
 
 [[package]]
 name = "secretstorage"
-version = "3.3.3"
+version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
     { name = "jeepney" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/53/a4/f48c9d79cb507ed1373477dbceaba7401fd8a23af63b837fa61f1dcd3691/SecretStorage-3.3.3.tar.gz", hash = "sha256:2403533ef369eca6d2ba81718576c5e0f564d5cca1b58f73a8b23e7d4eeebd77", size = 19739, upload-time = "2022-08-13T16:22:46.976Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/54/24/b4293291fa1dd830f353d2cb163295742fa87f179fcc8a20a306a81978b7/SecretStorage-3.3.3-py3-none-any.whl", hash = "sha256:f356e6628222568e3af06f2eba8df495efa13b3b63081dafd4f7d9a7b7bc9f99", size = 15221, upload-time = "2022-08-13T16:22:44.457Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/46/f5af3402b579fd5e11573ce652019a67074317e18c1935cc0b4ba9b35552/secretstorage-3.5.0-py3-none-any.whl", hash = "sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137", size = 15554, upload-time = "2025-11-23T19:02:51.545Z" },
 ]
 
 [[package]]
@@ -1041,31 +1239,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/04/be/d09147ad1ec7934636ad912901c5fd7667e1c858e19d355237db0d0cd5e4/smmap-5.0.2-py3-none-any.whl", hash = "sha256:b30115f0def7d7531d22a0fb6502488d879e75b260a9db4d0819cfb25403af5e", size = 24303, upload-time = "2025-01-02T07:14:38.724Z" },
 ]
 
-[[package]]
-name = "sniffio"
-version = "1.3.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a2/87/a6771e1546d97e7e041b6ae58d80074f81b7d5121207425c964ddf5cfdbd/sniffio-1.3.1.tar.gz", hash = "sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc", size = 20372, upload-time = "2024-02-25T23:20:04.057Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e9/44/75a9c9421471a6c4805dbf2356f7c181a29c1879239abab1ea2cc8f38b40/sniffio-1.3.1-py3-none-any.whl", hash = "sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2", size = 10235, upload-time = "2024-02-25T23:20:01.196Z" },
-]
-
 [[package]]
 name = "socketdev"
-version = "3.0.21"
+version = "3.0.22"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/33/fb/4669dcd763144f7ebba824562b58648be08f93474ce12fbe3e21836e622f/socketdev-3.0.21.tar.gz", hash = "sha256:c5fe8bdba8c2c114e3bfff9f5f3a4224eca5c85f86a68f68dda8a2d3fea26815", size = 134528, upload-time = "2025-11-27T17:27:09.608Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c1/87/054e1cc4593127361773d782f7d0544e32d0f5f299f3493392bfe426af70/socketdev-3.0.22.tar.gz", hash = "sha256:11cb1e0b5bfad44c1130edcc5cbfc2b1268157718e424b486ae492e00b3f93ec", size = 164883, upload-time = "2025-12-10T14:55:28.067Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/40/2974cca90077b861206e8f402571047ac074f6233c524eb88e8ee9323ecc/socketdev-3.0.21-py3-none-any.whl", hash = "sha256:39a85991445a4a37b0a3bc05138d5799cefc3185b77177fdb1e0d9a2ed81fd08", size = 59698, upload-time = "2025-11-27T17:27:07.696Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/38/4f6fa954d5c0e9ed5422d59b56499ee57b95482c85c477c06667ce5e0654/socketdev-3.0.22-py3-none-any.whl", hash = "sha256:066e1647257132d7ef4d0a515251389ba91a869d4c64f903c220513dcc21180f", size = 59691, upload-time = "2025-12-10T14:55:26.246Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.41"
+version = "2.2.47"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1116,7 +1305,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.21,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.22,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]
@@ -1136,41 +1325,51 @@ wheels = [
 
 [[package]]
 name = "tomli"
-version = "2.2.1"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/18/87/302344fed471e44a87289cf4967697d07e532f2421fdaf868a303cbae4ff/tomli-2.2.1.tar.gz", hash = "sha256:cd45e1dc79c835ce60f7404ec8119f2eb06d38b1deba146f07ced3bbc44505ff", size = 17175, upload-time = "2024-11-27T22:38:36.873Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/ca/75707e6efa2b37c77dadb324ae7d9571cb424e61ea73fad7c56c2d14527f/tomli-2.2.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:678e4fa69e4575eb77d103de3df8a895e1591b48e740211bd1067378c69e8249", size = 131077, upload-time = "2024-11-27T22:37:54.956Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/16/51ae563a8615d472fdbffc43a3f3d46588c264ac4f024f63f01283becfbb/tomli-2.2.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6", size = 123429, upload-time = "2024-11-27T22:37:56.698Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/dd/4f6cd1e7b160041db83c694abc78e100473c15d54620083dbd5aae7b990e/tomli-2.2.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ece47d672db52ac607a3d9599a9d48dcb2f2f735c6c2d1f34130085bb12b112a", size = 226067, upload-time = "2024-11-27T22:37:57.63Z" },
-    { url = "https://files.pythonhosted.org/packages/a9/6b/c54ede5dc70d648cc6361eaf429304b02f2871a345bbdd51e993d6cdf550/tomli-2.2.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6972ca9c9cc9f0acaa56a8ca1ff51e7af152a9f87fb64623e31d5c83700080ee", size = 236030, upload-time = "2024-11-27T22:37:59.344Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/47/999514fa49cfaf7a92c805a86c3c43f4215621855d151b61c602abb38091/tomli-2.2.1-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c954d2250168d28797dd4e3ac5cf812a406cd5a92674ee4c8f123c889786aa8e", size = 240898, upload-time = "2024-11-27T22:38:00.429Z" },
-    { url = "https://files.pythonhosted.org/packages/73/41/0a01279a7ae09ee1573b423318e7934674ce06eb33f50936655071d81a24/tomli-2.2.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:8dd28b3e155b80f4d54beb40a441d366adcfe740969820caf156c019fb5c7ec4", size = 229894, upload-time = "2024-11-27T22:38:02.094Z" },
-    { url = "https://files.pythonhosted.org/packages/55/18/5d8bc5b0a0362311ce4d18830a5d28943667599a60d20118074ea1b01bb7/tomli-2.2.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e59e304978767a54663af13c07b3d1af22ddee3bb2fb0618ca1593e4f593a106", size = 245319, upload-time = "2024-11-27T22:38:03.206Z" },
-    { url = "https://files.pythonhosted.org/packages/92/a3/7ade0576d17f3cdf5ff44d61390d4b3febb8a9fc2b480c75c47ea048c646/tomli-2.2.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:33580bccab0338d00994d7f16f4c4ec25b776af3ffaac1ed74e0b3fc95e885a8", size = 238273, upload-time = "2024-11-27T22:38:04.217Z" },
-    { url = "https://files.pythonhosted.org/packages/72/6f/fa64ef058ac1446a1e51110c375339b3ec6be245af9d14c87c4a6412dd32/tomli-2.2.1-cp311-cp311-win32.whl", hash = "sha256:465af0e0875402f1d226519c9904f37254b3045fc5084697cefb9bdde1ff99ff", size = 98310, upload-time = "2024-11-27T22:38:05.908Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/1c/4a2dcde4a51b81be3530565e92eda625d94dafb46dbeb15069df4caffc34/tomli-2.2.1-cp311-cp311-win_amd64.whl", hash = "sha256:2d0f2fdd22b02c6d81637a3c95f8cd77f995846af7414c5c4b8d0545afa1bc4b", size = 108309, upload-time = "2024-11-27T22:38:06.812Z" },
-    { url = "https://files.pythonhosted.org/packages/52/e1/f8af4c2fcde17500422858155aeb0d7e93477a0d59a98e56cbfe75070fd0/tomli-2.2.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4a8f6e44de52d5e6c657c9fe83b562f5f4256d8ebbfe4ff922c495620a7f6cea", size = 132762, upload-time = "2024-11-27T22:38:07.731Z" },
-    { url = "https://files.pythonhosted.org/packages/03/b8/152c68bb84fc00396b83e7bbddd5ec0bd3dd409db4195e2a9b3e398ad2e3/tomli-2.2.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8d57ca8095a641b8237d5b079147646153d22552f1c637fd3ba7f4b0b29167a8", size = 123453, upload-time = "2024-11-27T22:38:09.384Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/d6/fc9267af9166f79ac528ff7e8c55c8181ded34eb4b0e93daa767b8841573/tomli-2.2.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e340144ad7ae1533cb897d406382b4b6fede8890a03738ff1683af800d54192", size = 233486, upload-time = "2024-11-27T22:38:10.329Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/51/51c3f2884d7bab89af25f678447ea7d297b53b5a3b5730a7cb2ef6069f07/tomli-2.2.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:db2b95f9de79181805df90bedc5a5ab4c165e6ec3fe99f970d0e302f384ad222", size = 242349, upload-time = "2024-11-27T22:38:11.443Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/df/bfa89627d13a5cc22402e441e8a931ef2108403db390ff3345c05253935e/tomli-2.2.1-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:40741994320b232529c802f8bc86da4e1aa9f413db394617b9a256ae0f9a7f77", size = 252159, upload-time = "2024-11-27T22:38:13.099Z" },
-    { url = "https://files.pythonhosted.org/packages/9e/6e/fa2b916dced65763a5168c6ccb91066f7639bdc88b48adda990db10c8c0b/tomli-2.2.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:400e720fe168c0f8521520190686ef8ef033fb19fc493da09779e592861b78c6", size = 237243, upload-time = "2024-11-27T22:38:14.766Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/04/885d3b1f650e1153cbb93a6a9782c58a972b94ea4483ae4ac5cedd5e4a09/tomli-2.2.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:02abe224de6ae62c19f090f68da4e27b10af2b93213d36cf44e6e1c5abd19fdd", size = 259645, upload-time = "2024-11-27T22:38:15.843Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/de/6b432d66e986e501586da298e28ebeefd3edc2c780f3ad73d22566034239/tomli-2.2.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b82ebccc8c8a36f2094e969560a1b836758481f3dc360ce9a3277c65f374285e", size = 244584, upload-time = "2024-11-27T22:38:17.645Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/9a/47c0449b98e6e7d1be6cbac02f93dd79003234ddc4aaab6ba07a9a7482e2/tomli-2.2.1-cp312-cp312-win32.whl", hash = "sha256:889f80ef92701b9dbb224e49ec87c645ce5df3fa2cc548664eb8a25e03127a98", size = 98875, upload-time = "2024-11-27T22:38:19.159Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/60/9b9638f081c6f1261e2688bd487625cd1e660d0a85bd469e91d8db969734/tomli-2.2.1-cp312-cp312-win_amd64.whl", hash = "sha256:7fc04e92e1d624a4a63c76474610238576942d6b8950a2d7f908a340494e67e4", size = 109418, upload-time = "2024-11-27T22:38:20.064Z" },
-    { url = "https://files.pythonhosted.org/packages/04/90/2ee5f2e0362cb8a0b6499dc44f4d7d48f8fff06d28ba46e6f1eaa61a1388/tomli-2.2.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f4039b9cbc3048b2416cc57ab3bda989a6fcf9b36cf8937f01a6e731b64f80d7", size = 132708, upload-time = "2024-11-27T22:38:21.659Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/ec/46b4108816de6b385141f082ba99e315501ccd0a2ea23db4a100dd3990ea/tomli-2.2.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:286f0ca2ffeeb5b9bd4fcc8d6c330534323ec51b2f52da063b11c502da16f30c", size = 123582, upload-time = "2024-11-27T22:38:22.693Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/bd/b470466d0137b37b68d24556c38a0cc819e8febe392d5b199dcd7f578365/tomli-2.2.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a92ef1a44547e894e2a17d24e7557a5e85a9e1d0048b0b5e7541f76c5032cb13", size = 232543, upload-time = "2024-11-27T22:38:24.367Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/e5/82e80ff3b751373f7cead2815bcbe2d51c895b3c990686741a8e56ec42ab/tomli-2.2.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9316dc65bed1684c9a98ee68759ceaed29d229e985297003e494aa825ebb0281", size = 241691, upload-time = "2024-11-27T22:38:26.081Z" },
-    { url = "https://files.pythonhosted.org/packages/05/7e/2a110bc2713557d6a1bfb06af23dd01e7dde52b6ee7dadc589868f9abfac/tomli-2.2.1-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e85e99945e688e32d5a35c1ff38ed0b3f41f43fad8df0bdf79f72b2ba7bc5272", size = 251170, upload-time = "2024-11-27T22:38:27.921Z" },
-    { url = "https://files.pythonhosted.org/packages/64/7b/22d713946efe00e0adbcdfd6d1aa119ae03fd0b60ebed51ebb3fa9f5a2e5/tomli-2.2.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ac065718db92ca818f8d6141b5f66369833d4a80a9d74435a268c52bdfa73140", size = 236530, upload-time = "2024-11-27T22:38:29.591Z" },
-    { url = "https://files.pythonhosted.org/packages/38/31/3a76f67da4b0cf37b742ca76beaf819dca0ebef26d78fc794a576e08accf/tomli-2.2.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:d920f33822747519673ee656a4b6ac33e382eca9d331c87770faa3eef562aeb2", size = 258666, upload-time = "2024-11-27T22:38:30.639Z" },
-    { url = "https://files.pythonhosted.org/packages/07/10/5af1293da642aded87e8a988753945d0cf7e00a9452d3911dd3bb354c9e2/tomli-2.2.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a198f10c4d1b1375d7687bc25294306e551bf1abfa4eace6650070a5c1ae2744", size = 243954, upload-time = "2024-11-27T22:38:31.702Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/b9/1ed31d167be802da0fc95020d04cd27b7d7065cc6fbefdd2f9186f60d7bd/tomli-2.2.1-cp313-cp313-win32.whl", hash = "sha256:d3f5614314d758649ab2ab3a62d4f2004c825922f9e370b29416484086b264ec", size = 98724, upload-time = "2024-11-27T22:38:32.837Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/32/b0963458706accd9afcfeb867c0f9175a741bf7b19cd424230714d722198/tomli-2.2.1-cp313-cp313-win_amd64.whl", hash = "sha256:a38aa0308e754b0e3c67e344754dff64999ff9b513e691d0e786265c93583c69", size = 109383, upload-time = "2024-11-27T22:38:34.455Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/c2/61d3e0f47e2b74ef40a68b9e6ad5984f6241a942f7cd3bbfbdbd03861ea9/tomli-2.2.1-py3-none-any.whl", hash = "sha256:cb55c73c5f4408779d0cf3eef9f762b9c9f147a77de7b258bef0a5628adc85cc", size = 14257, upload-time = "2024-11-27T22:38:35.385Z" },
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/52/ed/3f73f72945444548f33eba9a87fc7a6e969915e7b1acc8260b30e1f76a2f/tomli-2.3.0.tar.gz", hash = "sha256:64be704a875d2a59753d80ee8a533c3fe183e3f06807ff7dc2232938ccb01549", size = 17392, upload-time = "2025-10-08T22:01:47.119Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/2e/299f62b401438d5fe1624119c723f5d877acc86a4c2492da405626665f12/tomli-2.3.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:88bd15eb972f3664f5ed4b57c1634a97153b4bac4479dcb6a495f41921eb7f45", size = 153236, upload-time = "2025-10-08T22:01:00.137Z" },
+    { url = "https://files.pythonhosted.org/packages/86/7f/d8fffe6a7aefdb61bced88fcb5e280cfd71e08939da5894161bd71bea022/tomli-2.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:883b1c0d6398a6a9d29b508c331fa56adbcdff647f6ace4dfca0f50e90dfd0ba", size = 148084, upload-time = "2025-10-08T22:01:01.63Z" },
+    { url = "https://files.pythonhosted.org/packages/47/5c/24935fb6a2ee63e86d80e4d3b58b222dafaf438c416752c8b58537c8b89a/tomli-2.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d1381caf13ab9f300e30dd8feadb3de072aeb86f1d34a8569453ff32a7dea4bf", size = 234832, upload-time = "2025-10-08T22:01:02.543Z" },
+    { url = "https://files.pythonhosted.org/packages/89/da/75dfd804fc11e6612846758a23f13271b76d577e299592b4371a4ca4cd09/tomli-2.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a0e285d2649b78c0d9027570d4da3425bdb49830a6156121360b3f8511ea3441", size = 242052, upload-time = "2025-10-08T22:01:03.836Z" },
+    { url = "https://files.pythonhosted.org/packages/70/8c/f48ac899f7b3ca7eb13af73bacbc93aec37f9c954df3c08ad96991c8c373/tomli-2.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0a154a9ae14bfcf5d8917a59b51ffd5a3ac1fd149b71b47a3a104ca4edcfa845", size = 239555, upload-time = "2025-10-08T22:01:04.834Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/28/72f8afd73f1d0e7829bfc093f4cb98ce0a40ffc0cc997009ee1ed94ba705/tomli-2.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:74bf8464ff93e413514fefd2be591c3b0b23231a77f901db1eb30d6f712fc42c", size = 245128, upload-time = "2025-10-08T22:01:05.84Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/eb/a7679c8ac85208706d27436e8d421dfa39d4c914dcf5fa8083a9305f58d9/tomli-2.3.0-cp311-cp311-win32.whl", hash = "sha256:00b5f5d95bbfc7d12f91ad8c593a1659b6387b43f054104cda404be6bda62456", size = 96445, upload-time = "2025-10-08T22:01:06.896Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/fe/3d3420c4cb1ad9cb462fb52967080575f15898da97e21cb6f1361d505383/tomli-2.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:4dc4ce8483a5d429ab602f111a93a6ab1ed425eae3122032db7e9acf449451be", size = 107165, upload-time = "2025-10-08T22:01:08.107Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/b7/40f36368fcabc518bb11c8f06379a0fd631985046c038aca08c6d6a43c6e/tomli-2.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d7d86942e56ded512a594786a5ba0a5e521d02529b3826e7761a05138341a2ac", size = 154891, upload-time = "2025-10-08T22:01:09.082Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/3f/d9dd692199e3b3aab2e4e4dd948abd0f790d9ded8cd10cbaae276a898434/tomli-2.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:73ee0b47d4dad1c5e996e3cd33b8a76a50167ae5f96a2607cbe8cc773506ab22", size = 148796, upload-time = "2025-10-08T22:01:10.266Z" },
+    { url = "https://files.pythonhosted.org/packages/60/83/59bff4996c2cf9f9387a0f5a3394629c7efa5ef16142076a23a90f1955fa/tomli-2.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:792262b94d5d0a466afb5bc63c7daa9d75520110971ee269152083270998316f", size = 242121, upload-time = "2025-10-08T22:01:11.332Z" },
+    { url = "https://files.pythonhosted.org/packages/45/e5/7c5119ff39de8693d6baab6c0b6dcb556d192c165596e9fc231ea1052041/tomli-2.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4f195fe57ecceac95a66a75ac24d9d5fbc98ef0962e09b2eddec5d39375aae52", size = 250070, upload-time = "2025-10-08T22:01:12.498Z" },
+    { url = "https://files.pythonhosted.org/packages/45/12/ad5126d3a278f27e6701abde51d342aa78d06e27ce2bb596a01f7709a5a2/tomli-2.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e31d432427dcbf4d86958c184b9bfd1e96b5b71f8eb17e6d02531f434fd335b8", size = 245859, upload-time = "2025-10-08T22:01:13.551Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/a1/4d6865da6a71c603cfe6ad0e6556c73c76548557a8d658f9e3b142df245f/tomli-2.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:7b0882799624980785240ab732537fcfc372601015c00f7fc367c55308c186f6", size = 250296, upload-time = "2025-10-08T22:01:14.614Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/b7/a7a7042715d55c9ba6e8b196d65d2cb662578b4d8cd17d882d45322b0d78/tomli-2.3.0-cp312-cp312-win32.whl", hash = "sha256:ff72b71b5d10d22ecb084d345fc26f42b5143c5533db5e2eaba7d2d335358876", size = 97124, upload-time = "2025-10-08T22:01:15.629Z" },
+    { url = "https://files.pythonhosted.org/packages/06/1e/f22f100db15a68b520664eb3328fb0ae4e90530887928558112c8d1f4515/tomli-2.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:1cb4ed918939151a03f33d4242ccd0aa5f11b3547d0cf30f7c74a408a5b99878", size = 107698, upload-time = "2025-10-08T22:01:16.51Z" },
+    { url = "https://files.pythonhosted.org/packages/89/48/06ee6eabe4fdd9ecd48bf488f4ac783844fd777f547b8d1b61c11939974e/tomli-2.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5192f562738228945d7b13d4930baffda67b69425a7f0da96d360b0a3888136b", size = 154819, upload-time = "2025-10-08T22:01:17.964Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/01/88793757d54d8937015c75dcdfb673c65471945f6be98e6a0410fba167ed/tomli-2.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:be71c93a63d738597996be9528f4abe628d1adf5e6eb11607bc8fe1a510b5dae", size = 148766, upload-time = "2025-10-08T22:01:18.959Z" },
+    { url = "https://files.pythonhosted.org/packages/42/17/5e2c956f0144b812e7e107f94f1cc54af734eb17b5191c0bbfb72de5e93e/tomli-2.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c4665508bcbac83a31ff8ab08f424b665200c0e1e645d2bd9ab3d3e557b6185b", size = 240771, upload-time = "2025-10-08T22:01:20.106Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/f4/0fbd014909748706c01d16824eadb0307115f9562a15cbb012cd9b3512c5/tomli-2.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4021923f97266babc6ccab9f5068642a0095faa0a51a246a6a02fccbb3514eaf", size = 248586, upload-time = "2025-10-08T22:01:21.164Z" },
+    { url = "https://files.pythonhosted.org/packages/30/77/fed85e114bde5e81ecf9bc5da0cc69f2914b38f4708c80ae67d0c10180c5/tomli-2.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4ea38c40145a357d513bffad0ed869f13c1773716cf71ccaa83b0fa0cc4e42f", size = 244792, upload-time = "2025-10-08T22:01:22.417Z" },
+    { url = "https://files.pythonhosted.org/packages/55/92/afed3d497f7c186dc71e6ee6d4fcb0acfa5f7d0a1a2878f8beae379ae0cc/tomli-2.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ad805ea85eda330dbad64c7ea7a4556259665bdf9d2672f5dccc740eb9d3ca05", size = 248909, upload-time = "2025-10-08T22:01:23.859Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/84/ef50c51b5a9472e7265ce1ffc7f24cd4023d289e109f669bdb1553f6a7c2/tomli-2.3.0-cp313-cp313-win32.whl", hash = "sha256:97d5eec30149fd3294270e889b4234023f2c69747e555a27bd708828353ab606", size = 96946, upload-time = "2025-10-08T22:01:24.893Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/b7/718cd1da0884f281f95ccfa3a6cc572d30053cba64603f79d431d3c9b61b/tomli-2.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:0c95ca56fbe89e065c6ead5b593ee64b84a26fca063b5d71a1122bf26e533999", size = 107705, upload-time = "2025-10-08T22:01:26.153Z" },
+    { url = "https://files.pythonhosted.org/packages/19/94/aeafa14a52e16163008060506fcb6aa1949d13548d13752171a755c65611/tomli-2.3.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:cebc6fe843e0733ee827a282aca4999b596241195f43b4cc371d64fc6639da9e", size = 154244, upload-time = "2025-10-08T22:01:27.06Z" },
+    { url = "https://files.pythonhosted.org/packages/db/e4/1e58409aa78eefa47ccd19779fc6f36787edbe7d4cd330eeeedb33a4515b/tomli-2.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4c2ef0244c75aba9355561272009d934953817c49f47d768070c3c94355c2aa3", size = 148637, upload-time = "2025-10-08T22:01:28.059Z" },
+    { url = "https://files.pythonhosted.org/packages/26/b6/d1eccb62f665e44359226811064596dd6a366ea1f985839c566cd61525ae/tomli-2.3.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c22a8bf253bacc0cf11f35ad9808b6cb75ada2631c2d97c971122583b129afbc", size = 241925, upload-time = "2025-10-08T22:01:29.066Z" },
+    { url = "https://files.pythonhosted.org/packages/70/91/7cdab9a03e6d3d2bb11beae108da5bdc1c34bdeb06e21163482544ddcc90/tomli-2.3.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0eea8cc5c5e9f89c9b90c4896a8deefc74f518db5927d0e0e8d4a80953d774d0", size = 249045, upload-time = "2025-10-08T22:01:31.98Z" },
+    { url = "https://files.pythonhosted.org/packages/15/1b/8c26874ed1f6e4f1fcfeb868db8a794cbe9f227299402db58cfcc858766c/tomli-2.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:b74a0e59ec5d15127acdabd75ea17726ac4c5178ae51b85bfe39c4f8a278e879", size = 245835, upload-time = "2025-10-08T22:01:32.989Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/42/8e3c6a9a4b1a1360c1a2a39f0b972cef2cc9ebd56025168c4137192a9321/tomli-2.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:b5870b50c9db823c595983571d1296a6ff3e1b88f734a4c8f6fc6188397de005", size = 253109, upload-time = "2025-10-08T22:01:34.052Z" },
+    { url = "https://files.pythonhosted.org/packages/22/0c/b4da635000a71b5f80130937eeac12e686eefb376b8dee113b4a582bba42/tomli-2.3.0-cp314-cp314-win32.whl", hash = "sha256:feb0dacc61170ed7ab602d3d972a58f14ee3ee60494292d384649a3dc38ef463", size = 97930, upload-time = "2025-10-08T22:01:35.082Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/74/cb1abc870a418ae99cd5c9547d6bce30701a954e0e721821df483ef7223c/tomli-2.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:b273fcbd7fc64dc3600c098e39136522650c49bca95df2d11cf3b626422392c8", size = 107964, upload-time = "2025-10-08T22:01:36.057Z" },
+    { url = "https://files.pythonhosted.org/packages/54/78/5c46fff6432a712af9f792944f4fcd7067d8823157949f4e40c56b8b3c83/tomli-2.3.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:940d56ee0410fa17ee1f12b817b37a4d4e4dc4d27340863cc67236c74f582e77", size = 163065, upload-time = "2025-10-08T22:01:37.27Z" },
+    { url = "https://files.pythonhosted.org/packages/39/67/f85d9bd23182f45eca8939cd2bc7050e1f90c41f4a2ecbbd5963a1d1c486/tomli-2.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f85209946d1fe94416debbb88d00eb92ce9cd5266775424ff81bc959e001acaf", size = 159088, upload-time = "2025-10-08T22:01:38.235Z" },
+    { url = "https://files.pythonhosted.org/packages/26/5a/4b546a0405b9cc0659b399f12b6adb750757baf04250b148d3c5059fc4eb/tomli-2.3.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a56212bdcce682e56b0aaf79e869ba5d15a6163f88d5451cbde388d48b13f530", size = 268193, upload-time = "2025-10-08T22:01:39.712Z" },
+    { url = "https://files.pythonhosted.org/packages/42/4f/2c12a72ae22cf7b59a7fe75b3465b7aba40ea9145d026ba41cb382075b0e/tomli-2.3.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c5f3ffd1e098dfc032d4d3af5c0ac64f6d286d98bc148698356847b80fa4de1b", size = 275488, upload-time = "2025-10-08T22:01:40.773Z" },
+    { url = "https://files.pythonhosted.org/packages/92/04/a038d65dbe160c3aa5a624e93ad98111090f6804027d474ba9c37c8ae186/tomli-2.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5e01decd096b1530d97d5d85cb4dff4af2d8347bd35686654a004f8dea20fc67", size = 272669, upload-time = "2025-10-08T22:01:41.824Z" },
+    { url = "https://files.pythonhosted.org/packages/be/2f/8b7c60a9d1612a7cbc39ffcca4f21a73bf368a80fc25bccf8253e2563267/tomli-2.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:8a35dd0e643bb2610f156cca8db95d213a90015c11fee76c946aa62b7ae7e02f", size = 279709, upload-time = "2025-10-08T22:01:43.177Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/46/cc36c679f09f27ded940281c38607716c86cf8ba4a518d524e349c8b4874/tomli-2.3.0-cp314-cp314t-win32.whl", hash = "sha256:a1f7f282fe248311650081faafa5f4732bdbfef5d45fe3f2e702fbc6f2d496e0", size = 107563, upload-time = "2025-10-08T22:01:44.233Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ff/426ca8683cf7b753614480484f6437f568fd2fda2edbdf57a2d3d8b27a0b/tomli-2.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:70a251f8d4ba2d9ac2542eecf008b3c8a9fc5c3f9f02c56a9d7952612be2fdba", size = 119756, upload-time = "2025-10-08T22:01:45.234Z" },
+    { url = "https://files.pythonhosted.org/packages/77/b8/0135fadc89e73be292b473cb820b4f5a08197779206b33191e801feeae40/tomli-2.3.0-py3-none-any.whl", hash = "sha256:e95b1af3c5b07d9e643909b5abbec77cd9f1217e6d0bca72b0234736b9fb1f1b", size = 14408, upload-time = "2025-10-08T22:01:46.04Z" },
 ]
 
 [[package]]
@@ -1193,16 +1392,16 @@ wheels = [
 
 [[package]]
 name = "trove-classifiers"
-version = "2025.8.6.13"
+version = "2025.12.1.14"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c3/21/707af14daa638b0df15b5d5700349e0abdd3e5140069f9ab6e0ccb922806/trove_classifiers-2025.8.6.13.tar.gz", hash = "sha256:5a0abad839d2ed810f213ab133d555d267124ddea29f1d8a50d6eca12a50ae6e", size = 16932, upload-time = "2025-08-06T13:26:26.479Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/80/e1/000add3b3e0725ce7ee0ea6ea4543f1e1d9519742f3b2320de41eeefa7c7/trove_classifiers-2025.12.1.14.tar.gz", hash = "sha256:a74f0400524fc83620a9be74a07074b5cbe7594fd4d97fd4c2bfde625fdc1633", size = 16985, upload-time = "2025-12-01T14:47:11.456Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d5/44/323a87d78f04d5329092aada803af3612dd004a64b69ba8b13046601a8c9/trove_classifiers-2025.8.6.13-py3-none-any.whl", hash = "sha256:c4e7fc83012770d80b3ae95816111c32b085716374dccee0d3fbf5c235495f9f", size = 14121, upload-time = "2025-08-06T13:26:25.063Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/7e/bc19996fa86cad8801e8ffe6f1bba5836ca0160df76d0410d27432193712/trove_classifiers-2025.12.1.14-py3-none-any.whl", hash = "sha256:a8206978ede95937b9959c3aff3eb258bbf7b07dff391ddd4ea7e61f316635ab", size = 14184, upload-time = "2025-12-01T14:47:10.113Z" },
 ]
 
 [[package]]
 name = "twine"
-version = "6.1.0"
+version = "6.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "id" },
@@ -1215,27 +1414,27 @@ dependencies = [
     { name = "rich" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c8/a2/6df94fc5c8e2170d21d7134a565c3a8fb84f9797c1dd65a5976aaf714418/twine-6.1.0.tar.gz", hash = "sha256:be324f6272eff91d07ee93f251edf232fc647935dd585ac003539b42404a8dbd", size = 168404, upload-time = "2025-01-21T18:45:26.758Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e0/a8/949edebe3a82774c1ec34f637f5dd82d1cf22c25e963b7d63771083bbee5/twine-6.2.0.tar.gz", hash = "sha256:e5ed0d2fd70c9959770dce51c8f39c8945c574e18173a7b81802dab51b4b75cf", size = 172262, upload-time = "2025-09-04T15:43:17.255Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7c/b6/74e927715a285743351233f33ea3c684528a0d374d2e43ff9ce9585b73fe/twine-6.1.0-py3-none-any.whl", hash = "sha256:a47f973caf122930bf0fbbf17f80b83bc1602c9ce393c7845f289a3001dc5384", size = 40791, upload-time = "2025-01-21T18:45:24.584Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/7a/882d99539b19b1490cac5d77c67338d126e4122c8276bf640e411650c830/twine-6.2.0-py3-none-any.whl", hash = "sha256:418ebf08ccda9a8caaebe414433b0ba5e25eb5e4a927667122fbe8f829f985d8", size = 42727, upload-time = "2025-09-04T15:43:15.994Z" },
 ]
 
 [[package]]
 name = "typing-extensions"
-version = "4.14.1"
+version = "4.15.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/98/5a/da40306b885cc8c09109dc2e1abd358d5684b1425678151cdaed4731c822/typing_extensions-4.14.1.tar.gz", hash = "sha256:38b39f4aeeab64884ce9f74c94263ef78f3c22467c8724005483154c26648d36", size = 107673, upload-time = "2025-07-04T13:28:34.16Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b5/00/d631e67a838026495268c2f6884f3711a15a9a2a96cd244fdaea53b823fb/typing_extensions-4.14.1-py3-none-any.whl", hash = "sha256:d1e1e3b58374dc93031d6eda2420a48ea44a36c2b4766a4fdeb3710755731d76", size = 43906, upload-time = "2025-07-04T13:28:32.743Z" },
+    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
 ]
 
 [[package]]
 name = "urllib3"
-version = "2.5.0"
+version = "2.6.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/15/22/9ee70a2574a4f4599c47dd506532914ce044817c7752a79b6a51286319bc/urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760", size = 393185, upload-time = "2025-06-18T14:07:41.644Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5e/1d/0f3a93cca1ac5e8287842ed4eebbd0f7a991315089b1a0b01c7788aa7b63/urllib3-2.6.1.tar.gz", hash = "sha256:5379eb6e1aba4088bae84f8242960017ec8d8e3decf30480b3a1abdaa9671a3f", size = 432678, upload-time = "2025-12-08T15:25:26.773Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a7/c2/fe1e52489ae3122415c51f387e221dd0773709bad6c6cdaa599e8a2c5185/urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc", size = 129795, upload-time = "2025-06-18T14:07:40.39Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/56/190ceb8cb10511b730b564fb1e0293fa468363dbad26145c34928a60cb0c/urllib3-2.6.1-py3-none-any.whl", hash = "sha256:e67d06fe947c36a7ca39f4994b08d73922d40e6cca949907be05efa6fd75110b", size = 131138, upload-time = "2025-12-08T15:25:25.51Z" },
 ]
 
 [[package]]
@@ -1252,33 +1451,33 @@ wheels = [
 
 [[package]]
 name = "uv"
-version = "0.8.13"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ca/f3/4f947303fb68daa553fc44ea5f2bcdfb1d11c4390ab52b6e3829f72b6b69/uv-0.8.13.tar.gz", hash = "sha256:a4438eca3d301183c52994a6d2baff70fd1840421a83446f3cabb1d0d0b50aff", size = 3529020, upload-time = "2025-08-21T19:20:17.329Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/1d/98c7985f05c1dfa4a1d9bfebfdc75fd5c86633acb3bd9a65a5233a267d0e/uv-0.8.13-py3-none-linux_armv6l.whl", hash = "sha256:3b5c6e44238007ec1d25212cafe1b37a8506d425d1dd74a267cb9072a61930f9", size = 18712142, upload-time = "2025-08-21T19:19:30.882Z" },
-    { url = "https://files.pythonhosted.org/packages/32/a2/2fc23b2fb14316fafafcd918dd4bf3456aecfeae95d71deaf9d7d59e9720/uv-0.8.13-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:2945c32b8fcf23807ef1f74c390795e2b00371c53b94c015cc6e7b0cfbab9d94", size = 18752276, upload-time = "2025-08-21T19:19:34.658Z" },
-    { url = "https://files.pythonhosted.org/packages/95/e4/c8d4963271e3a9ea0886be1082c96b16881d58d6d260957e76bd41f4c991/uv-0.8.13-py3-none-macosx_11_0_arm64.whl", hash = "sha256:73459fe1403b1089853071db6770450dc03e4058848f7146d88cff5f1c352743", size = 17403078, upload-time = "2025-08-21T19:19:36.882Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/25/3985330034df1f99b63b947f5de37059859aede74883fc14e4500a983daf/uv-0.8.13-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:854c4e75024a4894477bf61684b2872b83c77ca87d1bad62692bcc31200619c3", size = 18075030, upload-time = "2025-08-21T19:19:41.992Z" },
-    { url = "https://files.pythonhosted.org/packages/68/f2/5956b44e8b77e777b1c15c011e43a7bb29c4346908f569c474db67baab02/uv-0.8.13-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:28c8d4560c673ff5c798f2f4422281840728f46ebf1946345b65d065f8344c03", size = 18334387, upload-time = "2025-08-21T19:19:44.543Z" },
-    { url = "https://files.pythonhosted.org/packages/18/96/5feda4185ea21e7dc79f73ba1f9ebbd2ac5da22ed5c40d7c6f6a310d4738/uv-0.8.13-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f6c508aa9c5210577008e1919b532e38356fe68712179399f00462b3e78fd845", size = 19097001, upload-time = "2025-08-21T19:19:47.363Z" },
-    { url = "https://files.pythonhosted.org/packages/02/f8/1b6e258907afdb008855418f7a0aa41568f8b7389994f62b7992352a5146/uv-0.8.13-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:3bac51ea503d97f371222f23e845fc4ab95465ac3e958c7589d6743c75445b71", size = 20501591, upload-time = "2025-08-21T19:19:49.976Z" },
-    { url = "https://files.pythonhosted.org/packages/39/17/8a9f979bb6329b74320514797bfaf0a2865e25c2edf7506fde5080ad071c/uv-0.8.13-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4a6d37547947fcae57244b4d1f3b62fba55f4a85d3e45e7284a93b6cd5bedca4", size = 20156528, upload-time = "2025-08-21T19:19:52.096Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/ca/bc42b2ae9dd0eae8b5bba34020bc3893cf7370c4125164075643a1da86c8/uv-0.8.13-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3735a452cdc3168932d128891d7e8866b4a2d052283c6da5ccfe0b038d1cf8bd", size = 19491271, upload-time = "2025-08-21T19:19:54.302Z" },
-    { url = "https://files.pythonhosted.org/packages/82/6b/81387a715dd045f7edea452fb76a5896dcfc11b8ecf0db5106f4b0f633ec/uv-0.8.13-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2113cd877974b68ea2af64a2f2cc23708ba97066046e78efb72ba94e5fef617a", size = 19452076, upload-time = "2025-08-21T19:19:56.608Z" },
-    { url = "https://files.pythonhosted.org/packages/59/2e/eae2eff5876576b6e1d43010924446da22f4fe33140124a4f2ae936c457d/uv-0.8.13-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:4c2c5e5962239ecaff6444d5bc22422a9bd2da25a80adc6ab14cb42e4461b1cf", size = 18329700, upload-time = "2025-08-21T19:19:58.784Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/6e/9a88c83a1d8845c04b911433bbe61989b9d40b4feb7a51ab1ca595107bf5/uv-0.8.13-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:eb90089624d92d57b8582f708973db8988e09dba6bae83991dba20731d82eb6a", size = 19218874, upload-time = "2025-08-21T19:20:01.054Z" },
-    { url = "https://files.pythonhosted.org/packages/df/f5/8f818016a1704a185dd0087cacbe0797b0ca2ef859922814e26322427756/uv-0.8.13-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:cf3ce98404ddc1e11cd2c2604668f8f81219cf00bb1227b792fdf5dbb4faf31a", size = 18310085, upload-time = "2025-08-21T19:20:03.219Z" },
-    { url = "https://files.pythonhosted.org/packages/64/d2/b0d16ec65efb8b5877256e14da808a0db20c4bf3e9960d807e4c0db5f71c/uv-0.8.13-py3-none-musllinux_1_1_i686.whl", hash = "sha256:8a3739540f8b0b5258869b1671185d55daacfa4609eaffd235573ac938ec01a6", size = 18604881, upload-time = "2025-08-21T19:20:05.413Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/ba/f96a34b2aec7c38d0512b10fea182eaf0d416e2825cf4ac00fde1e375019/uv-0.8.13-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:18a502328545af511039c7b7c602a0aa89eeff23b1221a1f56d99b3a3fecfddd", size = 19569585, upload-time = "2025-08-21T19:20:08.008Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/7d/a57198784a1dca07668007837cfd00346cde2da079697f67daaedbfb1376/uv-0.8.13-py3-none-win32.whl", hash = "sha256:d22fa55580b224779279b98e0b23cbc45e51837e1fac616d7c5d03aff668a998", size = 18661160, upload-time = "2025-08-21T19:20:10.393Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/14/65ba1f45c27ff975497f2db965cd2b989fdda031afa76b978ddc72a66032/uv-0.8.13-py3-none-win_amd64.whl", hash = "sha256:20862f612de38f6dea55d40467a29f3cb621b256a4b5891ae55debbbdf1db2b4", size = 20556536, upload-time = "2025-08-21T19:20:12.745Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/47/16a2eb25166861af1a139e506e5595cb92c7f7e5aae6e71feec135093394/uv-0.8.13-py3-none-win_arm64.whl", hash = "sha256:404ca19b2d860ab661e1d78633f594e994f8422af8772ad237d763fe353da2ab", size = 19028395, upload-time = "2025-08-21T19:20:15.035Z" },
+version = "0.9.17"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/52/1a/cb0c37ae8513b253bcbc13d42392feb7d95ea696eb398b37535a28df9040/uv-0.9.17.tar.gz", hash = "sha256:6d93ab9012673e82039cfa7f9f66f69b388bc3f910f9e8a2ebee211353f620aa", size = 3815957, upload-time = "2025-12-09T23:01:21.756Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2b/e2/b6e2d473bdc37f4d86307151b53c0776e9925de7376ce297e92eab2e8894/uv-0.9.17-py3-none-linux_armv6l.whl", hash = "sha256:c708e6560ae5bc3cda1ba93f0094148ce773b6764240ced433acf88879e57a67", size = 21254511, upload-time = "2025-12-09T23:00:36.604Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/40/75f1529a8bf33cc5c885048e64a014c3096db5ac7826c71e20f2b731b588/uv-0.9.17-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:233b3d90f104c59d602abf434898057876b87f64df67a37129877d6dab6e5e10", size = 20384366, upload-time = "2025-12-09T23:01:17.293Z" },
+    { url = "https://files.pythonhosted.org/packages/de/30/b3a343893681a569cbb74f8747a1c24e5f18ca9e07de0430aceaf9389ef4/uv-0.9.17-py3-none-macosx_11_0_arm64.whl", hash = "sha256:4b8e5513d48a267bfa180ca7fefaf6f27b1267e191573b3dba059981143e88ef", size = 18924624, upload-time = "2025-12-09T23:01:10.291Z" },
+    { url = "https://files.pythonhosted.org/packages/21/56/9daf8bbe4a9a36eb0b9257cf5e1e20f9433d0ce996778ccf1929cbe071a4/uv-0.9.17-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:8f283488bbcf19754910cc1ae7349c567918d6367c596e5a75d4751e0080eee0", size = 20671687, upload-time = "2025-12-09T23:00:51.927Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/c8/4050ff7dc692770092042fcef57223b8852662544f5981a7f6cac8fc488d/uv-0.9.17-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:9cf8052ba669dc17bdba75dae655094d820f4044990ea95c01ec9688c182f1da", size = 20861866, upload-time = "2025-12-09T23:01:12.555Z" },
+    { url = "https://files.pythonhosted.org/packages/84/d4/208e62b7db7a65cb3390a11604c59937e387d07ed9f8b63b54edb55e2292/uv-0.9.17-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:06749461b11175a884be193120044e7f632a55e2624d9203398808907d346aad", size = 21858420, upload-time = "2025-12-09T23:01:00.009Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2c/91288cd5a04db37dfc1e0dad26ead84787db5832d9836b4cc8e0fa7f3c53/uv-0.9.17-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:35eb1a519688209160e48e1bb8032d36d285948a13b4dd21afe7ec36dc2a9787", size = 23471658, upload-time = "2025-12-09T23:00:49.503Z" },
+    { url = "https://files.pythonhosted.org/packages/44/ba/493eba650ffad1df9e04fd8eabfc2d0aebc23e8f378acaaee9d95ca43518/uv-0.9.17-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2bfb60a533e82690ab17dfe619ff7f294d053415645800d38d13062170230714", size = 23062950, upload-time = "2025-12-09T23:00:39.055Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/9e/f7f679503c06843ba59451e3193f35fb7c782ff0afc697020d4718a7de46/uv-0.9.17-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cd0f3e380ff148aff3d769e95a9743cb29c7f040d7ef2896cafe8063279a6bc1", size = 22080299, upload-time = "2025-12-09T23:00:44.026Z" },
+    { url = "https://files.pythonhosted.org/packages/32/2e/76ba33c7d9efe9f17480db1b94d3393025062005e346bb8b3660554526da/uv-0.9.17-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cd2c3d25fbd8f91b30d0fac69a13b8e2c2cd8e606d7e6e924c1423e4ff84e616", size = 22087554, upload-time = "2025-12-09T23:00:41.715Z" },
+    { url = "https://files.pythonhosted.org/packages/14/db/ef4aae4a6c49076db2acd2a7b0278ddf3dbf785d5172b3165018b96ba2fb/uv-0.9.17-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:330e7085857e4205c5196a417aca81cfbfa936a97dd2a0871f6560a88424ebf2", size = 20823225, upload-time = "2025-12-09T23:00:57.041Z" },
+    { url = "https://files.pythonhosted.org/packages/11/73/e0f816cacd802a1cb25e71de9d60e57fa1f6c659eb5599cef708668618cc/uv-0.9.17-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:45880faa9f6cf91e3cda4e5f947da6a1004238fdc0ed4ebc18783a12ce197312", size = 22004893, upload-time = "2025-12-09T23:01:15.011Z" },
+    { url = "https://files.pythonhosted.org/packages/15/6b/700f6256ee191136eb06e40d16970a4fc687efdccf5e67c553a258063019/uv-0.9.17-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:8e775a1b94c6f248e22f0ce2f86ed37c24e10ae31fb98b7e1b9f9a3189d25991", size = 20853850, upload-time = "2025-12-09T23:01:02.694Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/6a/13f02e2ed6510223c40f74804586b09e5151d9319f93aab1e49d91db13bb/uv-0.9.17-py3-none-musllinux_1_1_i686.whl", hash = "sha256:8650c894401ec96488a6fd84a5b4675e09be102f5525c902a12ba1c8ef8ff230", size = 21322623, upload-time = "2025-12-09T23:00:46.806Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/18/2d19780cebfbec877ea645463410c17859f8070f79c1a34568b153d78e1d/uv-0.9.17-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:673066b72d8b6c86be0dae6d5f73926bcee8e4810f1690d7b8ce5429d919cde3", size = 22290123, upload-time = "2025-12-09T23:00:54.394Z" },
+    { url = "https://files.pythonhosted.org/packages/77/69/ab79bde3f7b6d2ac89f839ea40411a9cf3e67abede2278806305b6ba797e/uv-0.9.17-py3-none-win32.whl", hash = "sha256:7407d45afeae12399de048f7c8c2256546899c94bd7892dbddfae6766616f5a3", size = 20070709, upload-time = "2025-12-09T23:01:05.105Z" },
+    { url = "https://files.pythonhosted.org/packages/08/a0/ab5b1850197bf407d095361b214352e40805441791fed35b891621cb1562/uv-0.9.17-py3-none-win_amd64.whl", hash = "sha256:22fcc26755abebdf366becc529b2872a831ce8bb14b36b6a80d443a1d7f84d3b", size = 22122852, upload-time = "2025-12-09T23:01:07.783Z" },
+    { url = "https://files.pythonhosted.org/packages/37/ef/813cfedda3c8e49d8b59a41c14fcc652174facfd7a1caf9fee162b40ccbd/uv-0.9.17-py3-none-win_arm64.whl", hash = "sha256:6761076b27a763d0ede2f5e72455d2a46968ff334badf8312bb35988c5254831", size = 20435751, upload-time = "2025-12-09T23:01:19.732Z" },
 ]
 
 [[package]]
 name = "virtualenv"
-version = "20.34.0"
+version = "20.35.4"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -1286,9 +1485,9 @@ dependencies = [
     { name = "platformdirs" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1c/14/37fcdba2808a6c615681cd216fecae00413c9dab44fb2e57805ecf3eaee3/virtualenv-20.34.0.tar.gz", hash = "sha256:44815b2c9dee7ed86e387b842a84f20b93f7f417f95886ca1996a72a4138eb1a", size = 6003808, upload-time = "2025-08-13T14:24:07.464Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/20/28/e6f1a6f655d620846bd9df527390ecc26b3805a0c5989048c210e22c5ca9/virtualenv-20.35.4.tar.gz", hash = "sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c", size = 6028799, upload-time = "2025-10-29T06:57:40.511Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/06/04c8e804f813cf972e3262f3f8584c232de64f0cde9f703b46cf53a45090/virtualenv-20.34.0-py3-none-any.whl", hash = "sha256:341f5afa7eee943e4984a9207c025feedd768baff6753cd660c857ceb3e36026", size = 5983279, upload-time = "2025-08-13T14:24:05.111Z" },
+    { url = "https://files.pythonhosted.org/packages/79/0c/c05523fa3181fdf0c9c52a6ba91a23fbf3246cc095f26f6516f9c60e6771/virtualenv-20.35.4-py3-none-any.whl", hash = "sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b", size = 6005095, upload-time = "2025-10-29T06:57:37.598Z" },
 ]
 
 [[package]]
@@ -1325,11 +1524,11 @@ wheels = [
 
 [[package]]
 name = "wcwidth"
-version = "0.2.13"
+version = "0.2.14"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6c/63/53559446a878410fc5a5974feb13d31d78d752eb18aeba59c7fef1af7598/wcwidth-0.2.13.tar.gz", hash = "sha256:72ea0c06399eb286d978fdedb6923a9eb47e1c486ce63e9b4e64fc18303972b5", size = 101301, upload-time = "2024-01-06T02:10:57.829Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/24/30/6b0809f4510673dc723187aeaf24c7f5459922d01e2f794277a3dfb90345/wcwidth-0.2.14.tar.gz", hash = "sha256:4d478375d31bc5395a3c55c40ccdf3354688364cd61c4f6adacaa9215d0b3605", size = 102293, upload-time = "2025-09-22T16:29:53.023Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fd/84/fd2ba7aafacbad3c4201d395674fc6348826569da3c0937e75505ead3528/wcwidth-0.2.13-py2.py3-none-any.whl", hash = "sha256:3da69048e4540d84af32131829ff948f1e022c1c6bdb8d6102117aac784f6859", size = 34166, upload-time = "2024-01-06T02:10:55.763Z" },
+    { url = "https://files.pythonhosted.org/packages/af/b5/123f13c975e9f27ab9c0770f514345bd406d0e8d3b7a0723af9d43f710af/wcwidth-0.2.14-py2.py3-none-any.whl", hash = "sha256:a7bb560c8aee30f9957e5f9895805edd20602f2d7f720186dfd906e82b4982e1", size = 37286, upload-time = "2025-09-22T16:29:51.641Z" },
 ]
 
 [[package]]
@@ -1340,93 +1539,3 @@ sdist = { url = "https://files.pythonhosted.org/packages/e3/02/0f2892c661036d50e
 wheels = [
     { url = "https://files.pythonhosted.org/packages/2e/54/647ade08bf0db230bfea292f893923872fd20be6ac6f53b2b936ba839d75/zipp-3.23.0-py3-none-any.whl", hash = "sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e", size = 10276, upload-time = "2025-06-08T17:06:38.034Z" },
 ]
-
-[[package]]
-name = "zstandard"
-version = "0.24.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/09/1b/c20b2ef1d987627765dcd5bf1dadb8ef6564f00a87972635099bb76b7a05/zstandard-0.24.0.tar.gz", hash = "sha256:fe3198b81c00032326342d973e526803f183f97aa9e9a98e3f897ebafe21178f", size = 905681, upload-time = "2025-08-17T18:36:36.352Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/63/9d/d1ca1e7bff6a7938e81180322c053c080ae9e31b0e3b393434deae7a1ae5/zstandard-0.24.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:af1394c2c5febc44e0bbf0fc6428263fa928b50d1b1982ce1d870dc793a8e5f4", size = 795228, upload-time = "2025-08-17T18:21:12.444Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/ba/a40ddfbbb9f0773127701a802338f215211b018f9222b9fab1e2d498f9cd/zstandard-0.24.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5e941654cef13a1d53634ec30933722eda11f44f99e1d0bc62bbce3387580d50", size = 640522, upload-time = "2025-08-17T18:21:14.133Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/7c/edeee3ef8d469a1345edd86f8d123a3825d60df033bcbbd16df417bdb9e7/zstandard-0.24.0-cp310-cp310-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:561123d05681197c0e24eb8ab3cfdaf299e2b59c293d19dad96e1610ccd8fbc6", size = 5344625, upload-time = "2025-08-17T18:21:16.067Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/2c/2f76e5058435d96ab0187303d4e9663372893cdcc95d64fdb60824951162/zstandard-0.24.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0f6d9a146e07458cb41423ca2d783aefe3a3a97fe72838973c13b8f1ecc7343a", size = 5055074, upload-time = "2025-08-17T18:21:18.483Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/87/3962530a568d38e64f287e11b9a38936d873617120589611c49c29af94a8/zstandard-0.24.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:bf02f915fa7934ea5dfc8d96757729c99a8868b7c340b97704795d6413cf5fe6", size = 5401308, upload-time = "2025-08-17T18:21:20.859Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/69/85e65f0fb05b4475130888cf7934ff30ac14b5979527e8f1ccb6f56e21ec/zstandard-0.24.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:35f13501a8accf834457d8e40e744568287a215818778bc4d79337af2f3f0d97", size = 5448948, upload-time = "2025-08-17T18:21:23.015Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/2f/1b607274bf20ea8bcd13bea3edc0a48f984c438c09d0a050b9667dadcaed/zstandard-0.24.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:92be52ca4e6e604f03d5daa079caec9e04ab4cbf6972b995aaebb877d3d24e13", size = 5555870, upload-time = "2025-08-17T18:21:24.985Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/9a/fadd5ffded6ab113b26704658a40444865b914de072fb460b6b51aa5fa2f/zstandard-0.24.0-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:0c9c3cba57f5792532a3df3f895980d47d78eda94b0e5b800651b53e96e0b604", size = 5044917, upload-time = "2025-08-17T18:21:27.082Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/0d/c5edc3b00e070d0b4156993bd7bef9cba58c5f2571bd0003054cbe90005c/zstandard-0.24.0-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:dd91b0134a32dfcd8be504e8e46de44ad0045a569efc25101f2a12ccd41b5759", size = 5571834, upload-time = "2025-08-17T18:21:29.239Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/7e/9e353ed08c3d7a93050bbadbebe2f5f783b13393e0e8e08e970ef3396390/zstandard-0.24.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d6975f2d903bc354916a17b91a7aaac7299603f9ecdb788145060dde6e573a16", size = 4959108, upload-time = "2025-08-17T18:21:31.228Z" },
-    { url = "https://files.pythonhosted.org/packages/af/28/135dffba375ab1f4d2c569de804647eba8bd682f36d3c01b5a012c560ff2/zstandard-0.24.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:7ac6e4d727521d86d20ec291a3f4e64a478e8a73eaee80af8f38ec403e77a409", size = 5265997, upload-time = "2025-08-17T18:21:33.369Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/7a/702e7cbc51c39ce104c198ea6d069fb6a918eb24c5709ac79fe9371f7a55/zstandard-0.24.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:87ae1684bc3c02d5c35884b3726525eda85307073dbefe68c3c779e104a59036", size = 5440015, upload-time = "2025-08-17T18:21:35.023Z" },
-    { url = "https://files.pythonhosted.org/packages/77/40/4a2d0faa2ae6f4c847c7f77ec626abed80873035891c4a4349b735a36fb4/zstandard-0.24.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:7de5869e616d426b56809be7dc6dba4d37b95b90411ccd3de47f421a42d4d42c", size = 5819056, upload-time = "2025-08-17T18:21:39.661Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/fc/580504a2d7c71411a8e403b83f2388ee083819a68e0e740bf974e78839f8/zstandard-0.24.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:388aad2d693707f4a0f6cc687eb457b33303d6b57ecf212c8ff4468c34426892", size = 5362621, upload-time = "2025-08-17T18:21:42.605Z" },
-    { url = "https://files.pythonhosted.org/packages/70/66/97f6b38eeda955eaa6b5e7cfc0528039bfcb9eb8338016aacf6d83d8a75e/zstandard-0.24.0-cp310-cp310-win32.whl", hash = "sha256:962ea3aecedcc944f8034812e23d7200d52c6e32765b8da396eeb8b8ffca71ce", size = 435575, upload-time = "2025-08-17T18:21:45.477Z" },
-    { url = "https://files.pythonhosted.org/packages/68/a2/5814bdd22d879b10fcc5dc37366e39603767063f06ae970f2a657f76ddac/zstandard-0.24.0-cp310-cp310-win_amd64.whl", hash = "sha256:869bf13f66b124b13be37dd6e08e4b728948ff9735308694e0b0479119e08ea7", size = 505115, upload-time = "2025-08-17T18:21:44.011Z" },
-    { url = "https://files.pythonhosted.org/packages/01/1f/5c72806f76043c0ef9191a2b65281dacdf3b65b0828eb13bb2c987c4fb90/zstandard-0.24.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:addfc23e3bd5f4b6787b9ca95b2d09a1a67ad5a3c318daaa783ff90b2d3a366e", size = 795228, upload-time = "2025-08-17T18:21:46.978Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/ba/3059bd5cd834666a789251d14417621b5c61233bd46e7d9023ea8bc1043a/zstandard-0.24.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:6b005bcee4be9c3984b355336283afe77b2defa76ed6b89332eced7b6fa68b68", size = 640520, upload-time = "2025-08-17T18:21:48.162Z" },
-    { url = "https://files.pythonhosted.org/packages/57/07/f0e632bf783f915c1fdd0bf68614c4764cae9dd46ba32cbae4dd659592c3/zstandard-0.24.0-cp311-cp311-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:3f96a9130171e01dbb6c3d4d9925d604e2131a97f540e223b88ba45daf56d6fb", size = 5347682, upload-time = "2025-08-17T18:21:50.266Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/4c/63523169fe84773a7462cd090b0989cb7c7a7f2a8b0a5fbf00009ba7d74d/zstandard-0.24.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:cd0d3d16e63873253bad22b413ec679cf6586e51b5772eb10733899832efec42", size = 5057650, upload-time = "2025-08-17T18:21:52.634Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/16/49013f7ef80293f5cebf4c4229535a9f4c9416bbfd238560edc579815dbe/zstandard-0.24.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:b7a8c30d9bf4bd5e4dcfe26900bef0fcd9749acde45cdf0b3c89e2052fda9a13", size = 5404893, upload-time = "2025-08-17T18:21:54.54Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/38/78e8bcb5fc32a63b055f2b99e0be49b506f2351d0180173674f516cf8a7a/zstandard-0.24.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:52cd7d9fa0a115c9446abb79b06a47171b7d916c35c10e0c3aa6f01d57561382", size = 5452389, upload-time = "2025-08-17T18:21:56.822Z" },
-    { url = "https://files.pythonhosted.org/packages/55/8a/81671f05619edbacd49bd84ce6899a09fc8299be20c09ae92f6618ccb92d/zstandard-0.24.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a0f6fc2ea6e07e20df48752e7700e02e1892c61f9a6bfbacaf2c5b24d5ad504b", size = 5558888, upload-time = "2025-08-17T18:21:58.68Z" },
-    { url = "https://files.pythonhosted.org/packages/49/cc/e83feb2d7d22d1f88434defbaeb6e5e91f42a4f607b5d4d2d58912b69d67/zstandard-0.24.0-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:e46eb6702691b24ddb3e31e88b4a499e31506991db3d3724a85bd1c5fc3cfe4e", size = 5048038, upload-time = "2025-08-17T18:22:00.642Z" },
-    { url = "https://files.pythonhosted.org/packages/08/c3/7a5c57ff49ef8943877f85c23368c104c2aea510abb339a2dc31ad0a27c3/zstandard-0.24.0-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:d5e3b9310fd7f0d12edc75532cd9a56da6293840c84da90070d692e0bb15f186", size = 5573833, upload-time = "2025-08-17T18:22:02.402Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/00/64519983cd92535ba4bdd4ac26ac52db00040a52d6c4efb8d1764abcc343/zstandard-0.24.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:76cdfe7f920738ea871f035568f82bad3328cbc8d98f1f6988264096b5264efd", size = 4961072, upload-time = "2025-08-17T18:22:04.384Z" },
-    { url = "https://files.pythonhosted.org/packages/72/ab/3a08a43067387d22994fc87c3113636aa34ccd2914a4d2d188ce365c5d85/zstandard-0.24.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:3f2fe35ec84908dddf0fbf66b35d7c2878dbe349552dd52e005c755d3493d61c", size = 5268462, upload-time = "2025-08-17T18:22:06.095Z" },
-    { url = "https://files.pythonhosted.org/packages/49/cf/2abb3a1ad85aebe18c53e7eca73223f1546ddfa3bf4d2fb83fc5a064c5ca/zstandard-0.24.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:aa705beb74ab116563f4ce784fa94771f230c05d09ab5de9c397793e725bb1db", size = 5443319, upload-time = "2025-08-17T18:22:08.572Z" },
-    { url = "https://files.pythonhosted.org/packages/40/42/0dd59fc2f68f1664cda11c3b26abdf987f4e57cb6b6b0f329520cd074552/zstandard-0.24.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:aadf32c389bb7f02b8ec5c243c38302b92c006da565e120dfcb7bf0378f4f848", size = 5822355, upload-time = "2025-08-17T18:22:10.537Z" },
-    { url = "https://files.pythonhosted.org/packages/99/c0/ea4e640fd4f7d58d6f87a1e7aca11fb886ac24db277fbbb879336c912f63/zstandard-0.24.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:e40cd0fc734aa1d4bd0e7ad102fd2a1aefa50ce9ef570005ffc2273c5442ddc3", size = 5365257, upload-time = "2025-08-17T18:22:13.159Z" },
-    { url = "https://files.pythonhosted.org/packages/27/a9/92da42a5c4e7e4003271f2e1f0efd1f37cfd565d763ad3604e9597980a1c/zstandard-0.24.0-cp311-cp311-win32.whl", hash = "sha256:cda61c46343809ecda43dc620d1333dd7433a25d0a252f2dcc7667f6331c7b61", size = 435559, upload-time = "2025-08-17T18:22:17.29Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/8e/2c8e5c681ae4937c007938f954a060fa7c74f36273b289cabdb5ef0e9a7e/zstandard-0.24.0-cp311-cp311-win_amd64.whl", hash = "sha256:3b95fc06489aa9388400d1aab01a83652bc040c9c087bd732eb214909d7fb0dd", size = 505070, upload-time = "2025-08-17T18:22:14.808Z" },
-    { url = "https://files.pythonhosted.org/packages/52/10/a2f27a66bec75e236b575c9f7b0d7d37004a03aa2dcde8e2decbe9ed7b4d/zstandard-0.24.0-cp311-cp311-win_arm64.whl", hash = "sha256:ad9fd176ff6800a0cf52bcf59c71e5de4fa25bf3ba62b58800e0f84885344d34", size = 461507, upload-time = "2025-08-17T18:22:15.964Z" },
-    { url = "https://files.pythonhosted.org/packages/26/e9/0bd281d9154bba7fc421a291e263911e1d69d6951aa80955b992a48289f6/zstandard-0.24.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a2bda8f2790add22773ee7a4e43c90ea05598bffc94c21c40ae0a9000b0133c3", size = 795710, upload-time = "2025-08-17T18:22:19.189Z" },
-    { url = "https://files.pythonhosted.org/packages/36/26/b250a2eef515caf492e2d86732e75240cdac9d92b04383722b9753590c36/zstandard-0.24.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:cc76de75300f65b8eb574d855c12518dc25a075dadb41dd18f6322bda3fe15d5", size = 640336, upload-time = "2025-08-17T18:22:20.466Z" },
-    { url = "https://files.pythonhosted.org/packages/79/bf/3ba6b522306d9bf097aac8547556b98a4f753dc807a170becaf30dcd6f01/zstandard-0.24.0-cp312-cp312-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:d2b3b4bda1a025b10fe0269369475f420177f2cb06e0f9d32c95b4873c9f80b8", size = 5342533, upload-time = "2025-08-17T18:22:22.326Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/ec/22bc75bf054e25accdf8e928bc68ab36b4466809729c554ff3a1c1c8bce6/zstandard-0.24.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:9b84c6c210684286e504022d11ec294d2b7922d66c823e87575d8b23eba7c81f", size = 5062837, upload-time = "2025-08-17T18:22:24.416Z" },
-    { url = "https://files.pythonhosted.org/packages/48/cc/33edfc9d286e517fb5b51d9c3210e5bcfce578d02a675f994308ca587ae1/zstandard-0.24.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:c59740682a686bf835a1a4d8d0ed1eefe31ac07f1c5a7ed5f2e72cf577692b00", size = 5393855, upload-time = "2025-08-17T18:22:26.786Z" },
-    { url = "https://files.pythonhosted.org/packages/73/36/59254e9b29da6215fb3a717812bf87192d89f190f23817d88cb8868c47ac/zstandard-0.24.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6324fde5cf5120fbf6541d5ff3c86011ec056e8d0f915d8e7822926a5377193a", size = 5451058, upload-time = "2025-08-17T18:22:28.885Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/c7/31674cb2168b741bbbe71ce37dd397c9c671e73349d88ad3bca9e9fae25b/zstandard-0.24.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:51a86bd963de3f36688553926a84e550d45d7f9745bd1947d79472eca27fcc75", size = 5546619, upload-time = "2025-08-17T18:22:31.115Z" },
-    { url = "https://files.pythonhosted.org/packages/e6/01/1a9f22239f08c00c156f2266db857545ece66a6fc0303d45c298564bc20b/zstandard-0.24.0-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:d82ac87017b734f2fb70ff93818c66f0ad2c3810f61040f077ed38d924e19980", size = 5046676, upload-time = "2025-08-17T18:22:33.077Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/91/6c0cf8fa143a4988a0361380ac2ef0d7cb98a374704b389fbc38b5891712/zstandard-0.24.0-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:92ea7855d5bcfb386c34557516c73753435fb2d4a014e2c9343b5f5ba148b5d8", size = 5576381, upload-time = "2025-08-17T18:22:35.391Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/77/1526080e22e78871e786ccf3c84bf5cec9ed25110a9585507d3c551da3d6/zstandard-0.24.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3adb4b5414febf074800d264ddf69ecade8c658837a83a19e8ab820e924c9933", size = 4953403, upload-time = "2025-08-17T18:22:37.266Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/d0/a3a833930bff01eab697eb8abeafb0ab068438771fa066558d96d7dafbf9/zstandard-0.24.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:6374feaf347e6b83ec13cc5dcfa70076f06d8f7ecd46cc71d58fac798ff08b76", size = 5267396, upload-time = "2025-08-17T18:22:39.757Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/5e/90a0db9a61cd4769c06374297ecfcbbf66654f74cec89392519deba64d76/zstandard-0.24.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:13fc548e214df08d896ee5f29e1f91ee35db14f733fef8eabea8dca6e451d1e2", size = 5433269, upload-time = "2025-08-17T18:22:42.131Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/58/fc6a71060dd67c26a9c5566e0d7c99248cbe5abfda6b3b65b8f1a28d59f7/zstandard-0.24.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:0a416814608610abf5488889c74e43ffa0343ca6cf43957c6b6ec526212422da", size = 5814203, upload-time = "2025-08-17T18:22:44.017Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/6a/89573d4393e3ecbfa425d9a4e391027f58d7810dec5cdb13a26e4cdeef5c/zstandard-0.24.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:0d66da2649bb0af4471699aeb7a83d6f59ae30236fb9f6b5d20fb618ef6c6777", size = 5359622, upload-time = "2025-08-17T18:22:45.802Z" },
-    { url = "https://files.pythonhosted.org/packages/60/ff/2cbab815d6f02a53a9d8d8703bc727d8408a2e508143ca9af6c3cca2054b/zstandard-0.24.0-cp312-cp312-win32.whl", hash = "sha256:ff19efaa33e7f136fe95f9bbcc90ab7fb60648453b03f95d1de3ab6997de0f32", size = 435968, upload-time = "2025-08-17T18:22:49.493Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/a3/8f96b8ddb7ad12344218fbd0fd2805702dafd126ae9f8a1fb91eef7b33da/zstandard-0.24.0-cp312-cp312-win_amd64.whl", hash = "sha256:bc05f8a875eb651d1cc62e12a4a0e6afa5cd0cc231381adb830d2e9c196ea895", size = 505195, upload-time = "2025-08-17T18:22:47.193Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/4a/bfca20679da63bfc236634ef2e4b1b4254203098b0170e3511fee781351f/zstandard-0.24.0-cp312-cp312-win_arm64.whl", hash = "sha256:b04c94718f7a8ed7cdd01b162b6caa1954b3c9d486f00ecbbd300f149d2b2606", size = 461605, upload-time = "2025-08-17T18:22:48.317Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/ef/db949de3bf81ed122b8ee4db6a8d147a136fe070e1015f5a60d8a3966748/zstandard-0.24.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e4ebb000c0fe24a6d0f3534b6256844d9dbf042fdf003efe5cf40690cf4e0f3e", size = 795700, upload-time = "2025-08-17T18:22:50.851Z" },
-    { url = "https://files.pythonhosted.org/packages/99/56/fc04395d6f5eabd2fe6d86c0800d198969f3038385cb918bfbe94f2b0c62/zstandard-0.24.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:498f88f5109666c19531f0243a90d2fdd2252839cd6c8cc6e9213a3446670fa8", size = 640343, upload-time = "2025-08-17T18:22:51.999Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/0f/0b0e0d55f2f051d5117a0d62f4f9a8741b3647440c0ee1806b7bd47ed5ae/zstandard-0.24.0-cp313-cp313-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:0a9e95ceb180ccd12a8b3437bac7e8a8a089c9094e39522900a8917745542184", size = 5342571, upload-time = "2025-08-17T18:22:53.734Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/43/d74e49f04fbd62d4b5d89aeb7a29d693fc637c60238f820cd5afe6ca8180/zstandard-0.24.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:bcf69e0bcddbf2adcfafc1a7e864edcc204dd8171756d3a8f3340f6f6cc87b7b", size = 5062723, upload-time = "2025-08-17T18:22:55.624Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/97/df14384d4d6a004388e6ed07ded02933b5c7e0833a9150c57d0abc9545b7/zstandard-0.24.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:10e284748a7e7fbe2815ca62a9d6e84497d34cfdd0143fa9e8e208efa808d7c4", size = 5393282, upload-time = "2025-08-17T18:22:57.655Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/09/8f5c520e59a4d41591b30b7568595eda6fd71c08701bb316d15b7ed0613a/zstandard-0.24.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:1bda8a85e5b9d5e73af2e61b23609a8cc1598c1b3b2473969912979205a1ff25", size = 5450895, upload-time = "2025-08-17T18:22:59.749Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/3d/02aba892327a67ead8cba160ee835cfa1fc292a9dcb763639e30c07da58b/zstandard-0.24.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:1b14bc92af065d0534856bf1b30fc48753163ea673da98857ea4932be62079b1", size = 5546353, upload-time = "2025-08-17T18:23:01.457Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/6e/96c52afcde44da6a5313a1f6c356349792079808f12d8b69a7d1d98ef353/zstandard-0.24.0-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:b4f20417a4f511c656762b001ec827500cbee54d1810253c6ca2df2c0a307a5f", size = 5046404, upload-time = "2025-08-17T18:23:03.418Z" },
-    { url = "https://files.pythonhosted.org/packages/da/b6/eefee6b92d341a7db7cd1b3885d42d30476a093720fb5c181e35b236d695/zstandard-0.24.0-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:337572a7340e1d92fd7fb5248c8300d0e91071002d92e0b8cabe8d9ae7b58159", size = 5576095, upload-time = "2025-08-17T18:23:05.331Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/29/743de3131f6239ba6611e17199581e6b5e0f03f268924d42468e29468ca0/zstandard-0.24.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:df4be1cf6e8f0f2bbe2a3eabfff163ef592c84a40e1a20a8d7db7f27cfe08fc2", size = 4953448, upload-time = "2025-08-17T18:23:07.225Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/11/bd36ef49fba82e307d69d93b5abbdcdc47d6a0bcbc7ffbbfe0ef74c2fec5/zstandard-0.24.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:6885ae4b33aee8835dbdb4249d3dfec09af55e705d74d9b660bfb9da51baaa8b", size = 5267388, upload-time = "2025-08-17T18:23:09.127Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/23/a4cfe1b871d3f1ce1f88f5c68d7e922e94be0043f3ae5ed58c11578d1e21/zstandard-0.24.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:663848a8bac4fdbba27feea2926049fdf7b55ec545d5b9aea096ef21e7f0b079", size = 5433383, upload-time = "2025-08-17T18:23:11.343Z" },
-    { url = "https://files.pythonhosted.org/packages/77/26/f3fb85f00e732cca617d4b9cd1ffa6484f613ea07fad872a8bdc3a0ce753/zstandard-0.24.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:05d27c953f2e0a3ecc8edbe91d6827736acc4c04d0479672e0400ccdb23d818c", size = 5813988, upload-time = "2025-08-17T18:23:13.194Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/8c/d7e3b424b73f3ce66e754595cbcb6d94ff49790c9ac37d50e40e8145cd44/zstandard-0.24.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:77b8b7b98893eaf47da03d262816f01f251c2aa059c063ed8a45c50eada123a5", size = 5359756, upload-time = "2025-08-17T18:23:15.021Z" },
-    { url = "https://files.pythonhosted.org/packages/90/6c/f1f0e11f1b295138f9da7e7ae22dcd9a1bb96a9544fa3b31507e431288f5/zstandard-0.24.0-cp313-cp313-win32.whl", hash = "sha256:cf7fbb4e54136e9a03c7ed7691843c4df6d2ecc854a2541f840665f4f2bb2edd", size = 435957, upload-time = "2025-08-17T18:23:18.835Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/03/ab8b82ae5eb49eca4d3662705399c44442666cc1ce45f44f2d263bb1ae31/zstandard-0.24.0-cp313-cp313-win_amd64.whl", hash = "sha256:d64899cc0f33a8f446f1e60bffc21fa88b99f0e8208750d9144ea717610a80ce", size = 505171, upload-time = "2025-08-17T18:23:16.44Z" },
-    { url = "https://files.pythonhosted.org/packages/db/12/89a2ecdea4bc73a934a30b66a7cfac5af352beac94d46cf289e103b65c34/zstandard-0.24.0-cp313-cp313-win_arm64.whl", hash = "sha256:57be3abb4313e0dd625596376bbb607f40059d801d51c1a1da94d7477e63b255", size = 461596, upload-time = "2025-08-17T18:23:17.603Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/56/f3d2c4d64aacee4aab89e788783636884786b6f8334c819f09bff1aa207b/zstandard-0.24.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:b7fa260dd2731afd0dfa47881c30239f422d00faee4b8b341d3e597cface1483", size = 795747, upload-time = "2025-08-17T18:23:19.968Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2d/9d3e5f6627e4cb5e511803788be1feee2f0c3b94594591e92b81db324253/zstandard-0.24.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e05d66239d14a04b4717998b736a25494372b1b2409339b04bf42aa4663bf251", size = 640475, upload-time = "2025-08-17T18:23:21.5Z" },
-    { url = "https://files.pythonhosted.org/packages/be/5d/48e66abf8c146d95330e5385633a8cfdd556fa8bd14856fe721590cbab2b/zstandard-0.24.0-cp314-cp314-manylinux2010_i686.manylinux2014_i686.manylinux_2_12_i686.manylinux_2_17_i686.whl", hash = "sha256:622e1e04bd8a085994e02313ba06fbcf4f9ed9a488c6a77a8dbc0692abab6a38", size = 5343866, upload-time = "2025-08-17T18:23:23.351Z" },
-    { url = "https://files.pythonhosted.org/packages/95/6c/65fe7ba71220a551e082e4a52790487f1d6bb8dfc2156883e088f975ad6d/zstandard-0.24.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:55872e818598319f065e8192ebefecd6ac05f62a43f055ed71884b0a26218f41", size = 5062719, upload-time = "2025-08-17T18:23:25.192Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/68/15ed0a813ff91be80cc2a610ac42e0fc8d29daa737de247bbf4bab9429a1/zstandard-0.24.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:bb2446a55b3a0fd8aa02aa7194bd64740015464a2daaf160d2025204e1d7c282", size = 5393090, upload-time = "2025-08-17T18:23:27.145Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/89/e560427b74fa2da6a12b8f3af8ee29104fe2bb069a25e7d314c35eec7732/zstandard-0.24.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:2825a3951f945fb2613ded0f517d402b1e5a68e87e0ee65f5bd224a8333a9a46", size = 5450383, upload-time = "2025-08-17T18:23:29.044Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/95/0498328cbb1693885509f2fc145402b108b750a87a3af65b7250b10bd896/zstandard-0.24.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:09887301001e7a81a3618156bc1759e48588de24bddfdd5b7a4364da9a8fbc20", size = 5546142, upload-time = "2025-08-17T18:23:31.281Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/8a/64aa15a726594df3bf5d8decfec14fe20cd788c60890f44fcfc74d98c2cc/zstandard-0.24.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:98ca91dc9602cf351497d5600aa66e6d011a38c085a8237b370433fcb53e3409", size = 4953456, upload-time = "2025-08-17T18:23:33.234Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/b6/e94879c5cd6017af57bcba08519ed1228b1ebb15681efd949f4a00199449/zstandard-0.24.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:e69f8e534b4e254f523e2f9d4732cf9c169c327ca1ce0922682aac9a5ee01155", size = 5268287, upload-time = "2025-08-17T18:23:35.145Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/e5/1a3b3a93f953dbe9e77e2a19be146e9cd2af31b67b1419d6cc8e8898d409/zstandard-0.24.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:444633b487a711e34f4bccc46a0c5dfbe1aee82c1a511e58cdc16f6bd66f187c", size = 5433197, upload-time = "2025-08-17T18:23:36.969Z" },
-    { url = "https://files.pythonhosted.org/packages/39/83/b6eb1e1181de994b29804e1e0d2dc677bece4177f588c71653093cb4f6d5/zstandard-0.24.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:f7d3fe9e1483171e9183ffdb1fab07c5fef80a9c3840374a38ec2ab869ebae20", size = 5813161, upload-time = "2025-08-17T18:23:38.812Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/d3/2fb4166561591e9d75e8e35c79182aa9456644e2f4536f29e51216d1c513/zstandard-0.24.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:27b6fa72b57824a3f7901fc9cc4ce1c1c834b28f3a43d1d4254c64c8f11149d4", size = 5359831, upload-time = "2025-08-17T18:23:41.162Z" },
-    { url = "https://files.pythonhosted.org/packages/11/94/6a9227315b774f64a67445f62152c69b4e5e49a52a3c7c4dad8520a55e20/zstandard-0.24.0-cp314-cp314-win32.whl", hash = "sha256:fdc7a52a4cdaf7293e10813fd6a3abc0c7753660db12a3b864ab1fb5a0c60c16", size = 444448, upload-time = "2025-08-17T18:23:45.151Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/de/67acaba311013e0798cb96d1a2685cb6edcdfc1cae378b297ea7b02c319f/zstandard-0.24.0-cp314-cp314-win_amd64.whl", hash = "sha256:656ed895b28c7e42dd5b40dfcea3217cfc166b6b7eef88c3da2f5fc62484035b", size = 516075, upload-time = "2025-08-17T18:23:42.8Z" },
-    { url = "https://files.pythonhosted.org/packages/10/ae/45fd8921263cea0228b20aa31bce47cc66016b2aba1afae1c6adcc3dbb1f/zstandard-0.24.0-cp314-cp314-win_arm64.whl", hash = "sha256:0101f835da7de08375f380192ff75135527e46e3f79bef224e3c49cb640fef6a", size = 476847, upload-time = "2025-08-17T18:23:43.892Z" },
-]

From 40530ced3460c311aca02417c0dc3195c429c02e Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Wed, 10 Dec 2025 08:25:48 -0800
Subject: [PATCH 06/80] Fixing hatch versioning (#139)

* Fixing hatch versioning

* Fixed typo in toml

* Fixing uv lock and testing hatch
---
 pyproject.toml             | 3 ++-
 socketsecurity/__init__.py | 2 +-
 uv.lock                    | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 4d739d2..9d22de8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.48"
+version = "2.2.51"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -165,3 +165,4 @@ include = ["socketsecurity", "LICENSE"]
 dev = [
     "pre-commit>=4.3.0",
 ]
+
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index f334adf..afff87d 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.48'
+__version__ = '2.2.51'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index b37557c..1b64bac 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1254,7 +1254,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.47"
+version = "2.2.50"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 7329f501ff3fbcaf5ddf3e0d2a32c66dec8ccbad Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Thu, 11 Dec 2025 18:27:49 -0800
Subject: [PATCH 07/80] feat: add batched PURL endpoint calls and conditional
 license fetching (#140)

* feat: add batched PURL endpoint calls and conditional license fetching

- Add --max-purl-batch-size flag (default: 5000, range: 1-9999) to control
  batch size for license detail API calls
- Skip PURL endpoint entirely when --generate-license is not set, improving
  performance for scans that don't need license attribution/details
- Implement batching in get_license_text_via_purl() to process packages in
  configurable chunks, preventing API overload on large repos
- Add validation for max_purl_batch_size parameter with clear error messages
- Remove unused check_full_scans_status() method (dead code cleanup)

This change optimizes license data retrieval by:
1. Only calling PURL endpoint when license output is actually needed
2. Processing packages in manageable batches to avoid timeouts/limits
3. Providing tunable batch sizes for different repo sizes

* Fixing --ignore-commit-files to properly work again

* properly included the enable diff param to the main module

* Adding NPM CLI to Dockerfile
---
 Dockerfile                      |   2 +-
 pyproject.toml                  |   2 +-
 socketsecurity/__init__.py      |   2 +-
 socketsecurity/config.py        |  15 ++++
 socketsecurity/core/__init__.py | 126 ++++++++++++++------------------
 socketsecurity/socketcli.py     |  41 +++++++----
 6 files changed, 99 insertions(+), 89 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index a5ef959..4f31e10 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -57,7 +57,7 @@ RUN if [ "$DOTNET_VERSION" = "6" ]; then \
     fi
 
 # Install additional tools
-RUN npm install @coana-tech/cli -g && \
+RUN npm install @coana-tech/cli socket -g && \
     gem install bundler && \
     curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && \
     . ~/.cargo/env && \
diff --git a/pyproject.toml b/pyproject.toml
index 9d22de8..12fa227 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.51"
+version = "2.2.55"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index afff87d..0feb3be 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.51'
+__version__ = '2.2.55'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 28aa39b..8ebda71 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -78,6 +78,7 @@ class CliConfig:
     reach_additional_params: Optional[List[str]] = None
     only_facts_file: bool = False
     reach_use_only_pregenerated_sboms: bool = False
+    max_purl_batch_size: int = 5000
     
     @classmethod
     def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
@@ -106,6 +107,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'commit_sha': args.commit_sha,
             'generate_license': args.generate_license,
             'enable_debug': args.enable_debug,
+            'enable_diff': args.enable_diff,
             'allow_unverified': args.allow_unverified,
             'enable_json': args.enable_json,
             'enable_sarif': args.enable_sarif,
@@ -141,6 +143,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_additional_params': args.reach_additional_params,
             'only_facts_file': args.only_facts_file,
             'reach_use_only_pregenerated_sboms': args.reach_use_only_pregenerated_sboms,
+            'max_purl_batch_size': args.max_purl_batch_size,
             'version': __version__
         }
         try:
@@ -187,6 +190,11 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--reach-concurrency must be >= 1")
             exit(1)
 
+        # Validate max_purl_batch_size is within allowed range
+        if args.max_purl_batch_size < 1 or args.max_purl_batch_size > 9999:
+            logging.error("--max-purl-batch-size must be between 1 and 9999")
+            exit(1)
+
         return cls(**config_args)
 
     def to_dict(self) -> dict:
@@ -446,6 +454,13 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Exclude license details from the diff report (boosts performance for large repos)"
     )
+    output_group.add_argument(
+        "--max-purl-batch-size",
+        dest="max_purl_batch_size",
+        type=int,
+        default=5000,
+        help="Maximum batch size for PURL endpoint calls when generating license info (default: 5000, min: 1, max: 9999)"
+    )
 
     output_group.add_argument(
         "--disable-security-issue",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 2a2987c..a76a794 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -659,54 +659,6 @@ def create_full_scan_with_report_url(
         # Return result in the format expected by the user
         return diff
 
-    def check_full_scans_status(self, head_full_scan_id: str, new_full_scan_id: str) -> bool:
-        is_ready = False
-        current_timeout = self.config.timeout
-        self.sdk.set_timeout(0.5)
-        try:
-            self.sdk.fullscans.stream(self.config.org_slug, head_full_scan_id)
-        except Exception:
-            log.debug(f"Queued up full scan for processing ({head_full_scan_id})")
-
-        try:
-            self.sdk.fullscans.stream(self.config.org_slug, new_full_scan_id)
-        except Exception:
-            log.debug(f"Queued up full scan for processing ({new_full_scan_id})")
-        self.sdk.set_timeout(current_timeout)
-        start_check = time.time()
-        head_is_ready = False
-        new_is_ready = False
-        while not is_ready:
-            head_full_scan_metadata = self.sdk.fullscans.metadata(self.config.org_slug, head_full_scan_id)
-            if head_full_scan_metadata:
-                head_state = head_full_scan_metadata.get("scan_state")
-            else:
-                head_state = None
-            new_full_scan_metadata = self.sdk.fullscans.metadata(self.config.org_slug, new_full_scan_id)
-            if new_full_scan_metadata:
-                new_state = new_full_scan_metadata.get("scan_state")
-            else:
-                new_state = None
-            if head_state and head_state == "resolve":
-                head_is_ready = True
-            if new_state and new_state == "resolve":
-                new_is_ready = True
-            if head_is_ready and new_is_ready:
-                is_ready = True
-            current_time = time.time()
-            if current_time - start_check >= self.config.timeout:
-                log.debug(
-                    f"Timeout reached while waiting for full scans to be ready "
-                    f"({head_full_scan_id}, {new_full_scan_id})"
-                )
-                break
-        total_time = time.time() - start_check
-        if is_ready:
-            log.info(f"Full scans are ready in {total_time:.2f} seconds")
-        else:
-            log.warning(f"Full scans are not ready yet ({head_full_scan_id}, {new_full_scan_id})")
-        return is_ready
-
     def get_full_scan(self, full_scan_id: str) -> FullScan:
         """
         Get a FullScan object for an existing full scan including sbom_artifacts and packages.
@@ -846,28 +798,54 @@ def update_package_values(pkg: Package) -> Package:
         pkg.url += f"/{pkg.name}/overview/{pkg.version}"
         return pkg
 
-    def get_license_text_via_purl(self, packages: dict[str, Package]) -> dict:
-        components = []
+    def get_license_text_via_purl(self, packages: dict[str, Package], batch_size: int = 5000) -> dict:
+        """Get license attribution and details via PURL endpoint in batches.
+        
+        Args:
+            packages: Dictionary of packages to get license info for
+            batch_size: Maximum number of packages to process per API call (1-9999)
+            
+        Returns:
+            Updated packages dictionary with licenseAttrib and licenseDetails populated
+        """
+        # Validate batch size
+        batch_size = max(1, min(9999, batch_size))
+        
+        # Build list of all components
+        all_components = []
         for purl in packages:
             full_purl = f"pkg:/{purl}"
-            components.append({"purl": full_purl})
-        results = self.sdk.purl.post(
-            license=True,
-            components=components,
-            licenseattrib=True,
-            licensedetails=True
-        )
-        purl_packages = []
-        for result in results:
-            ecosystem = result["type"]
-            name = result["name"]
-            package_version = result["version"]
-            licenseDetails = result.get("licenseDetails")
-            licenseAttrib = result.get("licenseAttrib")
-            purl = f"{ecosystem}/{name}@{package_version}"
-            if purl not in purl_packages and purl in packages:
-                packages[purl].licenseAttrib = licenseAttrib
-                packages[purl].licenseDetails = licenseDetails
+            all_components.append({"purl": full_purl})
+        
+        # Process in batches
+        total_components = len(all_components)
+        log.debug(f"Processing {total_components} packages in batches of {batch_size}")
+        
+        for i in range(0, total_components, batch_size):
+            batch_components = all_components[i:i + batch_size]
+            batch_num = (i // batch_size) + 1
+            total_batches = (total_components + batch_size - 1) // batch_size
+            log.debug(f"Processing batch {batch_num}/{total_batches} ({len(batch_components)} packages)")
+            
+            results = self.sdk.purl.post(
+                license=True,
+                components=batch_components,
+                licenseattrib=True,
+                licensedetails=True
+            )
+            
+            purl_packages = []
+            for result in results:
+                ecosystem = result["type"]
+                name = result["name"]
+                package_version = result["version"]
+                licenseDetails = result.get("licenseDetails")
+                licenseAttrib = result.get("licenseAttrib")
+                purl = f"{ecosystem}/{name}@{package_version}"
+                if purl not in purl_packages and purl in packages:
+                    packages[purl].licenseAttrib = licenseAttrib
+                    packages[purl].licenseDetails = licenseDetails
+        
         return packages
 
     def get_added_and_removed_packages(
@@ -960,7 +938,14 @@ def get_added_and_removed_packages(
                 log.error(f"Artifact details - name: {artifact.name}, version: {artifact.version}")
                 log.error("No matching packages found in head_full_scan")
 
-        packages = self.get_license_text_via_purl(packages)
+        # Only fetch license details if generate_license is enabled
+        if self.cli_config and self.cli_config.generate_license:
+            log.debug("Fetching license details via PURL endpoint")
+            batch_size = self.cli_config.max_purl_batch_size if self.cli_config else 5000
+            packages = self.get_license_text_via_purl(packages, batch_size=batch_size)
+        else:
+            log.debug("Skipping PURL endpoint call (--generate-license not set)")
+        
         return added_packages, removed_packages, packages
 
     def create_new_diff(
@@ -1092,9 +1077,6 @@ def create_new_diff(
                     log.warning(f"Failed to clean up temporary file {temp_file}: {e}")
 
         # Handle diff generation - now we always have both scans
-        scans_ready = self.check_full_scans_status(head_full_scan_id, new_full_scan.id)
-        if scans_ready is False:
-            log.error(f"Full scans did not complete within {self.config.timeout} seconds")
         (
             added_packages,
             removed_packages,
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 00b64a7..644a967 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -356,6 +356,7 @@ def main_code():
     # Determine files to check based on the new logic
     files_to_check = []
     force_api_mode = False
+    force_diff_mode = False
     
     if files_explicitly_specified:
         # Case 2: Files are specified - use them and don't check commit details
@@ -365,10 +366,21 @@ def main_code():
         # Case 1: Files not specified and --ignore-commit-files not set - try to find changed files from commit
         files_to_check = git_repo.changed_files
         log.debug(f"Using changed files from commit: {files_to_check}")
+    elif config.ignore_commit_files and is_repo:
+        # Case 3: Git repo with --ignore-commit-files - force diff mode
+        files_to_check = []
+        force_diff_mode = True
+        log.debug("Git repo with --ignore-commit-files: forcing diff mode")
     else:
-        # ignore_commit_files is set or not a repo - scan everything but force API mode if no supported files
+        # Case 4: Not a git repo (ignore_commit_files was auto-set to True)
         files_to_check = []
-        log.debug("No files to check from commit (ignore_commit_files=True or not a repo)")
+        # If --enable-diff is set, force diff mode for non-git repos
+        log.debug(f"Case 4: Non-git repo - config.enable_diff={config.enable_diff}, type={type(config.enable_diff)}")
+        if config.enable_diff:
+            force_diff_mode = True
+            log.debug("Non-git repo with --enable-diff: forcing diff mode")
+        else:
+            log.debug("Non-git repo without --enable-diff: will use full scan mode")
 
     # Check if we have supported manifest files
     has_supported_files = files_to_check and core.has_manifest_files(files_to_check)
@@ -389,22 +401,21 @@ def main_code():
             has_supported_files = False
     
     # Case 3: If no supported files or files are empty, force API mode (no PR comments)
-    if not has_supported_files:
+    # BUT: Don't force API mode if we're in force_diff_mode
+    log.debug(f"files_to_check={files_to_check}, has_supported_files={has_supported_files}, force_diff_mode={force_diff_mode}, config.enable_diff={config.enable_diff}")
+    if not has_supported_files and not force_diff_mode:
         force_api_mode = True
         log.debug("No supported manifest files found, forcing API mode")
+    log.debug(f"force_api_mode={force_api_mode}")
     
     # Determine scan behavior
     should_skip_scan = False  # Always perform scan, but behavior changes based on supported files
-    if config.ignore_commit_files and not files_explicitly_specified:
-        # Force full scan when ignoring commit files and no explicit files
-        should_skip_scan = False
-        log.debug("Forcing full scan due to ignore_commit_files")
-    elif not has_supported_files:
-        # No supported files - still scan but in API mode
+    if not has_supported_files and not force_diff_mode:
+        # No supported files and not forcing diff - still scan but in API mode
         should_skip_scan = False
         log.debug("No supported files but will scan in API mode")
     else:
-        log.debug("Found supported manifest files, proceeding with normal scan")
+        log.debug("Found supported manifest files or forcing diff mode, proceeding with normal scan")
 
     org_slug = core.config.org_slug
     if config.repo_is_public:
@@ -457,6 +468,7 @@ def main_code():
     diff.report_url = ""
 
     # Handle SCM-specific flows
+    log.debug(f"Flow decision: scm={scm is not None}, force_diff_mode={force_diff_mode}, force_api_mode={force_api_mode}, enable_diff={config.enable_diff}")
     if scm is not None and scm.check_event_type() == "comment":
         # FIXME: This entire flow should be a separate command called "filter_ignored_alerts_in_comments"
         # It's not related to scanning or diff generation - it just:
@@ -531,14 +543,15 @@ def main_code():
 
         output_handler.handle_output(diff)
 
-    elif config.enable_diff and not force_api_mode:
-        # New logic: --enable-diff forces diff mode even with --integration api (no SCM)
+    elif (config.enable_diff or force_diff_mode) and not force_api_mode:
+        # New logic: --enable-diff or force_diff_mode (from --ignore-commit-files in git repos) forces diff mode
         log.info("Diff mode enabled without SCM integration")
         diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
         output_handler.handle_output(diff)
     
-    elif config.enable_diff and force_api_mode:
-        # User requested diff mode but no manifest files were detected
+    elif (config.enable_diff or force_diff_mode) and force_api_mode:
+        # User requested diff mode but no manifest files were detected - this should not happen with new logic
+        # but keeping as a safety net
         log.warning("--enable-diff was specified but no supported manifest files were detected in the changed files. Falling back to full scan mode.")
         log.info("Creating Socket Report (full scan)")
         serializable_params = {

From 30574b87c8a69eaf62317fccdda2040d93e5283f Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 18 Dec 2025 11:02:58 +0100
Subject: [PATCH 08/80] remove process timeout from reachability analysis
 (#141)

* remove process timeout from reachability analysis

* Fixing version for build

---------

Co-authored-by: Douglas Coburn <douglas@dactbc.com>
---
 CHANGELOG.md                              | 5 +++++
 README.md                                 | 1 +
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 4 ----
 5 files changed, 8 insertions(+), 6 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..382c886
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,5 @@
+# Changelog
+
+## 2.2.56
+
+- Removed process timeout from reachability analysis subprocess. Timeouts are now only passed to the Coana CLI via the `--analysis-timeout` flag.
diff --git a/README.md b/README.md
index 6dd5d1b..ab489ee 100644
--- a/README.md
+++ b/README.md
@@ -527,3 +527,4 @@ pre-commit install
 ```
 
 > **Note**: This manual setup is an alternative to the streamlined Make targets described above. For most development workflows, using `make first-time-setup` or `make first-time-local-setup` is recommended.
+
diff --git a/pyproject.toml b/pyproject.toml
index 12fa227..8ef524c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.55"
+version = "2.2.56"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 0feb3be..b9372d7 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.55'
+__version__ = '2.2.56'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 2ac3e6c..f757a17 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -220,7 +220,6 @@ def run_reachability_analysis(
                 cwd=target_directory,
                 stdout=sys.stderr,  # Send stdout to stderr so user sees it
                 stderr=sys.stderr,  # Send stderr to stderr
-                timeout=timeout + 60 if timeout else None  # Add buffer to subprocess timeout
             )
             
             if result.returncode != 0:
@@ -240,9 +239,6 @@ def run_reachability_analysis(
                 "tar_hash_used": tar_hash
             }
         
-        except subprocess.TimeoutExpired:
-            log.error(f"Reachability analysis timed out after {timeout} seconds")
-            raise Exception(f"Reachability analysis timed out after {timeout} seconds")
         except Exception as e:
             log.error(f"Failed to run reachability analysis: {str(e)}")
             raise Exception(f"Failed to run reachability analysis: {str(e)}")

From e10dd4ed1087354ac1954cb0c0acdbe683206f8d Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 18 Dec 2025 18:42:14 +0100
Subject: [PATCH 09/80] fix GOROOT when go is installed via apk

---
 CHANGELOG.md                 | 4 ++++
 Dockerfile                   | 9 +++++----
 pyproject.toml               | 2 +-
 scripts/docker-entrypoint.sh | 3 +++
 socketsecurity/__init__.py   | 2 +-
 5 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 382c886..604c602 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.57
+
+- Fixed Dockerfile to set `GOROOT` to `/usr/lib/go` when using system Go (`GO_VERSION=system`) instead of always using `/usr/local/go`.
+
 ## 2.2.56
 
 - Removed process timeout from reachability analysis subprocess. Timeouts are now only passed to the Coana CLI via the `--analysis-timeout` flag.
diff --git a/Dockerfile b/Dockerfile
index 4f31e10..c4d483a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,8 @@ RUN apk update && apk add --no-cache \
 
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
-        apk add --no-cache go; \
+        apk add --no-cache go && \
+        echo "/usr/lib/go" > /etc/goroot; \
     else \
         cd /tmp && \
         ARCH=$(uname -m) && \
@@ -31,7 +32,8 @@ RUN if [ "$GO_VERSION" = "system" ]; then \
         esac && \
         wget https://golang.org/dl/go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
         tar -C /usr/local -xzf go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
-        rm go${GO_VERSION}.linux-${GOARCH}.tar.gz; \
+        rm go${GO_VERSION}.linux-${GOARCH}.tar.gz && \
+        echo "/usr/local/go" > /etc/goroot; \
     fi
 
 # Install Java with version control
@@ -64,8 +66,7 @@ RUN npm install @coana-tech/cli socket -g && \
     rustup component add rustfmt clippy
 
 # Set environment paths
-ENV PATH="/usr/local/go/bin:/root/.cargo/bin:${PATH}"
-ENV GOROOT="/usr/local/go"
+ENV PATH="/usr/local/go/bin:/usr/lib/go/bin:/root/.cargo/bin:${PATH}"
 ENV GOPATH="/go"
 
 # Install uv
diff --git a/pyproject.toml b/pyproject.toml
index 8ef524c..e2f22b0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.56"
+version = "2.2.57"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/scripts/docker-entrypoint.sh b/scripts/docker-entrypoint.sh
index e190c6d..2679340 100755
--- a/scripts/docker-entrypoint.sh
+++ b/scripts/docker-entrypoint.sh
@@ -4,6 +4,9 @@
 # docker run socketdev/cli socketcli --params
 # docker run socketdev/cli --cli-params
 
+# Set GOROOT from the value determined at build time
+export GOROOT=$(cat /etc/goroot)
+
 # Check if we have any arguments
 if [ $# -eq 0 ]; then
     # No arguments provided, run socketcli with no args (will show help)
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index b9372d7..798b847 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.56'
+__version__ = '2.2.57'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

From 0b7f49a4a158e160378e8daf3f03f37e64fa57af Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Tue, 23 Dec 2025 19:17:42 -0800
Subject: [PATCH 10/80] =?UTF-8?q?Fixed=20globbing=20for=20files=20that=20w?=
 =?UTF-8?q?ere=20unintentionally=20filtering=20out=20path=E2=80=A6=20(#143?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fixed globbing for files that were unintentionally filtering out paths that started with a dot

* Removed unused imports
---
 pyproject.toml                  |  2 +-
 socketsecurity/__init__.py      |  2 +-
 socketsecurity/core/__init__.py | 27 ++++++++++++++++-----------
 3 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index e2f22b0..238cf5f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.57"
+version = "2.2.59"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 798b847..53c3012 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.57'
+__version__ = '2.2.59'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index a76a794..9da7915 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -4,13 +4,10 @@
 import tarfile
 import tempfile
 import time
-import io
 import json
 from dataclasses import asdict
-from glob import glob
-from io import BytesIO
-from pathlib import PurePath
-from typing import BinaryIO, Dict, List, Tuple, Set, Union, TYPE_CHECKING, Optional
+from pathlib import Path, PurePath
+from typing import Dict, List, Tuple, Set, TYPE_CHECKING, Optional
 
 if TYPE_CHECKING:
     from socketsecurity.config import CliConfig
@@ -315,15 +312,18 @@ def find_files(self, path: str, ecosystems: Optional[List[str]] = None) -> List[
 
                 for pattern in expanded_patterns:
                     case_insensitive_pattern = Core.to_case_insensitive_regex(pattern)
-                    file_path = os.path.join(path, "**", case_insensitive_pattern)
-
-                    log.debug(f"Globbing {file_path}")
+                    
+                    log.debug(f"Searching for pattern: {case_insensitive_pattern}")
                     glob_start = time.time()
-                    glob_files = glob(file_path, recursive=True)
+                    
+                    # Use pathlib.Path.rglob() instead of glob.glob() to properly match dotfiles/dotdirs
+                    base_path = Path(path)
+                    glob_files = base_path.rglob(case_insensitive_pattern)
 
                     for glob_file in glob_files:
-                        if os.path.isfile(glob_file) and not Core.is_excluded(glob_file, self.config.excluded_dirs):
-                            files.add(glob_file.replace("\\", "/"))
+                        glob_file_str = str(glob_file)
+                        if os.path.isfile(glob_file_str) and not Core.is_excluded(glob_file_str, self.config.excluded_dirs):
+                            files.add(glob_file_str.replace("\\", "/"))
 
                     glob_end = time.time()
                     log.debug(f"Globbing took {glob_end - glob_start:.4f} seconds")
@@ -414,6 +414,11 @@ def has_manifest_files(self, files: list) -> bool:
                 # Expand brace patterns for each manifest pattern
                 expanded_patterns = Core.expand_brace_pattern(pattern_str)
                 for exp_pat in expanded_patterns:
+                    # If pattern doesn't contain '/', prepend '**/' to match files in any subdirectory
+                    # This ensures patterns like '*requirements.txt' match '.test/requirements.txt'
+                    if '/' not in exp_pat:
+                        exp_pat = f"**/{exp_pat}"
+                    
                     for file in norm_files:
                         # Use PurePath.match for glob-like matching
                         if PurePath(file).match(exp_pat):

From 13b8fe596aa2f4d3860796997fde31058730b86b Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Fri, 2 Jan 2026 07:19:18 -0800
Subject: [PATCH 11/80] feat: add Slack formatter for Socket Facts reachability
 analysis (#144)

- Add new markdown utility for Socket Facts data formatting
- Add `socketsecurity/core/helper/socket_facts_loader.py` to load Socket Facts JSON
- Add `socketsecurity/plugins/formatters/slack.py` for Slack-specific formatting
- Update Slack plugin to support reachability analysis notifications with smart block limiting
- Add markdown dependency for enhanced formatting capabilities
- Update README documentation
- Update socketdev dependency to 3.0.25
- Bump version to 2.2.59
---
 README.md                                     |  45 +-
 pyproject.toml                                |   5 +-
 socketsecurity/__init__.py                    |   2 +-
 socketsecurity/config.py                      |  32 +-
 .../core/helper/socket_facts_loader.py        | 387 ++++++++++++
 socketsecurity/plugins/formatters/__init__.py |   5 +
 socketsecurity/plugins/formatters/slack.py    | 272 +++++++++
 socketsecurity/plugins/slack.py               | 434 +++++++++++++-
 socketsecurity/socketcli.py                   |   6 +-
 uv.lock                                       | 559 +++++++++---------
 10 files changed, 1435 insertions(+), 312 deletions(-)
 create mode 100644 socketsecurity/core/helper/socket_facts_loader.py
 create mode 100644 socketsecurity/plugins/formatters/__init__.py
 create mode 100644 socketsecurity/plugins/formatters/slack.py

diff --git a/README.md b/README.md
index ab489ee..dacc8a9 100644
--- a/README.md
+++ b/README.md
@@ -101,14 +101,14 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--repo-is-public] [--branc
           [--only-facts-file] [--version]
 ````
 
-If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_KEY`
+If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_TOKEN`
 
 ### Parameters
 
 #### Authentication
-| Parameter   | Required | Default | Description                                                                     |
-|:------------|:---------|:--------|:--------------------------------------------------------------------------------|
-| --api-token | False    |         | Socket Security API token (can also be set via SOCKET_SECURITY_API_KEY env var) |
+| Parameter   | Required | Default | Description                                                                       |
+|:------------|:---------|:--------|:----------------------------------------------------------------------------------|
+| --api-token | False    |         | Socket Security API token (can also be set via SOCKET_SECURITY_API_TOKEN env var) |
 
 #### Repository
 | Parameter        | Required | Default | Description                                                             |
@@ -221,15 +221,43 @@ Example `SOCKET_JIRA_CONFIG_JSON` value
 
 | Environment Variable     | Required | Default | Description                        |
 |:-------------------------|:---------|:--------|:-----------------------------------|
-| SOCKET_SLACK_ENABLED     | False    | false   | Enables/Disables the Slack Plugin  |
-| SOCKET_SLACK_CONFIG_JSON | True     | None    | Required if the Plugin is enabled. |
+| SOCKET_SLACK_CONFIG_JSON | False    | None    | Slack webhook configuration (enables plugin when set). Alternatively, use --slack-webhook CLI flag. |
 
-Example `SOCKET_SLACK_CONFIG_JSON` value
+Example `SOCKET_SLACK_CONFIG_JSON` value (simple webhook):
 
 ````json
 {"url": "https://REPLACE_ME_WEBHOOK"}
 ````
 
+Example with advanced filtering (reachability-only alerts):
+
+````json
+{
+  "url": [
+    {
+      "name": "prod_alerts",
+      "url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+    }
+  ],
+  "url_configs": {
+    "prod_alerts": {
+      "reachability_alerts_only": true,
+      "always_send_reachability": true
+    }
+  }
+}
+````
+
+**Advanced Configuration Options:**
+
+The `url_configs` object allows per-webhook filtering:
+
+- `reachability_alerts_only` (boolean, default: false): When `--reach` is enabled, only send blocking alerts (error=true) from diff scans
+- `always_send_reachability` (boolean, default: true): Send reachability alerts even on non-diff scans when `--reach` is enabled. Set to false to only send reachability alerts when there are diff alerts.
+- `repos` (array): Only send alerts for specific repositories (e.g., `["owner/repo1", "owner/repo2"]`)
+- `alert_types` (array): Only send specific alert types (e.g., `["malware", "typosquat"]`)
+- `severities` (array): Only send alerts with specific severities (e.g., `["high", "critical"]`)
+
 ## Automatic Git Detection
 
 The CLI now automatically detects repository information from your git environment, significantly simplifying usage in CI/CD pipelines:
@@ -490,7 +518,8 @@ Implementation targets:
 ### Environment Variables
 
 #### Core Configuration
-- `SOCKET_SECURITY_API_KEY`: Socket Security API token (alternative to --api-token parameter)
+- `SOCKET_SECURITY_API_TOKEN`: Socket Security API token (alternative to --api-token parameter)
+  - For backwards compatibility, also accepts: `SOCKET_SECURITY_API_KEY`, `SOCKET_API_KEY`, `SOCKET_API_TOKEN`
 - `SOCKET_SDK_PATH`: Path to local socketdev repository (default: ../socketdev)
 
 #### GitLab Integration
diff --git a/pyproject.toml b/pyproject.toml
index 238cf5f..d906dc6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.59"
+version = "2.2.60"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,8 +16,9 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    'socketdev>=3.0.22,<4.0.0',
+    "socketdev>=3.0.25,<4.0.0",
     "bs4>=0.0.2",
+    "markdown>=3.10",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 53c3012..b4aba6c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.59'
+__version__ = '2.2.60'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 8ebda71..b32a3d2 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -57,6 +57,7 @@ class CliConfig:
     version: str = __version__
     jira_plugin: PluginConfig = field(default_factory=PluginConfig)
     slack_plugin: PluginConfig = field(default_factory=PluginConfig)
+    slack_webhook: Optional[str] = None
     license_file_name: str = "license_output.json"
     save_submitted_files_list: Optional[str] = None
     save_manifest_tar: Optional[str] = None
@@ -85,8 +86,14 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
         parser = create_argument_parser()
         args = parser.parse_args(args_list)
 
-        # Get API token from env or args
-        api_token = os.getenv("SOCKET_SECURITY_API_KEY") or args.api_token
+        # Get API token from env or args (check multiple env var names)
+        api_token = (
+            os.getenv("SOCKET_SECURITY_API_KEY") or
+            os.getenv("SOCKET_SECURITY_API_TOKEN") or
+            os.getenv("SOCKET_API_KEY") or
+            os.getenv("SOCKET_API_TOKEN") or
+            args.api_token
+        )
 
         # Strip quotes from commit message if present
         commit_message = args.commit_message
@@ -128,6 +135,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'save_manifest_tar': args.save_manifest_tar,
             'sub_paths': args.sub_paths or [],
             'workspace_name': args.workspace_name,
+            'slack_webhook': args.slack_webhook,
             'reach': args.reach,
             'reach_version': args.reach_version,
             'reach_analysis_timeout': args.reach_analysis_timeout,
@@ -151,6 +159,11 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
         except json.JSONDecodeError:
             logging.error(f"Unable to parse excluded_ecosystems: {config_args['excluded_ecosystems']}")
             exit(1)
+        # Build Slack plugin config, merging CLI arg with env config
+        slack_config = get_plugin_config_from_env("SOCKET_SLACK")
+        if args.slack_webhook:
+            slack_config["url"] = args.slack_webhook
+            
         config_args.update({
             "jira_plugin": PluginConfig(
                 enabled=os.getenv("SOCKET_JIRA_ENABLED", "false").lower() == "true",
@@ -158,9 +171,9 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
                 config=get_plugin_config_from_env("SOCKET_JIRA")
             ),
             "slack_plugin": PluginConfig(
-                enabled=os.getenv("SOCKET_SLACK_ENABLED", "false").lower() == "true",
+                enabled=bool(slack_config) or bool(args.slack_webhook),
                 levels=os.getenv("SOCKET_SLACK_LEVELS", "block,warn").split(","),
-                config=get_plugin_config_from_env("SOCKET_SLACK")
+                config=slack_config
             )
         })
 
@@ -212,7 +225,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--api-token",
         dest="api_token",
         metavar="<token>",
-        help="Socket Security API token (can also be set via SOCKET_SECURITY_API_KEY env var)",
+        help="Socket Security API token (can also be set via SOCKET_SECURITY_API_TOKEN env var)",
         required=False
     )
     auth_group.add_argument(
@@ -475,6 +488,15 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help=argparse.SUPPRESS
     )
 
+    # Plugin Configuration
+    plugin_group = parser.add_argument_group('Plugin Configuration')
+    plugin_group.add_argument(
+        "--slack-webhook",
+        dest="slack_webhook",
+        metavar="<url>",
+        help="Slack webhook URL for notifications (automatically enables Slack plugin)"
+    )
+
     # Advanced Configuration
     advanced_group = parser.add_argument_group('Advanced Configuration')
     advanced_group.add_argument(
diff --git a/socketsecurity/core/helper/socket_facts_loader.py b/socketsecurity/core/helper/socket_facts_loader.py
new file mode 100644
index 0000000..fd93b9d
--- /dev/null
+++ b/socketsecurity/core/helper/socket_facts_loader.py
@@ -0,0 +1,387 @@
+"""Helper module for loading and processing .socket.facts.json files."""
+
+import json
+import logging
+from pathlib import Path
+from typing import Dict, Any, Optional, List
+from copy import deepcopy
+
+logger = logging.getLogger(__name__)
+
+
+def load_socket_facts(file_path: str = ".socket.facts.json") -> Optional[Dict[str, Any]]:
+    """
+    Load a .socket.facts.json file into a dictionary.
+    
+    The .socket.facts.json file is generated by the Socket CLI reachability analysis
+    and contains component dependency information, vulnerability data, and 
+    reachability analysis results.
+    
+    Args:
+        file_path: Path to the .socket.facts.json file. Defaults to ".socket.facts.json"
+                  in the current directory.
+    
+    Returns:
+        Dict containing the parsed JSON data with keys like:
+        - components: List of dependency components with vulnerabilities and reachability info
+        - tier1ReachabilityScanId: The scan ID for this reachability analysis
+        
+        Returns None if the file doesn't exist or cannot be parsed.
+    
+    Example structure:
+        {
+            "components": [
+                {
+                    "id": "12345",
+                    "type": "npm",
+                    "name": "package-name",
+                    "version": "1.0.0",
+                    "namespace": "@scope",
+                    "direct": false,
+                    "dev": true,
+                    "vulnerabilities": [...],
+                    "reachability": [...],
+                    ...
+                }
+            ],
+            "tier1ReachabilityScanId": "scan-id-here"
+        }
+    """
+    facts_path = Path(file_path)
+    
+    if not facts_path.exists():
+        logger.warning(f"Socket facts file not found: {file_path}")
+        return None
+    
+    try:
+        with facts_path.open('r', encoding='utf-8') as f:
+            data = json.load(f)
+        
+        logger.debug(f"Successfully loaded socket facts from {file_path}")
+        
+        # Validate expected structure
+        if not isinstance(data, dict):
+            logger.warning(f"Socket facts file has unexpected format: expected dict, got {type(data)}")
+            return None
+        
+        if 'components' not in data:
+            logger.warning(f"Socket facts file missing 'components' key")
+        
+        return data
+    
+    except json.JSONDecodeError as e:
+        logger.error(f"Failed to parse JSON from {file_path}: {e}")
+        return None
+    except IOError as e:
+        logger.error(f"Failed to read {file_path}: {e}")
+        return None
+    except Exception as e:
+        logger.error(f"Unexpected error loading socket facts from {file_path}: {e}")
+        return None
+
+
+def get_components_with_vulnerabilities(facts_data: Dict[str, Any]) -> list:
+    """
+    Extract components that have vulnerabilities from socket facts data.
+    
+    Note: The .socket.facts.json file contains 'vulnerabilities' and 'reachability'
+    data separately. This function returns components that have vulnerabilities defined.
+    
+    Args:
+        facts_data: Dictionary loaded from .socket.facts.json
+    
+    Returns:
+        List of component dictionaries that have vulnerabilities
+    """
+    if not facts_data or 'components' not in facts_data:
+        return []
+    
+    components = facts_data.get('components', [])
+    components_with_vulns = [
+        comp for comp in components 
+        if comp.get('vulnerabilities') and len(comp.get('vulnerabilities', [])) > 0
+    ]
+    
+    return components_with_vulns
+
+
+def get_scan_id(facts_data: Dict[str, Any]) -> Optional[str]:
+    """
+    Extract the tier1ReachabilityScanId from socket facts data.
+    
+    Args:
+        facts_data: Dictionary loaded from .socket.facts.json
+    
+    Returns:
+        The scan ID string if present, None otherwise
+    """
+    if not facts_data:
+        return None
+    
+    scan_id = facts_data.get('tier1ReachabilityScanId')
+    return scan_id.strip() if scan_id else None
+
+
+def _make_purl(component: Dict[str, Any]) -> str:
+    """Construct a package URL (purl) from a component entry."""
+    pkg_type = component.get('type', '')
+    namespace = component.get('namespace', '')
+    name = component.get('name') or component.get('id', '')
+    version = component.get('version', '')
+    
+    if not name:
+        return ''
+    
+    if namespace:
+        # Percent-encode @ in namespace for purl spec compliance
+        ns_encoded = namespace.replace('@', '%40')
+        purl = f"pkg:{pkg_type}/{ns_encoded}/{name}"
+    else:
+        purl = f"pkg:{pkg_type}/{name}"
+    
+    if version:
+        purl = f"{purl}@{version}"
+    
+    return purl
+
+
+def _determine_reachability(vulnerability: Dict[str, Any], component: Dict[str, Any]) -> Dict[str, Any]:
+    """
+    Determine the reachability state for a vulnerability on a component.
+    
+    Args:
+        vulnerability: Vulnerability dict from component's vulnerabilities array
+        component: Component dict containing reachability data
+    
+    Returns:
+        Dict with keys:
+        - type: 'reachable', 'unreachable', 'unknown', 'error', or 'not_applicable'
+        - undeterminableReachability: bool
+        - trace: list of formatted trace strings
+    """
+    result = {
+        'type': 'unknown',
+        'undeterminableReachability': False,
+        'trace': []
+    }
+    
+    vuln_id = vulnerability.get('ghsaId') or vulnerability.get('cveId')
+    if not vuln_id:
+        return result
+    
+    # Check for undeterminable reachability in the vulnerability data
+    reach_data = vulnerability.get('reachabilityData') or {}
+    if reach_data.get('undeterminableReachability'):
+        result['undeterminableReachability'] = True
+        result['type'] = 'unknown'
+    
+    # Find matching reachability entry in component
+    reachability_list = component.get('reachability', [])
+    matched_reach = None
+    
+    for reach_entry in reachability_list:
+        if reach_entry.get('ghsa_id') == vuln_id:
+            matched_reach = reach_entry
+            break
+    
+    if not matched_reach:
+        # No reachability data found for this vulnerability
+        if result['undeterminableReachability']:
+            return result
+        # Check if this vulnerability applies to this component version
+        if 'reachabilityData' in vulnerability:
+            # Has reachability data structure but no match - might not apply
+            result['type'] = 'not_applicable'
+        return result
+    
+    # Process reachability matches
+    reach_items = matched_reach.get('reachability', [])
+    if not reach_items:
+        return result
+    
+    # Take the first reachability entry (usually most relevant)
+    reach_info = reach_items[0]
+    reach_type = reach_info.get('type', 'unknown')
+    result['type'] = reach_type
+    
+    # Build trace for reachable vulnerabilities
+    if reach_type == 'reachable':
+        matches = reach_info.get('matches', [])
+        for match_group in matches:
+            if not match_group:
+                continue
+            
+            for i, frame in enumerate(match_group):
+                pkg = frame.get('package', '')
+                src_loc = frame.get('sourceLocation', {})
+                filename = src_loc.get('filename', '')
+                start = src_loc.get('start', {})
+                line = start.get('line')
+                col = start.get('column')
+                end = src_loc.get('end', {})
+                end_line = end.get('line')
+                end_col = end.get('column')
+                
+                if i == 0:
+                    # First frame - use filename as primary
+                    if filename:
+                        loc = filename
+                        if line is not None:
+                            if end_line is not None and end_line != line:
+                                loc = f"{filename} {line}:{col if col else ''}-{end_line}:{end_col if end_col else ''}"
+                            else:
+                                loc = f"{filename} {line}:{col if col else ''}"
+                        result['trace'].append(loc)
+                else:
+                    # Subsequent frames - show package/module reference
+                    if pkg or filename:
+                        entry = pkg if pkg else filename
+                        if line is not None:
+                            entry = f"  -> {entry} {line}:{col if col else ''}"
+                        else:
+                            entry = f"  -> {entry}"
+                        result['trace'].append(entry)
+        
+        # Add final line showing the vulnerable component
+        comp_name = component.get('name') or component.get('id')
+        comp_ver = component.get('version')
+        if comp_name:
+            final_line = f"  -> {comp_name}@{comp_ver}" if comp_ver else f"  -> {comp_name}"
+            result['trace'].append(final_line)
+    
+    return result
+
+
+def convert_to_alerts(components: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    """
+    Convert components with vulnerabilities into components with alerts.
+    
+    This function processes the raw .socket.facts.json format (with 'vulnerabilities' 
+    and 'reachability' arrays) and converts them into an 'alerts' format suitable 
+    for formatters and notifications.
+    
+    Args:
+        components: List of component dicts from .socket.facts.json
+    
+    Returns:
+        List of component dicts with 'alerts' field added (original components unchanged)
+    """
+    components_with_alerts = []
+    
+    for comp in components:
+        vulns = comp.get('vulnerabilities', [])
+        if not vulns:
+            continue
+        
+        alerts = []
+        for vuln in vulns:
+            vuln_id = vuln.get('ghsaId') or vuln.get('cveId') or 'Unknown'
+            
+            # Extract severity
+            sev_val = vuln.get('severity', '')
+            severity = 'unknown'
+            
+            # Handle both numeric and string severities
+            try:
+                if isinstance(sev_val, (int, float)):
+                    score = float(sev_val)
+                    if score >= 9.0:
+                        severity = 'critical'
+                    elif score >= 7.0:
+                        severity = 'high'
+                    elif score >= 4.0:
+                        severity = 'medium'
+                    else:
+                        severity = 'low'
+                elif isinstance(sev_val, str):
+                    # Try to parse as number first
+                    if sev_val.replace('.', '', 1).isdigit():
+                        score = float(sev_val)
+                        if score >= 9.0:
+                            severity = 'critical'
+                        elif score >= 7.0:
+                            severity = 'high'
+                        elif score >= 4.0:
+                            severity = 'medium'
+                        else:
+                            severity = 'low'
+                    else:
+                        # Use as-is if it's a string severity
+                        severity = sev_val.lower()
+            except (ValueError, TypeError):
+                severity = 'unknown'
+            
+            # Determine reachability
+            reach_info = _determine_reachability(vuln, comp)
+            
+            # Skip vulnerabilities that don't apply to this component version
+            if reach_info.get('type') == 'not_applicable':
+                continue
+            
+            # Build alert
+            purl = _make_purl(comp)
+            trace_str = '\n'.join(reach_info.get('trace', []))
+            reach_type = reach_info.get('type', 'unknown')
+            
+            # Map reachability to severity (reachable = critical, unknown/error = high, unreachable = low)
+            final_severity = severity
+            if reach_type == 'reachable':
+                final_severity = 'critical'
+            elif reach_type in ('unknown', 'error') or reach_info.get('undeterminableReachability'):
+                final_severity = 'high'
+            elif reach_type == 'unreachable':
+                final_severity = 'low'
+            
+            alert = {
+                'title': vuln_id,
+                'severity': final_severity,
+                'type': 'vulnerability',
+                'category': 'vulnerability',
+                'props': {
+                    'cveId': vuln.get('cveId'),
+                    'ghsaId': vuln.get('ghsaId'),
+                    'range': vuln.get('range'),
+                    'purl': purl,
+                    'reachability': reach_type,
+                    'undeterminableReachability': reach_info.get('undeterminableReachability', False),
+                    'trace': trace_str,
+                    'severity': final_severity,
+                    'original_severity': severity,
+                }
+            }
+            alerts.append(alert)
+        
+        if alerts:
+            # Create a copy with alerts added
+            comp_with_alerts = deepcopy(comp)
+            comp_with_alerts['alerts'] = alerts
+            components_with_alerts.append(comp_with_alerts)
+    
+    return components_with_alerts
+
+
+def get_component_count(facts_data: Dict[str, Any]) -> Dict[str, int]:
+    """
+    Get statistics about components in the socket facts data.
+    
+    Args:
+        facts_data: Dictionary loaded from .socket.facts.json
+    
+    Returns:
+        Dictionary with counts:
+        - total: Total number of components
+        - with_vulnerabilities: Components with vulnerabilities
+        - direct: Direct dependencies
+        - dev: Development dependencies
+    """
+    if not facts_data or 'components' not in facts_data:
+        return {'total': 0, 'with_vulnerabilities': 0, 'direct': 0, 'dev': 0}
+    
+    components = facts_data.get('components', [])
+    
+    return {
+        'total': len(components),
+        'with_vulnerabilities': len([c for c in components if c.get('vulnerabilities')]),
+        'direct': len([c for c in components if c.get('direct')]),
+        'dev': len([c for c in components if c.get('dev')])
+    }
diff --git a/socketsecurity/plugins/formatters/__init__.py b/socketsecurity/plugins/formatters/__init__.py
new file mode 100644
index 0000000..b7d4637
--- /dev/null
+++ b/socketsecurity/plugins/formatters/__init__.py
@@ -0,0 +1,5 @@
+"""Formatters for Socket security data output."""
+
+from .slack import format_socket_facts_for_slack
+
+__all__ = ['format_socket_facts_for_slack']
diff --git a/socketsecurity/plugins/formatters/slack.py b/socketsecurity/plugins/formatters/slack.py
new file mode 100644
index 0000000..adce7ee
--- /dev/null
+++ b/socketsecurity/plugins/formatters/slack.py
@@ -0,0 +1,272 @@
+"""Slack formatter for Socket Facts (reachability analysis) data."""
+
+import logging
+from typing import Dict, Any, List
+from collections import defaultdict
+
+logger = logging.getLogger(__name__)
+
+# Severity display configuration
+SEVERITY_ORDER = {'critical': 0, 'high': 1, 'medium': 2, 'low': 3}
+SEVERITY_EMOJI = {
+    'critical': '🔴',
+    'high': '🟠',
+    'medium': '🟡',
+    'low': '⚪'
+}
+
+
+def _make_purl(component: Dict[str, Any]) -> str:
+    """
+    Construct a package URL (purl) from a component entry.
+    
+    Args:
+        component: Component dictionary from socket facts
+    
+    Returns:
+        Package URL string in format: pkg:type/namespace/name@version
+    """
+    pkg_type = component.get('type', '')
+    namespace = component.get('namespace', '')
+    name = component.get('name') or component.get('id', '')
+    version = component.get('version', '')
+    
+    if not name:
+        return ''
+    
+    # Construct purl - handle scoped packages (namespace with @)
+    if namespace:
+        # Percent-encode @ in namespace for purl spec compliance
+        ns_encoded = namespace.replace('@', '%40')
+        purl = f"pkg:{pkg_type}/{ns_encoded}/{name}"
+    else:
+        purl = f"pkg:{pkg_type}/{name}"
+    
+    if version:
+        purl = f"{purl}@{version}"
+    
+    return purl
+
+
+def _get_reachability_from_alert(alert: Dict[str, Any]) -> str:
+    """
+    Extract reachability status from an alert.
+    
+    Args:
+        alert: Alert dictionary from component
+    
+    Returns:
+        Reachability status: 'reachable', 'unreachable', 'unknown', or 'error'
+    """
+    props = alert.get('props', {}) or {}
+    reachability = props.get('reachability', 'unknown')
+    
+    # Normalize to expected values
+    if isinstance(reachability, str):
+        return reachability.lower()
+    
+    return 'unknown'
+
+
+def _get_trace_from_alert(alert: Dict[str, Any], max_length: int = 500) -> str:
+    """
+    Extract and format trace data from an alert.
+    
+    Args:
+        alert: Alert dictionary from component
+        max_length: Maximum length for trace output (truncate if longer)
+    
+    Returns:
+        Formatted trace string
+    """
+    props = alert.get('props', {}) or {}
+    trace_raw = props.get('trace', '')
+    
+    trace_str = ''
+    if isinstance(trace_raw, list):
+        trace_str = '\n'.join(str(item) for item in trace_raw)
+    elif isinstance(trace_raw, str):
+        trace_str = trace_raw
+    
+    # Truncate if too long
+    if trace_str and len(trace_str) > max_length:
+        trace_str = trace_str[:max_length] + '\n...'
+    
+    return trace_str
+
+
+def _extract_alert_info(component: Dict[str, Any], alert: Dict[str, Any]) -> Dict[str, Any]:
+    """
+    Extract standardized information from an alert.
+    
+    Args:
+        component: Component dictionary containing the alert
+        alert: Alert dictionary
+    
+    Returns:
+        Dictionary with standardized alert information
+    """
+    props = alert.get('props', {}) or {}
+    severity = str(alert.get('severity') or props.get('severity') or '').lower()
+    
+    return {
+        'cve_id': str(props.get('ghsaId') or props.get('cveId') or alert.get('title') or 'Unknown'),
+        'severity': severity,
+        'severity_order': SEVERITY_ORDER.get(severity, 4),
+        'severity_emoji': SEVERITY_EMOJI.get(severity, '⚪'),
+        'reachability': _get_reachability_from_alert(alert),
+        'trace': _get_trace_from_alert(alert),
+        'purl': str(props.get('purl') or _make_purl(component) or component.get('name') or '-')
+    }
+
+
+def format_socket_facts_for_slack(
+    components: List[Dict[str, Any]], 
+    max_blocks: int = 45,
+    include_traces: bool = True
+) -> List[Dict[str, Any]]:
+    """
+    Format socket facts components with alerts for Slack notification.
+    
+    This function processes vulnerability data from Socket's reachability analysis
+    and formats it for display in Slack with smart block limiting.
+    
+    Slack has a 50 block limit. We use ~4 blocks for header/summary, leaving ~45 for findings.
+    
+    Prioritization (when space limited):
+    1. Reachable vulnerabilities (all severities)
+    2. Unknown/error reachability (critical/high only)
+    3. Skip unreachable vulnerabilities
+    
+    Further filtering by severity:
+    - Critical (always show if reachable)
+    - High (show if space allows)
+    - Medium (show if space allows)
+    - Low (skip if space limited)
+    
+    Args:
+        components: List of component dictionaries from socket facts JSON
+        max_blocks: Maximum number of blocks for findings (default: 45, Slack limit is 50)
+        include_traces: Whether to include trace data for reachable findings
+    
+    Returns:
+        List of notification dictionaries with structured vulnerability data.
+    
+    Example:
+        >>> components = socket_facts['components']
+        >>> notifications = format_socket_facts_for_slack(components)
+        >>> for notif in notifications:
+        ...     send_to_slack(notif['title'], notif['vulnerabilities'])
+    """
+    # Group findings by PURL and reachability status
+    purl_groups = defaultdict(lambda: {
+        'reachable': [],
+        'unknown': [],
+        'error': [],
+        'unreachable': []
+    })
+    
+    severity_counts = {'critical': 0, 'high': 0, 'medium': 0, 'low': 0}
+    reachability_counts = {'reachable': 0, 'unknown': 0, 'error': 0, 'unreachable': 0}
+    
+    # Process all components and their alerts
+    for component in components:
+        alerts = component.get('alerts', [])
+        
+        for alert in alerts:
+            alert_info = _extract_alert_info(component, alert)
+            purl = alert_info['purl']
+            reachability = alert_info['reachability']
+            
+            # Count by severity
+            if alert_info['severity'] in severity_counts:
+                severity_counts[alert_info['severity']] += 1
+            
+            # Count by reachability
+            if reachability in reachability_counts:
+                reachability_counts[reachability] += 1
+            
+            # Group by reachability status
+            if reachability in purl_groups[purl]:
+                purl_groups[purl][reachability].append(alert_info)
+    
+    # Sort findings within each group by severity (most severe first)
+    for purl in purl_groups:
+        for reach_type in ['reachable', 'unknown', 'error', 'unreachable']:
+            purl_groups[purl][reach_type].sort(key=lambda x: x['severity_order'])
+    
+    # Build Slack message content
+    if not purl_groups:
+        return [{
+            'title': 'Socket Reachability Analysis',
+            'summary': "✅ No vulnerabilities found in reachability analysis.",
+            'vulnerabilities': []
+        }]
+    
+    # Calculate totals
+    total_findings = sum(severity_counts.values())
+    
+    # Build summary
+    summary = (
+        f"🔴 Critical: {severity_counts['critical']} | "
+        f"🟠 High: {severity_counts['high']} | "
+        f"🟡 Medium: {severity_counts['medium']} | "
+        f"⚪ Low: {severity_counts['low']}\n\n"
+        f"🎯 Reachable: {reachability_counts['reachable']} | "
+        f"✓ Unreachable: {reachability_counts['unreachable']}"
+    )
+    
+    # Collect and prioritize vulnerabilities for display
+    # Priority: reachable (all) > unknown/error (critical/high) > skip unreachable unless space
+    vulnerabilities_to_show = []
+    
+    # First, add all reachable vulnerabilities (highest priority)
+    for purl in purl_groups:
+        for finding in purl_groups[purl]['reachable']:
+            vulnerabilities_to_show.append({
+                'purl': purl,
+                'finding': finding,
+                'reachability': 'reachable',
+                'priority': (0, finding['severity_order'])  # (reachability_pri, severity_pri)
+            })
+    
+    # Add unknown/error reachability (critical and high only)
+    for purl in purl_groups:
+        for finding in purl_groups[purl]['unknown']:
+            if finding['severity'] in ['critical', 'high']:
+                vulnerabilities_to_show.append({
+                    'purl': purl,
+                    'finding': finding,
+                    'reachability': 'unknown',
+                    'priority': (1, finding['severity_order'])
+                })
+        for finding in purl_groups[purl]['error']:
+            if finding['severity'] in ['critical', 'high']:
+                vulnerabilities_to_show.append({
+                    'purl': purl,
+                    'finding': finding,
+                    'reachability': 'error',
+                    'priority': (1, finding['severity_order'])
+                })
+    
+    # Sort by priority (reachability first, then severity)
+    vulnerabilities_to_show.sort(key=lambda x: x['priority'])
+    
+    # Limit to max_blocks (each vulnerability = 1 block)
+    selected_vulnerabilities = vulnerabilities_to_show[:max_blocks]
+    
+    # Calculate what was omitted
+    omitted_count = total_findings - len(selected_vulnerabilities)
+    omitted_unreachable = reachability_counts['unreachable']
+    omitted_low = severity_counts['low'] - sum(1 for v in selected_vulnerabilities if v['finding']['severity'] == 'low')
+    
+    return [{
+        'title': 'Socket Reachability Analysis',
+        'summary': summary,
+        'total_findings': total_findings,
+        'vulnerabilities': selected_vulnerabilities,
+        'omitted_count': omitted_count,
+        'omitted_unreachable': omitted_unreachable,
+        'omitted_low': omitted_low,
+        'include_traces': include_traces
+    }]
diff --git a/socketsecurity/plugins/slack.py b/socketsecurity/plugins/slack.py
index a1d1c43..ba2cd6c 100644
--- a/socketsecurity/plugins/slack.py
+++ b/socketsecurity/plugins/slack.py
@@ -4,6 +4,12 @@
 from .base import Plugin
 from socketsecurity.core.classes import Diff
 from socketsecurity.core.messages import Messages
+from socketsecurity.core.helper.socket_facts_loader import (
+    load_socket_facts,
+    get_components_with_vulnerabilities,
+    convert_to_alerts
+)
+from socketsecurity.plugins.formatters.slack import format_socket_facts_for_slack
 
 logger = logging.getLogger(__name__)
 
@@ -23,33 +29,423 @@ def send(self, diff, config: CliConfig):
             if config.enable_debug:
                 logger.debug("Slack webhook URL is missing from configuration")
             return
-        else:
-            url = self.config.get("url")
-
-        if not diff.new_alerts:
-            logger.debug("No new alerts to notify via Slack.")
+        
+        # Normalize URL configuration to list of dicts
+        url_configs = self._normalize_url_config(self.config.get("url"))
+        
+        if not url_configs:
+            logger.warning("No valid Slack webhook URLs configured.")
             return
 
         logger.debug("Slack Plugin Enabled")
         logger.debug("Alert levels: %s", self.config.get("levels"))
 
-        message = self.create_slack_blocks_from_diff(diff, config)
-        logger.debug(f"Sending message to {url}")
+        # Get url_configs parameter (filtering configuration)
+        webhook_configs = self.config.get("url_configs", {})
+        
+        # Validate that all URLs have corresponding configs
+        valid_webhooks = []
+        for url_config in url_configs:
+            name = url_config["name"]
+            if name not in webhook_configs:
+                logger.warning(f"No url_configs entry found for webhook '{name}'. This webhook will be disabled.")
+                continue
+            valid_webhooks.append(url_config)
+        
+        if not valid_webhooks:
+            logger.warning("No valid Slack webhooks with configurations. All webhooks disabled.")
+            return
+        
+        # Get repo name from config
+        repo_name = config.repo or ""
+        
+        # Handle reachability data if --reach is enabled
+        if config.reach:
+            self._send_reachability_alerts(valid_webhooks, webhook_configs, repo_name, config, diff)
+        
+        # Handle diff alerts (if any)
+        if not diff.new_alerts:
+            logger.debug("No new diff alerts to notify via Slack.")
+        else:
+            # Send to each configured webhook with filtering
+            for url_config in valid_webhooks:
+                url = url_config["url"]
+                name = url_config["name"]
+                webhook_config = webhook_configs[name]
+                
+                # Filter alerts based on webhook config
+                # When --reach is used, reachability_alerts_only applies to diff alerts
+                filtered_alerts = self._filter_alerts(
+                    diff.new_alerts, 
+                    webhook_config, 
+                    repo_name, 
+                    config,
+                    is_reachability_data=False,
+                    apply_reachability_only_filter=config.reach
+                )
+                
+                if not filtered_alerts:
+                    logger.debug(f"No diff alerts match filter criteria for webhook '{name}'. Skipping.")
+                    continue
+                
+                # Create a temporary diff object with filtered alerts for message creation
+                filtered_diff = Diff(
+                    new_alerts=filtered_alerts,
+                    diff_url=getattr(diff, "diff_url", ""),
+                    new_packages=getattr(diff, "new_packages", []),
+                    removed_packages=getattr(diff, "removed_packages", []),
+                    packages=getattr(diff, "packages", {})
+                )
+                
+                message = self.create_slack_blocks_from_diff(filtered_diff, config)
+                
+                logger.debug(f"Sending diff alerts message to {name} ({url})")
+                
+                if config.enable_debug:
+                    logger.debug(f"Slack webhook URL: {url}")
+                    logger.debug(f"Slack webhook name: {name}")
+                    logger.debug(f"Total diff alerts: {len(diff.new_alerts)}, Filtered alerts: {len(filtered_alerts)}")
+                    logger.debug(f"Message blocks count: {len(message)}")
+                
+                response = requests.post(
+                    url,
+                    json={"blocks": message}
+                )
+
+                if response.status_code >= 400:
+                    logger.error("Slack error for %s: %s - %s", name, response.status_code, response.text)
+                elif config.enable_debug:
+                    logger.debug(f"Slack webhook response for {name}: {response.status_code}")
+
+    def _filter_alerts(
+        self, 
+        alerts: list, 
+        webhook_config: dict, 
+        repo_name: str, 
+        config: CliConfig,
+        is_reachability_data: bool = False,
+        apply_reachability_only_filter: bool = False
+    ) -> list:
+        """
+        Filter alerts based on webhook configuration.
+        
+        Empty lists or missing keys mean no filtering for that criteria:
+        - repos: [] or missing → all repos allowed
+        - alert_types: [] or missing → no alert_type filtering
+        - severities: [] or missing → no severity filtering  
+        - reachability_alerts_only: missing → defaults to False
+        
+        Args:
+            alerts: List of Issue objects to filter
+            webhook_config: Config dict with optional keys: repos, alert_types, severities, reachability_alerts_only
+            repo_name: Current repository name from config
+            config: CliConfig object
+            is_reachability_data: If True, only apply severities filter (for .socket.facts.json data)
+            apply_reachability_only_filter: If True, apply reachability_alerts_only filter (only when --reach is used)
+        
+        Returns:
+            Filtered list of alerts matching the criteria
+        """
+        filtered = []
+        
+        # Extract filter configs (empty list/False means no filtering)
+        repos_filter = webhook_config.get("repos", [])
+        alert_types = webhook_config.get("alert_types", [])
+        severities = webhook_config.get("severities", [])
+        reachability_only = webhook_config.get("reachability_alerts_only", False)
         
         if config.enable_debug:
-            logger.debug(f"Slack webhook URL: {url}")
-            logger.debug(f"Number of alerts to send: {len(diff.new_alerts)}")
-            logger.debug(f"Message blocks count: {len(message)}")
-        
-        response = requests.post(
-            url,
-            json={"blocks": message}
-        )
+            logger.debug(f"Filtering {'reachability' if is_reachability_data else 'diff'} alerts with: "
+                        f"repos={repos_filter}, alert_types={alert_types}, "
+                        f"severities={severities}, reachability_only={reachability_only}, "
+                        f"apply_reachability_only={apply_reachability_only_filter}")
+        
+        for alert in alerts:
+            # For reachability data, only apply severities filter
+            if is_reachability_data:
+                # Filter by severities only (empty list = all severities allowed)
+                if severities:
+                    alert_severity = getattr(alert, "severity", "")
+                    if alert_severity not in severities:
+                        continue
+                filtered.append(alert)
+                continue
+            
+            # For diff alerts, apply all filters
+            # Filter by repos (empty list = all repos allowed)
+            if repos_filter and repo_name not in repos_filter:
+                continue
+            
+            # Filter by reachability_alerts_only (only when --reach is used)
+            if apply_reachability_only_filter and reachability_only:
+                # Only include alerts that have error=True (blocking issues)
+                if not getattr(alert, "error", False):
+                    continue
+            
+            # Filter by alert_types (overrides severity, empty list = no filtering)
+            if alert_types:
+                alert_type = getattr(alert, "type", "")
+                if alert_type not in alert_types:
+                    continue
+            else:
+                # Only apply severity filter if alert_types is not specified
+                # Empty severities list = all severities allowed
+                if severities:
+                    alert_severity = getattr(alert, "severity", "")
+                    if alert_severity not in severities:
+                        continue
+            
+            filtered.append(alert)
+        
+        return filtered
 
-        if response.status_code >= 400:
-            logger.error("Slack error %s: %s", response.status_code, response.text)
-        elif config.enable_debug:
-            logger.debug(f"Slack webhook response: {response.status_code}")
+    def _send_reachability_alerts(self, valid_webhooks: list, webhook_configs: dict, repo_name: str, config: CliConfig, diff=None):
+        """
+        Load and send reachability alerts from .socket.facts.json file.
+        
+        Args:
+            valid_webhooks: List of validated webhook configurations
+            webhook_configs: Dictionary of webhook configurations with filters
+            repo_name: Current repository name
+            config: CliConfig object
+            diff: Diff object containing diff_url for report link
+        """
+        logger.debug("Loading reachability data from .socket.facts.json")
+        
+        # Load socket facts file
+        facts_data = load_socket_facts(".socket.facts.json")
+        
+        if not facts_data:
+            logger.debug("No .socket.facts.json file found or failed to load")
+            return
+        
+        # Get components with vulnerabilities
+        components_with_vulns = get_components_with_vulnerabilities(facts_data)
+        
+        if not components_with_vulns:
+            logger.debug("No components with vulnerabilities found in .socket.facts.json")
+            return
+        
+        # Convert to alerts format
+        components_with_alerts = convert_to_alerts(components_with_vulns)
+        
+        if not components_with_alerts:
+            logger.debug("No alerts generated from .socket.facts.json")
+            return
+        
+        logger.debug(f"Found {len(components_with_alerts)} components with reachability alerts")
+        
+        # Send to each configured webhook with filtering
+        for url_config in valid_webhooks:
+            url = url_config["url"]
+            name = url_config["name"]
+            webhook_config = webhook_configs[name]
+            
+            # Filter components based on severities only (for reachability data)
+            filtered_components = []
+            for component in components_with_alerts:
+                component_alerts = component.get('alerts', [])
+                # Filter alerts using only severities
+                filtered_component_alerts = self._filter_alerts(
+                    component_alerts,
+                    webhook_config,
+                    repo_name,
+                    config,
+                    is_reachability_data=True
+                )
+                
+                if filtered_component_alerts:
+                    # Create a copy of component with only filtered alerts
+                    filtered_component = component.copy()
+                    filtered_component['alerts'] = filtered_component_alerts
+                    filtered_components.append(filtered_component)
+            
+            if not filtered_components:
+                logger.debug(f"No reachability alerts match filter criteria for webhook '{name}'. Skipping.")
+                continue
+            
+            # Format for Slack using the formatter (max 45 blocks for findings + 5 for header/footer)
+            slack_notifications = format_socket_facts_for_slack(
+                filtered_components,
+                max_blocks=45,
+                include_traces=True
+            )
+            
+            # Convert to Slack blocks format
+            for notification in slack_notifications:
+                blocks = self._create_reachability_slack_blocks_from_structured(
+                    notification,
+                    config,
+                    diff
+                )
+                
+                logger.debug(f"Sending reachability alerts message to {name} ({url})")
+                
+                if config.enable_debug:
+                    logger.debug(f"Slack webhook URL: {url}")
+                    logger.debug(f"Slack webhook name: {name}")
+                    logger.debug(f"Reachability components: {len(filtered_components)}")
+                    logger.debug(f"Message blocks count: {len(blocks)}")
+                
+                response = requests.post(
+                    url,
+                    json={"blocks": blocks}
+                )
+                
+                if response.status_code >= 400:
+                    logger.error("Slack error for %s: %s - %s", name, response.status_code, response.text)
+                elif config.enable_debug:
+                    logger.debug(f"Slack webhook response for {name}: {response.status_code}")
+    
+    def _create_reachability_slack_blocks_from_structured(self, notification: dict, config: CliConfig, diff=None) -> list:
+        """
+        Create Slack blocks from structured reachability notification data.
+        Respects Slack's 50 block limit by prioritizing critical findings.
+        
+        Args:
+            notification: Structured notification dict from format_socket_facts_for_slack
+            config: CliConfig object
+            diff: Diff object containing diff_url for report link
+        
+        Returns:
+            List of Slack block dictionaries (max 50 blocks)
+        """
+        pr = getattr(config, "pr_number", None)
+        sha = getattr(config, "commit_sha", None)
+        diff_url = getattr(diff, "diff_url", "") if diff else ""
+        
+        title_part = ""
+        if pr:
+            title_part += f" for PR {pr}"
+        if sha:
+            title_part += f" - {sha[:8]}"
+        
+        # Header blocks (2 blocks)
+        blocks = [
+            {
+                "type": "section",
+                "text": {
+                    "type": "mrkdwn",
+                    "text": f"*{notification['title']}*{title_part}"
+                }
+            },
+            {"type": "divider"}
+        ]
+        
+        # Summary block (2 blocks)
+        blocks.append({
+            "type": "section",
+            "text": {
+                "type": "mrkdwn",
+                "text": notification['summary']
+            }
+        })
+        blocks.append({"type": "divider"})
+        
+        # Vulnerability blocks (1 block per vulnerability, max ~45)
+        include_traces = notification.get('include_traces', True)
+        for vuln in notification.get('vulnerabilities', []):
+            finding = vuln['finding']
+            reachability = vuln['reachability']
+            
+            # Reachability indicator
+            reach_indicator = {
+                'reachable': '🎯 *Reachable*',
+                'unreachable': '✓ *Unreachable*',
+                'unknown': '❓ *Unknown*',
+                'error': '⚠️ *Error*'
+            }.get(reachability, '')
+            
+            # Build vulnerability text
+            vuln_text = f"*Package:* `{vuln['purl']}`\n\n{reach_indicator}\n"
+            vuln_text += f"{finding['severity_emoji']} *{finding['cve_id']}*: {finding['severity'].upper()}"
+            
+            # Add trace if enabled and available
+            if include_traces and reachability == 'reachable' and finding.get('trace'):
+                # Format trace lines with indentation
+                trace_lines = finding['trace'].split('\n')
+                trace_text = '\n'.join(f"  {line}" for line in trace_lines if line.strip())
+                if trace_text:
+                    vuln_text += f"\n```\n{trace_text}\n```"
+            
+            blocks.append({
+                "type": "section",
+                "text": {
+                    "type": "mrkdwn",
+                    "text": vuln_text
+                }
+            })
+            blocks.append({"type": "divider"})
+        
+        # Footer with omission notice and link (1-2 blocks)
+        omitted_count = notification.get('omitted_count', 0)
+        if omitted_count > 0:
+            omitted_unreachable = notification.get('omitted_unreachable', 0)
+            omitted_low = notification.get('omitted_low', 0)
+            
+            footer_parts = []
+            if omitted_unreachable > 0:
+                footer_parts.append(f"{omitted_unreachable} unreachable")
+            if omitted_low > 0:
+                footer_parts.append(f"{omitted_low} low severity")
+            
+            omission_text = f"⚠️ *{omitted_count} findings not shown*"
+            if footer_parts:
+                omission_text += f" ({', '.join(footer_parts)})"
+            
+            blocks.append({
+                "type": "section",
+                "text": {
+                    "type": "mrkdwn",
+                    "text": omission_text
+                }
+            })
+        
+        # Add link to full report if available
+        if diff_url:
+            blocks.append({
+                "type": "section",
+                "text": {
+                    "type": "mrkdwn",
+                    "text": f"<{diff_url}|View full report >"
+                }
+            })
+        
+        return blocks
+
+    def _normalize_url_config(self, url_input):
+        """
+        Normalize URL configuration to a consistent list of dicts format.
+        
+        Args:
+            url_input: Can be:
+                - string: "https://webhook.url"
+                - list of strings: ["https://webhook1.url", "https://webhook2.url"]
+                - list of dicts: [{"url": "https://webhook.url", "name": "unique_name"}]
+        
+        Returns:
+            List of dicts with 'url' and 'name' keys
+        """
+        if isinstance(url_input, str):
+            return [{"url": url_input, "name": "default"}]
+        
+        if isinstance(url_input, list):
+            normalized = []
+            for idx, item in enumerate(url_input):
+                if isinstance(item, str):
+                    normalized.append({"url": item, "name": f"webhook_{idx}"})
+                elif isinstance(item, dict):
+                    if "url" not in item:
+                        logger.warning(f"URL config item missing 'url' key: {item}")
+                        continue
+                    name = item.get("name", f"webhook_{idx}")
+                    normalized.append({"url": item["url"], "name": name})
+                else:
+                    logger.warning(f"Invalid URL config item type: {type(item)}")
+            return normalized
+        
+        logger.warning(f"Invalid URL config type: {type(url_input)}")
+        return []
 
     @staticmethod
     def create_slack_blocks_from_diff(diff: Diff, config: CliConfig):
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 644a967..332d3e4 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -54,10 +54,10 @@ def main_code():
     if not config.api_token:
         log.info("Socket API Token not found. Please set it using either:\n"
                  "1. Command line: --api-token YOUR_TOKEN\n"
-                 "2. Environment variable: SOCKET_SECURITY_API_KEY")
+                 "2. Environment variable: SOCKET_SECURITY_API_TOKEN")
         sys.exit(3)
-    
-    sdk = socketdev(token=config.api_token, allow_unverified=config.allow_unverified)
+    cli_user_agent_string = f"SocketPythonCLI/{config.version}"
+    sdk = socketdev(token=config.api_token, allow_unverified=config.allow_unverified, user_agent=cli_user_agent_string)
     
     # Suppress urllib3 InsecureRequestWarning when using --allow-unverified
     if config.allow_unverified:
diff --git a/uv.lock b/uv.lock
index 1b64bac..c387cb9 100644
--- a/uv.lock
+++ b/uv.lock
@@ -36,107 +36,107 @@ wheels = [
 
 [[package]]
 name = "backports-zstd"
-version = "1.2.0"
+version = "1.3.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f4/d8/e8426a2abd7bfdafffcc1be07a23890314f199928515937c8ee7e3537157/backports_zstd-1.2.0.tar.gz", hash = "sha256:6c3fc19342db750b52fde793e4440a93575761b1493bb4a1d3b26033d2bd3452", size = 997263, upload-time = "2025-12-06T20:26:39.595Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/a0/97/01630376854dab8cc6e58819236c46ffc40bc2ad1c5a82b430e0c5b79009/backports_zstd-1.2.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:68d70396997cbaaf8e571dee93f05c4cec5053ef14a6e165c26ad4aadca6b7ee", size = 435932, upload-time = "2025-12-06T20:24:08.421Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/62/a06ddca84e3c0ec45e667a02be5c4a157ab5e1e940d65096a80d409f0557/backports_zstd-1.2.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8dc2d15224ea683bbf7ad6aa8eacde40972c2c700e8ff72862cb0663e18ae953", size = 362327, upload-time = "2025-12-06T20:24:09.956Z" },
-    { url = "https://files.pythonhosted.org/packages/10/16/1045c674bb09fad1b838098c0b16a88bae9a7bab5e305aac11e55a8c813e/backports_zstd-1.2.0-cp310-cp310-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:7137114011f380f7e8bd97d92664b5bd71ab5f6e08144f22836263ad45273af2", size = 506230, upload-time = "2025-12-06T20:24:11.273Z" },
-    { url = "https://files.pythonhosted.org/packages/32/8d/ef8a8051374a1948d19c9888d2898d7091314448360a803bffc8474bbf58/backports_zstd-1.2.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fb922d2f278ec2e62a29121f98e573f622cefa9408dc0462a0e51ac08bca30b8", size = 475845, upload-time = "2025-12-06T20:24:12.846Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/b9/2c01e970e69f7ea2fa9710373fa4b48d31e677098d04d9b05d01e109feef/backports_zstd-1.2.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b72f4fe1764d53c6f8526d53ef566dcbe71daa81b3219fd802b51a153692159a", size = 581469, upload-time = "2025-12-06T20:24:14.343Z" },
-    { url = "https://files.pythonhosted.org/packages/84/a3/a2780c37d876badb483815239f2cc9bd863123248e20b2290e3f08355b7e/backports_zstd-1.2.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:743feb4e13e0f41a22d257bb5d2d4323f0308ecfedfd53db69172e2d9c3e4ba8", size = 641118, upload-time = "2025-12-06T20:24:16.024Z" },
-    { url = "https://files.pythonhosted.org/packages/92/88/5f40f9ead71dfb234fb7ab3c7949f2c0aa52eaed3f75115e4e7cfb5528f4/backports_zstd-1.2.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:199c41106c05bf12cb665a1d105ce2185da5e190e13b95933420d6fd9cd8bb10", size = 491335, upload-time = "2025-12-06T20:24:17.565Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/e2/4fd0071eb6035d6a412f6c5c2802ebacdbb845569dbb7a1e723c13cc1742/backports_zstd-1.2.0-cp310-cp310-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:270f10d14852fd11f85e1199f59fcb9dbcb425d489c678e5b0ea669c091b1cf3", size = 565341, upload-time = "2025-12-06T20:24:18.705Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/ef/b40a17346294c892d93fa738f48fc145432fa4ff265cf2d1ab3c177f10b1/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:c276433f6bbe67a8c71fa78bbfe1d7859ee17f799e6fcff9ac250840e38608d4", size = 481792, upload-time = "2025-12-06T20:24:19.948Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/24/7e0d77b17a3ae899a0c3f5ed9be842a8e6134577ea3411d8ff0e3962764d/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:772ad9b56a546fde9c1636dcf525d727330b11c6e34c9af8f879f23b41a8054e", size = 509736, upload-time = "2025-12-06T20:24:21.263Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/2a/99f7d247b974de0e5238796e85ba29e49c285a2d8a51c3b6f5b8abd4cd93/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:f7fd5d7c8c1c7b26b52b49bf3e392c3c6295658a34a887c587044b37a0b68a3c", size = 585835, upload-time = "2025-12-06T20:24:22.835Z" },
-    { url = "https://files.pythonhosted.org/packages/47/d9/0eabba1630f4b0674ce6ae79793e8901b0cdb28c83a484b424df29ed66dc/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:18b510dd03a2b7cdda62744802d8c43df7f027f578c4e67f6fa7208d8691db84", size = 563163, upload-time = "2025-12-06T20:24:24.35Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/67/cc1cd5cbb8982ca156393b8b50698b86efdd0245ba56f3b3b539950061c6/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:26301adc3008c2de40fedf780deb2bceb79471ea89efba37d30768871313f673", size = 631693, upload-time = "2025-12-06T20:24:26.166Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/19/01d30f83e87ae4890297f0d2422eb2fad0679c48eb65de8f2c8e131a9345/backports_zstd-1.2.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:9dc4c9cf3804e6b6cc5aa9aedc63cf81551cc4f6150ea4b248b95de84051317d", size = 495392, upload-time = "2025-12-06T20:24:27.424Z" },
-    { url = "https://files.pythonhosted.org/packages/06/5e/4fb7553901245637ae70d934f5ae719be7207aea3243b254a19f5947b554/backports_zstd-1.2.0-cp310-cp310-win32.whl", hash = "sha256:e456426bf45dd8d818df5ce6b81faaf3961ef8b16834e91cbe2b739346abe9fb", size = 288844, upload-time = "2025-12-06T20:24:28.563Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/64/9f8a05ff703f5bdc2b2c9c8e5797299eb2cf4791226a46b2e14489784b4a/backports_zstd-1.2.0-cp310-cp310-win_amd64.whl", hash = "sha256:cf6e2cbe1e637a834e1920ded11e423897a9822d17a0be9486d3f63554f51618", size = 313759, upload-time = "2025-12-06T20:24:29.665Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/e7/cc45af33a4e4aee365ab76c3f4fcadf984fea221563c2c29c5613cffeaa9/backports_zstd-1.2.0-cp310-cp310-win_arm64.whl", hash = "sha256:4d50bd23c4520e1ccd60af59f8aadc43ce3a481f2793afe01c18a7aa6a518892", size = 288960, upload-time = "2025-12-06T20:24:30.819Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/40/f914ee5a00c1f5df9a162efd7130db7ab339b838e6b1613eb2ed7f0594a2/backports_zstd-1.2.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:b47ed63b1c04e06981ac552d107945752d1ffecae98a4bce9c8a627490ce460d", size = 435933, upload-time = "2025-12-06T20:24:31.903Z" },
-    { url = "https://files.pythonhosted.org/packages/36/5b/f03eeaee5b17cf88d9f252381f5b8573b1a1c958787af68e9d287c65086a/backports_zstd-1.2.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4e6433f889edb998abe33f3498c37ddd97b3ce3607eebbc0fed148f8c7c7f2ef", size = 362324, upload-time = "2025-12-06T20:24:33.186Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/78/369773911bd9968ca5f4e10ee4232ab6b71cbe45d6e17c78d3399e4a3944/backports_zstd-1.2.0-cp311-cp311-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:4cd00e5bfd6d17233809f08d979742a5b9c322162d8daea16f7c3538387b9c64", size = 506229, upload-time = "2025-12-06T20:24:34.364Z" },
-    { url = "https://files.pythonhosted.org/packages/19/da/f23872cd114b5352c97bf83a2082427aa08bd22f42461309c23783e82da5/backports_zstd-1.2.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f8c7239b457f4d51c03634edb0c9b2ebdffc6806f58c0396209f5eb7f8d7642e", size = 475842, upload-time = "2025-12-06T20:24:36.079Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/ea/07b6ee0956b522e6a8e0aca97d7b28ed0dc72a7c35a5b77485d2b8d7c4dc/backports_zstd-1.2.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:75c35e5292d5c5fa879ce3f40428fdb510b11a98801ccf1140690ed7a9c13b3d", size = 581467, upload-time = "2025-12-06T20:24:37.735Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/ea/ce04fed217a484ad9f3e8e087dd29c198dbfcb2d4d2c216d044a2a18aea8/backports_zstd-1.2.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:153e1af06e348f5ed1b104c345880c001824a192536940a8d012d33014b27ecf", size = 641159, upload-time = "2025-12-06T20:24:38.967Z" },
-    { url = "https://files.pythonhosted.org/packages/96/8f/b28147869bb8aba7a0b30f05cfec567d90002c4161dabb8315f002709ee3/backports_zstd-1.2.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf700fd79758417b1c0b725a56fa485ba15b10ee07ada736ff7e669fddd28b38", size = 491371, upload-time = "2025-12-06T20:24:40.209Z" },
-    { url = "https://files.pythonhosted.org/packages/33/92/26c7f8bee4cb3e6aae08b04351aa5578d30bac2701197ca2e3cb2b785978/backports_zstd-1.2.0-cp311-cp311-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b04638b6adf68f730b04b21ac81fb58eef2ea10f6c221aa653f1009c0afcf67b", size = 565341, upload-time = "2025-12-06T20:24:41.551Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/4b/d1595a7d877e67da6ec6d759d08f5dedaca59d4317c6116b19fd9e3c60bd/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:35a445eb01e525ae8dec59fcbabcc373c9ace57f8c10455185038f54a930a039", size = 481793, upload-time = "2025-12-06T20:24:43.036Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/0f/1e1c6a154026bcdd2daecb1abd1d924cb6d274b0f7bae4042f83fb0e97ab/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:1923ac203545a18a1b9726f6ae7bed1ab4f8825f0b8f4a32d2795932af3f5322", size = 509738, upload-time = "2025-12-06T20:24:44.427Z" },
-    { url = "https://files.pythonhosted.org/packages/40/7e/09a807f3920fa1fe4ae019275d5978168d94fe8615c5bde3f7969760edb7/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:97d06ec9b5b21fb59cfa5e716ca1c91f3bac2cd2c3b14e21c3d29fa1b2b0baf9", size = 585823, upload-time = "2025-12-06T20:24:46.001Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/14/ef90815a3ad6eabbca59b9cd62013c39acfd38c7cf1f5da31c733520a6d8/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:57e773e295e7d56bd67a2f57071b1c978832566d0f908d7d7aabb16f35401810", size = 563165, upload-time = "2025-12-06T20:24:47.132Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/98/8918bb085bb2f333d5785cc67918c65e497674de6d53834c1c42233ddde0/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:157950cfd4ed85e03c2557067867e37090796b556c613badfaefcdf2750e95e1", size = 631734, upload-time = "2025-12-06T20:24:48.309Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/c6/a2e494d412728fc04c7e1f40479bac80c505f9eaeafa8048f764104dbfc8/backports_zstd-1.2.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:4a3450d9cf69d76843ea195c1defeff087b68a8a4a3687f0927f870ab594e062", size = 495397, upload-time = "2025-12-06T20:24:49.516Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/81/f9a762ad3e965324a19574c1aa7b39ac35196bc072534efd34b24bec9786/backports_zstd-1.2.0-cp311-cp311-win32.whl", hash = "sha256:77f0e7e71506e12f99927ddea7ab1de5933d47c9af048d05a229246977d89127", size = 288936, upload-time = "2025-12-06T20:24:50.68Z" },
-    { url = "https://files.pythonhosted.org/packages/21/95/1d699d9bc9a94ad5b8bc06d1a59246a5adce02668e3773a8c29b1f5a7554/backports_zstd-1.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:84a0b581408efce8624b887326e0b285fc2e5ba32348b9b6e6775f171fd4926b", size = 313884, upload-time = "2025-12-06T20:24:51.772Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/56/74b78b9313af6e330b04ae010a98e1d8cc133254c3c53ae2b5e5f4d5ec83/backports_zstd-1.2.0-cp311-cp311-win_arm64.whl", hash = "sha256:65e7591b20aa803c87a104c0dc9129a984f04adec9b042d88c7a14d1254c9524", size = 289080, upload-time = "2025-12-06T20:24:53.321Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/53/235dcac25478d60c4e58b6f982b91550b60908dbc07ab42405f818f41794/backports_zstd-1.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:ff2348b69da19243b7148f69fc60753c27b3efe313dfb29dcb642b4b3a064261", size = 436243, upload-time = "2025-12-06T20:24:54.458Z" },
-    { url = "https://files.pythonhosted.org/packages/db/b2/549d1933995ccf4464b29f068f6fdd1e2d9f6abc8ecbcab99dd90d4d28fd/backports_zstd-1.2.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f194a3cb53173f8bf8160597d39be16731e576ccf0244e7694e3aeac47e6c85d", size = 362396, upload-time = "2025-12-06T20:24:55.712Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/11/dc21a59734f2ce145a9a7f2d0016987cedf95598a850a3f4ab6ce73ddea0/backports_zstd-1.2.0-cp312-cp312-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:79a18d5d707cd92fc7ce28c4a1a63cfdaf8d19223b3167d2d879042bf1c018ac", size = 506651, upload-time = "2025-12-06T20:24:56.975Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/16/12f84de430428f620a6ced01fd2768d2296951d7543b81d971455f39ef75/backports_zstd-1.2.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f04bcbb75de26d39de81e7c02a784cb55a706c6ce9665b8df218fa9275193a1a", size = 476474, upload-time = "2025-12-06T20:24:58.136Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/8a/980e349fac1e1ba596f440b24901af498399c6e33b83032abbf22fed7d21/backports_zstd-1.2.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9c36bbd7cc85629d77f9537ad02bc438b3e3f9f1741a43f1cede1027fd9ebfb5", size = 581930, upload-time = "2025-12-06T20:24:59.605Z" },
-    { url = "https://files.pythonhosted.org/packages/36/f8/cba3372ca8d777cf5c3e312b35112ff608cf6b0b2f6a813b600b69763495/backports_zstd-1.2.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:28828f15a7429a7f7570a1465f9b71ccf7f99ea0a6bf786be7c276777f3cdc14", size = 640659, upload-time = "2025-12-06T20:25:01.164Z" },
-    { url = "https://files.pythonhosted.org/packages/61/59/c8bd0a5a39770cf7c0d864cbb65ac5df57405ee28a51fd5c11a5fbf1a169/backports_zstd-1.2.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6d634cba354a3ca61837e5a8d9a6ee19d9d37927ec288f0828437b2620ae83fb", size = 494445, upload-time = "2025-12-06T20:25:02.867Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/bf/52665f48d449fa1586fb775468e2fa83ebc8e222eb2d18332b3b5f12f933/backports_zstd-1.2.0-cp312-cp312-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3624a67d12695d5c32a332bd8cc4c1d45273eba1a4a451a0ecf70f4c3e67dd4f", size = 568897, upload-time = "2025-12-06T20:25:04.151Z" },
-    { url = "https://files.pythonhosted.org/packages/95/ca/e559551d4d206a71ae545fcb690e704dfee141d88984729b0100042e91d3/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:93c9afeee3c60b203644e0a1cc54028283636b4e76ba670c84522584116c1b2e", size = 482506, upload-time = "2025-12-06T20:25:05.388Z" },
-    { url = "https://files.pythonhosted.org/packages/75/61/7440f4c72324c1c455498581faeadc1711cc6728f9d60aa781e6ef939446/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:4687dac0a3c5a4c30fbd871ee3be666822f1eb902a7a68ce0d1379f190917850", size = 510079, upload-time = "2025-12-06T20:25:06.703Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/bf/248692d5e0960a50eebc982e4e2cbbb3ac0f6200ad81d222d4c01ddd500d/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:dd63ed6c7139cef92b1073be892e92631aa468332570f7230089e93a9449f551", size = 586309, upload-time = "2025-12-06T20:25:08.351Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/7c/ecfb1d8ba18e2c9090898f12b6ea83a9dd59e735021a2c564996c4599024/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:464d5fea68f5b03feabea22a4db4f39622db4ff89dab2df259b3c8665f1f676b", size = 566493, upload-time = "2025-12-06T20:25:09.8Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/8d/c81ed0da565f735e8a8f0c3b8c633f9e16bcfdb82ca5cb4d029dac0f1361/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:d5b3518f82c518a09067dab4ed1bd79ca542a2c248f7f9418262dc2c4a06ccdb", size = 631120, upload-time = "2025-12-06T20:25:10.974Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/8e/9dec5a74249b3af4ea4fd4a5dfb5d70167ea82f96592b3b4e7d340ccfff0/backports_zstd-1.2.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:1d57ce6d62dfb28bd37ad5523678752a5516ec68595fd35559f6c2878edd4de0", size = 498938, upload-time = "2025-12-06T20:25:12.145Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/99/ca71a403c79ec4bc419b71cee532de6545af1a0d8e61d0a2b8d70a034e0a/backports_zstd-1.2.0-cp312-cp312-win32.whl", hash = "sha256:e8bedc2372dae260397a99844420e16bb886912d685058d52e1f3533164f67a5", size = 289072, upload-time = "2025-12-06T20:25:13.48Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/e4/77fc5813ea35906ac1b71cd284e20c5a6f808f138e2e6a13e9586cd61d1a/backports_zstd-1.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:4667b30ea5e9f8b505b2042a40c5115660151987ca748b4be07facc757212ff9", size = 314094, upload-time = "2025-12-06T20:25:14.966Z" },
-    { url = "https://files.pythonhosted.org/packages/44/e3/133652d59a6731f9180a107812c9d52a2c72be2d80c2fd4f874669592a0c/backports_zstd-1.2.0-cp312-cp312-win_arm64.whl", hash = "sha256:cd6326f1562435677ab2bf607a44c96bb2a48beb0e14accff45e8c9f0931e9c1", size = 289197, upload-time = "2025-12-06T20:25:16.077Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/6c/dd602f484f22d8df9ed71859735dc86e094e90b7d8f51e51d48808f3571e/backports_zstd-1.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:1db671ac69df7cd88057c85a7bc614b94afd74a48faacd1576ad91dd18008f6a", size = 435731, upload-time = "2025-12-06T20:25:17.225Z" },
-    { url = "https://files.pythonhosted.org/packages/29/7d/b126e05650103f269282e5271a0960e30ac4ce9f192e3ae98e303325011b/backports_zstd-1.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5f6520e555c2b597863b97ecb90ad21857bf044119f643130c29110b55f67c1a", size = 362007, upload-time = "2025-12-06T20:25:18.841Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/e2/464e87930aa771da08634846300c13355f7ae07a476c8a30f75631fd1689/backports_zstd-1.2.0-cp313-cp313-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:9ef28be8bfebf5169cde28f36ebd146a0305569c91e836aed3a3aa79b7bbc58b", size = 505925, upload-time = "2025-12-06T20:25:20.319Z" },
-    { url = "https://files.pythonhosted.org/packages/44/08/bda420a2d13be0d6aa8323b735207de46bb01c08575e3a6810e01a20501f/backports_zstd-1.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9478c04e285da26ce1198d5ec1e43905531049c9e0f74169a39df5876f44643e", size = 476130, upload-time = "2025-12-06T20:25:21.839Z" },
-    { url = "https://files.pythonhosted.org/packages/17/d5/fca7eb6e5a12e390ea4437bc6705e18efd70c9966127c3c2fec8188654f1/backports_zstd-1.2.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f032452d783876c5f4d81907e42fc6fbe812a9a712c360b497968ea7109bb17", size = 581610, upload-time = "2025-12-06T20:25:23.077Z" },
-    { url = "https://files.pythonhosted.org/packages/81/e2/072fdf5bff7274788b49491a4d039bf0fe2f2f07a9975751d8b70fc14ac6/backports_zstd-1.2.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5642ae3832fb74817bdabc0d8b8877b109537c3f9ceeb54a6cd855aa0afc3bd9", size = 642454, upload-time = "2025-12-06T20:25:24.28Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/74/a7ae8e421ccb779130d64745d3191daf6da02f37bf7cf099dc10d688d14e/backports_zstd-1.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4e7340a7fb7bac7607382554b138ae8dbffda0b8af72ce5c639fb86b49a3b2e4", size = 491079, upload-time = "2025-12-06T20:25:25.481Z" },
-    { url = "https://files.pythonhosted.org/packages/25/26/450b23bad6035f0f3dc8e1cf3729e31a10ce1821a7b6d3bf8555ba818a46/backports_zstd-1.2.0-cp313-cp313-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b72e343b1b2927fc047054450de8738bc64c268e93fabc8228d963690eaf348e", size = 566373, upload-time = "2025-12-06T20:25:27.034Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/42/8161164fb26ac1a656f5fb5e3aa3aa9dcf4d06f6d9553fc596fa6f0ae3ad/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:c3f2a3f898dd1eaba5c8f0ea0e1bd23d993ed86ea7d4c12bf7a0743158d123d6", size = 481888, upload-time = "2025-12-06T20:25:28.198Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/2c/5c4f9a54c7c708f38cdb0670804d62237e9cacd1a6ff567f8c5fb8ef5d1a/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:afb95bc88d7623eeda2c0c8fe0388ac8838fa5a09ddbd7dfa72b283de392024b", size = 509480, upload-time = "2025-12-06T20:25:29.438Z" },
-    { url = "https://files.pythonhosted.org/packages/13/fc/f7a86785fde290b3280adeb81c577a96323d4b661b9befa0d990aaa67a86/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:59ddb84b8bd46a4a297cdf92601aaa9f59881c59f4a402a021173d6bb8bc367a", size = 586040, upload-time = "2025-12-06T20:25:30.598Z" },
-    { url = "https://files.pythonhosted.org/packages/40/7a/11c709c72abeef82c5ef752718c10a3fde0fba8258c069d717de33d366f7/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:d3d0d54ef711ea5ffa4e2eebfb70784295eb517bd7ac64545a142ad35c5b02ba", size = 564125, upload-time = "2025-12-06T20:25:31.772Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/ec/2ea033ceeca0808d830c3fb1d8ced1b6d2e5c4540ed8bdf66e0ec99180af/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:5c170f1329e90614f2d51f6f4622f6f775f51b92b7bc7801fa093b97db6cfc95", size = 632819, upload-time = "2025-12-06T20:25:33.027Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/3a/1469312ce7b1c6d98c788b500df01d61468d17bfd58df21266a7160112fe/backports_zstd-1.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:49c675121210ee23ea9c9b28ad15822e1b0f9182df733f0e1a10a5385f628701", size = 495375, upload-time = "2025-12-06T20:25:34.362Z" },
-    { url = "https://files.pythonhosted.org/packages/c6/da/27ef9e6a169808fc6777fb58fb55991bdc9ec22eee1aaecaf076be91986b/backports_zstd-1.2.0-cp313-cp313-win32.whl", hash = "sha256:0724fb2958eb2ccc100c9f49315d856a88b5deb985c62953876a78ecb46027ba", size = 288717, upload-time = "2025-12-06T20:25:35.565Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/f3/bfe0c470e2cfd0bbc274ca484e7a061f2d505c28df2479c52ed1dcce4fea/backports_zstd-1.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:b80b715170fc590d464d3342757978702ed4b6b41a3b3a0a5dbb46a89f4ccebe", size = 313927, upload-time = "2025-12-06T20:25:36.691Z" },
-    { url = "https://files.pythonhosted.org/packages/16/0d/cf6b22e4ca8cfa850061baa89664437b2da65698b2a8a02eb67de9d6b69e/backports_zstd-1.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:c09f5e985142fc04581c12e635dfd8cdc64b2d595479c1213f0b4db7ee37e3cb", size = 288947, upload-time = "2025-12-06T20:25:37.884Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/65/285bccc9fddb1b1d7fa379b42407f3e88359db05a6955fbe02ef4d5ed6ce/backports_zstd-1.2.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:21c68b9d358f1062c5c8baad946e306b54380dcbe2b12d00fdebc42533b5a499", size = 436423, upload-time = "2025-12-06T20:25:39.048Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/27/bba33f68cfc57a2885bbd1a1ffc9405cb461b12db5083ca63b15074bfa6d/backports_zstd-1.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4c3508074a30e3309bcc1bfdfe6cbd6bd3d64567788d3c6e15b1594e63bef276", size = 362704, upload-time = "2025-12-06T20:25:40.232Z" },
-    { url = "https://files.pythonhosted.org/packages/42/62/9233d99c1be673188afde322aecc467653023185077064dd3eac18678e22/backports_zstd-1.2.0-cp313-cp313t-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:9a0e5f6aebd1ff3c75b26d3e3ac3140996b9f0883b95847fad57992be06fe5d2", size = 507870, upload-time = "2025-12-06T20:25:41.364Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/b0/089867ef455f6311caa9224e68020cabcbfc3f8759cfd19931b06ba7bb8d/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7b12f415fe62f1e9f7196ce9eaedc699547c38cc263e64b6939b610b2a29a200", size = 475770, upload-time = "2025-12-06T20:25:42.873Z" },
-    { url = "https://files.pythonhosted.org/packages/43/d5/8615151ea4bcf5d2dca0755bfa7cad97b7cb8dbd1c9c2e1da57081f1d8a6/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:00066e7c3df700fe0df66aa197dcbd3d691d55c16f6179c3acd87a6ca22e7993", size = 581191, upload-time = "2025-12-06T20:25:44.156Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/71/eb6e7019db30622d2a31faa0e608fc3dc29e336b4a855bd5b0e78ac0943e/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c56bdb8e57563d726ce46225011801ff748018cbeff5175576f8a46868e0f706", size = 640185, upload-time = "2025-12-06T20:25:45.348Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/64/ebd64f84875f7feb83005bfc3e7352700d26f5396e7e5e494681af18fe18/backports_zstd-1.2.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9f499ec4944c223814be97627d0f1b65c2474ba981e1f21ec8b541f2dff5f960", size = 495073, upload-time = "2025-12-06T20:25:46.546Z" },
-    { url = "https://files.pythonhosted.org/packages/45/a7/8f44bbd2a78855680c24e7f90cad69c0c70650f345c4cf13bc7a6dd56231/backports_zstd-1.2.0-cp313-cp313t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7a0957bc3eb84b4a537388c7a62ed055d61c2246c11babf4cbaafb3b5eda0a9c", size = 570664, upload-time = "2025-12-06T20:25:47.731Z" },
-    { url = "https://files.pythonhosted.org/packages/85/e3/476a8b3ac1d7d1b41442bf634603d0beb392d9df2a1439f9543312b67bc3/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e38b22cb32bd9010ad65c0b75a2934448adfdd6bba4387b0f9bacce11e051716", size = 482252, upload-time = "2025-12-06T20:25:49.166Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/2f/cebac7f4dc977da1dfbef4004dae6ae12e31f6978db34af530425568dea7/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:9af83bbd56f785dffc9a669918e7e7b7f96b0e32fd8877ff90e445ca531463ae", size = 511631, upload-time = "2025-12-06T20:25:50.4Z" },
-    { url = "https://files.pythonhosted.org/packages/22/29/1e9a135af0141d0e0eabb21491f0f058e73ddb4de356ca174406d60d1dd6/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:e3ddf78b1b58291616df13844d5a0e6027b0ce299b15d7d3be2a93b974b7b5f6", size = 585764, upload-time = "2025-12-06T20:25:51.998Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/17/e9b29c3d7c4d13e046876fb81b7564a85463d6ab65c10f7fc42a7c658042/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:93332bf758954da70b1803ccc73697c7cdec475e4ec04286ff8c568f3786c398", size = 568581, upload-time = "2025-12-06T20:25:53.895Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/b5/e2f2f68c204743a9060e50f6910fd7ae1b484250460fa85e843292e8e8d8/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:8f5ba6a97712794ab9c284382a5faefd31ebcb84fa55cb4621e948264dbc6b97", size = 630790, upload-time = "2025-12-06T20:25:55.071Z" },
-    { url = "https://files.pythonhosted.org/packages/78/ff/87fc0e498e6c4ad475da178a4e4c81fbfaf19b043ca586a63068ad704f49/backports_zstd-1.2.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:9d541c0c1992ac25bfd836a1e77cf0e70f18d5505aeeebc56c2cf06ffbc209f5", size = 499701, upload-time = "2025-12-06T20:25:56.265Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/2e/e10d1b10f087094a108f542b91b44efe928800b6ecd8f1619c9967b6da5b/backports_zstd-1.2.0-cp313-cp313t-win32.whl", hash = "sha256:6c2bc4f7154d5c166912c5b7ee6cbb3a921726d1c2cee7c0f1bfaae736f7c250", size = 289660, upload-time = "2025-12-06T20:25:57.753Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/ae/68e5bca7f9990c45c7b1940deccfa4a106c956c5ddd63393332372dad131/backports_zstd-1.2.0-cp313-cp313t-win_amd64.whl", hash = "sha256:2b7b83331878041a259ec0b384bee7dbfd486b2a2579cd730aca718897d045d7", size = 315026, upload-time = "2025-12-06T20:25:58.952Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/33/a519b4da2015069fb36cded5181ff078ecceb852861b675e2c79547ad10d/backports_zstd-1.2.0-cp313-cp313t-win_arm64.whl", hash = "sha256:a884be79cd0897436e1e06566d0b6bcad2360afca8e8e27fb19422ba0cca4d7a", size = 289583, upload-time = "2025-12-06T20:26:00.127Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/03/0be0f44bfd5a77b6dc476eae791bb2847f786bef717aab510b0764aba2f9/backports_zstd-1.2.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:f94f434e2265c067a7e6e2ea50f93e709421f2c9e4a2458a80284065a79caefd", size = 410041, upload-time = "2025-12-06T20:26:23.148Z" },
-    { url = "https://files.pythonhosted.org/packages/cb/7a/1d2390341fb97e9fa9c3242dce6825646bd6f47d96ca862bf070dce0c943/backports_zstd-1.2.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:0d9e4d77f03524b59bc2d8d9636e5d808e50ef0d20c56f0ab2ab8ee00b6a367a", size = 339556, upload-time = "2025-12-06T20:26:24.718Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/21/36a2a17f5cd360ddd89bc6d24d2cfb1f6b1e4051fe70da9e172697763d7d/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:5d8014aeaec1f47f3209bd5e9e29282fcafa7b9076f89cc342a5dab3f298fdec", size = 420605, upload-time = "2025-12-06T20:26:25.872Z" },
-    { url = "https://files.pythonhosted.org/packages/87/e3/ee54f99fda973cf18dcb5ef7fb481449b1e5770af4f449ac06af77c995d2/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:35b8390fde5644a067a66cbd6f1b1293f48264f7bd867f0148b09d4f206005bf", size = 394149, upload-time = "2025-12-06T20:26:27.57Z" },
-    { url = "https://files.pythonhosted.org/packages/36/d6/1e41a5469606fbe100b4841f03c42275a1b114fa02921cbdedb0aadeaa00/backports_zstd-1.2.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fb3b0e175170422b1d095709356cb688b664d381f3dba424ae5107990ca913ee", size = 414113, upload-time = "2025-12-06T20:26:29.072Z" },
-    { url = "https://files.pythonhosted.org/packages/46/68/26c9802339a885f567f1c7bbfa5d5b786545e5bb754ba385f81dd6d2ccc1/backports_zstd-1.2.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:5f7e28d44e322c16aaf8973ce3c062105b6d88fe2b4f4611b40e410176a4fd40", size = 299966, upload-time = "2025-12-06T20:26:30.333Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/b1/2b7b0e1dcd165cf0e0fc792b74138489bfb90d66d7ded86f7f7e91f6764c/backports_zstd-1.2.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:1c3a1748eaac8fd1c862d3e16c6beb023f118a82d7230a32d33f6ce65752a2d6", size = 409938, upload-time = "2025-12-06T20:26:31.55Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/ce/c91b6a4681eb8f13c7919ce551d4b5364e9fd6f07e770e4e01ca2c0b1f92/backports_zstd-1.2.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:9e126bd32c97b1f4717d30530a3762c1f9a85d5d629fdc2ad210e6427fd6849c", size = 339472, upload-time = "2025-12-06T20:26:32.765Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/e6/abb1b8e6e5c9dfb8cbf05669745de81273b46fef5bafee00fb1698c75ce8/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:e4524beed644c4074ff017e96afc91c5e98064f40680fa859bddee5974641805", size = 420603, upload-time = "2025-12-06T20:26:34.374Z" },
-    { url = "https://files.pythonhosted.org/packages/50/2e/ca206b678cdbd2eca56aa2ce49996f6d6cd21db840efa6e2e6f73d4cb7db/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72bc2b03590d66d8706e4717da25cc6c192f5a6bfc3f6148f671f79e73afd4e8", size = 394149, upload-time = "2025-12-06T20:26:35.563Z" },
-    { url = "https://files.pythonhosted.org/packages/50/c2/ba7bcfe28dc3f8e8848419757883c8a0c7a4263dcd5d3988dd7f49818ca8/backports_zstd-1.2.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:89afe7d6e86bedbf2bac083beb096732a1e92025a5efa9c972941a6140994485", size = 414114, upload-time = "2025-12-06T20:26:36.808Z" },
-    { url = "https://files.pythonhosted.org/packages/71/ad/d5e8a3b28150e4f310999ef26db1e6b5f3bbb899c07d88ebd910954fcaf2/backports_zstd-1.2.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:f00066de6ffd72c653b43afb9aaa36969fd0e2c91f66adb45a11f73e6423263a", size = 299968, upload-time = "2025-12-06T20:26:38.382Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/f4/b1/36a5182ce1d8ef9ef32bff69037bd28b389bbdb66338f8069e61da7028cb/backports_zstd-1.3.0.tar.gz", hash = "sha256:e8b2d68e2812f5c9970cabc5e21da8b409b5ed04e79b4585dbffa33e9b45ebe2", size = 997138, upload-time = "2025-12-29T17:28:06.143Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/76/70/766f6ebbb9db2ed75951f0a671ee15931dc69278c84d9f09b08dd6b67c3e/backports_zstd-1.3.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a2db17a6d9bf6b4dc223b3f6414aa9db6d1afe9de9bff61d582c2934ca456a0", size = 435664, upload-time = "2025-12-29T17:25:29.201Z" },
+    { url = "https://files.pythonhosted.org/packages/55/f8/7b3fad9c6ee5ff3bcd7c941586675007330197ff4a388f01c73198ecc8bb/backports_zstd-1.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a7f16b98ba81780a9517ce6c493e1aea9b7d72de2b1efa08375136c270e1ecba", size = 362060, upload-time = "2025-12-29T17:25:30.94Z" },
+    { url = "https://files.pythonhosted.org/packages/68/9e/cad0f508ed7c3fbd07398f22b5bf25aa0523fcf56c84c3def642909e80ae/backports_zstd-1.3.0-cp310-cp310-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:1124a169a647671ccb4654a0ef1d0b42d6735c45ce3d0adf609df22fb1f099db", size = 505958, upload-time = "2025-12-29T17:25:32.694Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/dc/96dc55c043b0d86e53ae9608b496196936244c1ecf7e95cdf66d0dbc0f23/backports_zstd-1.3.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8410fda08b36202d01ab4503f6787c763898888cb1a48c19fce94711563d3ee3", size = 475571, upload-time = "2025-12-29T17:25:33.9Z" },
+    { url = "https://files.pythonhosted.org/packages/20/48/d9c8c8c2a5ac57fc5697f1945254af31407b0c5f80335a175a7c215b4118/backports_zstd-1.3.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ab139d1fc0e91a697e82fa834e6404098802f11b6035607174776173ded9a2cc", size = 581199, upload-time = "2025-12-29T17:25:35.566Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/ca/7fe70d2d39ed39e26a6c6f6c1dd229f1ab889500d5c90b17527702b1a21e/backports_zstd-1.3.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6f3115d203f387f77c23b5461fb6678d282d4f276f9f39298ad242b00120afc7", size = 640846, upload-time = "2025-12-29T17:25:36.86Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/d8/5b8580469e70b72402212885bf19b9d31eaf23549b602e0c294edf380e25/backports_zstd-1.3.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:116f65cce84e215dfac0414924b051faf8d29dc7188cf3944dd1e5be8dd15a32", size = 491061, upload-time = "2025-12-29T17:25:38.721Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/dd/17a752263fccd1ba24184b7e89c14cd31553d512e2e5b065f38e63a0ba86/backports_zstd-1.3.0-cp310-cp310-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:04def169e4a9ae291298124da4e097c6d6545d0e93164f934b716da04d24630a", size = 565071, upload-time = "2025-12-29T17:25:40.372Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/81/df23d3fe664b2497ab2ec01dc012cb9304e7d568c67f50b1b324fb2d8cbb/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:481b586291ef02a250f03d4c31a37c9881e5e93556568abbd20ca1ad720d443f", size = 481518, upload-time = "2025-12-29T17:25:41.925Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/cd/e50dd85fde890c5d79e1ed5dc241f1c45f87b6c12571fdb60add57f2ee66/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:0290979eea67f7275fa42d5859cc5bea94f2c08cca6bc36396673476773d2bad", size = 509464, upload-time = "2025-12-29T17:25:43.844Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/bb/e429156e4b834837fe78b4f32ed512491aea39415444420c79ccd3aa0526/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:01c699d8c803dc9f9c9d6ede21b75ec99f45c3b411821011692befca538928cb", size = 585563, upload-time = "2025-12-29T17:25:45.038Z" },
+    { url = "https://files.pythonhosted.org/packages/95/c0/1a0d245325827242aefe76f4f3477ec183b996b8db5105698564f8303481/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:2c662912cfc1a5ebd1d2162ac651549d58bd3c97a8096130ec13c703fca355f2", size = 562889, upload-time = "2025-12-29T17:25:46.576Z" },
+    { url = "https://files.pythonhosted.org/packages/93/42/126b2bc7540a15452c3ebdf190ebfea8a8644e29b22f4e10e2a6aa2389e4/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:3180c8eb085396928e9946167e610aa625922b82c3e2263c5f17000556370168", size = 631423, upload-time = "2025-12-29T17:25:47.81Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/32/018e49657411582569032b7d1bb5d62e514aad8b44952de740ec6250588d/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5b9a8c75a294e7ffa18fc8425a763facc366435a8b442e4dffdc19fa9499a22c", size = 495122, upload-time = "2025-12-29T17:25:49.377Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/9e/cdd1d2e1d3612bb90d9cf9b23bea06f2155cdafccd8b6f28a1c4d7750004/backports_zstd-1.3.0-cp310-cp310-win32.whl", hash = "sha256:845defdb172385f17123d92a00d2e952d341e9ae310bfa2410c292bf03846034", size = 288573, upload-time = "2025-12-29T17:25:51.167Z" },
+    { url = "https://files.pythonhosted.org/packages/55/7c/2e9c80f08375bd14262cefa69297a926134f517c9955c0795eec5e1d470e/backports_zstd-1.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:43a9fea6299c801da85221e387b32d90a9ad7c62aa2a34edf525359ce5ad8f3a", size = 313506, upload-time = "2025-12-29T17:25:52.778Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/5d/fa67e8174f54db44eb33498abb7f98bea4f2329e873b225391bda0113a5e/backports_zstd-1.3.0-cp310-cp310-win_arm64.whl", hash = "sha256:df8473cb117e1316e6c6101f2724e025bd8f50af2dc009d0001c0aabfb5eb57c", size = 288688, upload-time = "2025-12-29T17:25:54.012Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/28/ed31a0e35feb4538a996348362051b52912d50f00d25c2d388eccef9242c/backports_zstd-1.3.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:249f90b39d3741c48620021a968b35f268ca70e35f555abeea9ff95a451f35f9", size = 435660, upload-time = "2025-12-29T17:25:55.207Z" },
+    { url = "https://files.pythonhosted.org/packages/00/0d/3db362169d80442adda9dd563c4f0bb10091c8c1c9a158037f4ecd53988e/backports_zstd-1.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:b0e71e83e46154a9d3ced6d4de9a2fea8207ee1e4832aeecf364dc125eda305c", size = 362056, upload-time = "2025-12-29T17:25:56.729Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/00/b67ba053a7d6f6dbe2f8a704b7d3a5e01b1d2e2e8edbc9b634f2702ef73c/backports_zstd-1.3.0-cp311-cp311-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:cbc6193acd21f96760c94dd71bf32b161223e8503f5277acb0a5ab54e5598957", size = 505957, upload-time = "2025-12-29T17:25:57.941Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/3e/2667c0ddb53ddf28667e330bf9fe92e8e17705a481c9b698e283120565f7/backports_zstd-1.3.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1df583adc0ae84a8d13d7139f42eade6d90182b1dd3e0d28f7df3c564b9fd55d", size = 475569, upload-time = "2025-12-29T17:25:59.075Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/86/4052473217bd954ccdffda5f7264a0e99e7c4ecf70c0f729845c6a45fc5a/backports_zstd-1.3.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d833fc23aa3cc2e05aeffc7cfadd87b796654ad3a7fb214555cda3f1db2d4dc2", size = 581196, upload-time = "2025-12-29T17:26:00.508Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/bd/064f6fdb61db3d2c473159ebc844243e650dc032de0f8208443a00127925/backports_zstd-1.3.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:142178fe981061f1d2a57c5348f2cd31a3b6397a35593e7a17dbda817b793a7f", size = 640888, upload-time = "2025-12-29T17:26:02.134Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/09/0822403f40932a165a4f1df289d41653683019e4fd7a86b63ed20e9b6177/backports_zstd-1.3.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5eed0a09a163f3a8125a857cb031be87ed052e4a47bc75085ed7fca786e9bb5b", size = 491100, upload-time = "2025-12-29T17:26:03.418Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/a3/f5ac28d74039b7e182a780809dc66b9dbfc893186f5d5444340bba135389/backports_zstd-1.3.0-cp311-cp311-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:60aa483fef5843749e993dde01229e5eedebca8c283023d27d6bf6800d1d4ce3", size = 565071, upload-time = "2025-12-29T17:26:05.022Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/ac/50209aeb92257a642ee987afa1e61d5b6731ab6bf0bff70905856e5aede6/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:ea0886c1b619773544546e243ed73f6d6c2b1ae3c00c904ccc9903a352d731e1", size = 481519, upload-time = "2025-12-29T17:26:06.255Z" },
+    { url = "https://files.pythonhosted.org/packages/08/1f/b06f64199fb4b2e9437cedbf96d0155ca08aeec35fe81d41065acd44762e/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:5e137657c830a5ce99be40a1d713eb1d246bae488ada28ff0666ac4387aebdd5", size = 509465, upload-time = "2025-12-29T17:26:07.602Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/37/2c365196e61c8fffbbc930ffd69f1ada7aa1c7210857b3e565031c787ac6/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:94048c8089755e482e4b34608029cf1142523a625873c272be2b1c9253871a72", size = 585552, upload-time = "2025-12-29T17:26:08.911Z" },
+    { url = "https://files.pythonhosted.org/packages/93/8d/c2c4f448bb6b6c9df17410eaedce415e8db0eb25b60d09a3d22a98294d09/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:d339c1ec40485e97e600eb9a285fb13169dbf44c5094b945788a62f38b96e533", size = 562893, upload-time = "2025-12-29T17:26:10.566Z" },
+    { url = "https://files.pythonhosted.org/packages/74/e8/2110d4d39115130f7514cbbcec673a885f4052bb68d15e41bc96a7558856/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:8aeee9210c54cf8bf83f4d263a6d0d6e7a0298aeb5a14a0a95e90487c5c3157c", size = 631462, upload-time = "2025-12-29T17:26:11.99Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/a8/d64b59ae0714fdace14e43873f794eff93613e35e3e85eead33a4f44cd80/backports_zstd-1.3.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ba7114a3099e5ea05cbb46568bd0e08bca2ca11e12c6a7b563a24b86b2b4a67f", size = 495125, upload-time = "2025-12-29T17:26:13.218Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/d8/bcff0a091fcf27172c57ae463e49d8dec6dc31e01d7e7bf1ae3aad9c3566/backports_zstd-1.3.0-cp311-cp311-win32.whl", hash = "sha256:08dfdfb85da5915383bfae680b6ac10ab5769ab22e690f9a854320720011ae8e", size = 288664, upload-time = "2025-12-29T17:26:14.791Z" },
+    { url = "https://files.pythonhosted.org/packages/28/1a/379061e2abf8c3150ad51c1baab9ac723e01cf7538860a6a74c48f8b73ee/backports_zstd-1.3.0-cp311-cp311-win_amd64.whl", hash = "sha256:d8aac2e7cdcc8f310c16f98a0062b48d0a081dbb82862794f4f4f5bdafde30a4", size = 313633, upload-time = "2025-12-29T17:26:16.31Z" },
+    { url = "https://files.pythonhosted.org/packages/35/e7/eca40858883029fc716660106069b23253e2ec5fd34e86b4101c8cfe864b/backports_zstd-1.3.0-cp311-cp311-win_arm64.whl", hash = "sha256:440ef1be06e82dc0d69dbb57177f2ce98bbd2151013ee7e551e2f2b54caa6120", size = 288814, upload-time = "2025-12-29T17:26:17.571Z" },
+    { url = "https://files.pythonhosted.org/packages/72/d4/356da49d3053f4bc50e71a8535631b57bc9ca4e8c6d2442e073e0ab41c44/backports_zstd-1.3.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:f4a292e357f3046d18766ce06d990ccbab97411708d3acb934e63529c2ea7786", size = 435972, upload-time = "2025-12-29T17:26:18.752Z" },
+    { url = "https://files.pythonhosted.org/packages/30/8f/dbe389e60c7e47af488520f31a4aa14028d66da5bf3c60d3044b571eb906/backports_zstd-1.3.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fb4c386f38323698991b38edcc9c091d46d4713f5df02a3b5c80a28b40e289ea", size = 362124, upload-time = "2025-12-29T17:26:19.995Z" },
+    { url = "https://files.pythonhosted.org/packages/55/4b/173beafc99e99e7276ce008ef060b704471e75124c826bc5e2092815da37/backports_zstd-1.3.0-cp312-cp312-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:f52523d2bdada29e653261abdc9cfcecd9e5500d305708b7e37caddb24909d4e", size = 506378, upload-time = "2025-12-29T17:26:21.855Z" },
+    { url = "https://files.pythonhosted.org/packages/df/c8/3f12a411d9a99d262cdb37b521025eecc2aa7e4a93277be3f4f4889adb74/backports_zstd-1.3.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3321d00beaacbd647252a7f581c1e1cdbdbda2407f2addce4bfb10e8e404b7c7", size = 476201, upload-time = "2025-12-29T17:26:23.047Z" },
+    { url = "https://files.pythonhosted.org/packages/43/dc/73c090e4a2d5671422512e1b6d276ca6ea0cc0c45ec4634789106adc0d66/backports_zstd-1.3.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:88f94d238ef36c639c0ae17cf41054ce103da9c4d399c6a778ce82690d9f4919", size = 581659, upload-time = "2025-12-29T17:26:24.189Z" },
+    { url = "https://files.pythonhosted.org/packages/08/4f/11bfcef534aa2bf3f476f52130217b45337f334d8a287edb2e06744a6515/backports_zstd-1.3.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:97d8c78fe20c7442c810adccfd5e3ea6a4e6f4f1fa4c73da2bc083260ebead17", size = 640388, upload-time = "2025-12-29T17:26:25.47Z" },
+    { url = "https://files.pythonhosted.org/packages/71/17/8faea426d4f49b63238bdfd9f211a9f01c862efe0d756d3abeb84265a4e2/backports_zstd-1.3.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:eefda80c3dbfbd924f1c317e7b0543d39304ee645583cb58bae29e19f42948ed", size = 494173, upload-time = "2025-12-29T17:26:26.736Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/9d/901f19ac90f3cd999bdcfb6edb4d7b4dc383dfba537f06f533fc9ac4777b/backports_zstd-1.3.0-cp312-cp312-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:2ab5d3b5a54a674f4f6367bb9e0914063f22cd102323876135e9cc7a8f14f17e", size = 568628, upload-time = "2025-12-29T17:26:28.12Z" },
+    { url = "https://files.pythonhosted.org/packages/60/39/4d29788590c2465a570c2fae49dbff05741d1f0c8e4a0fb2c1c310f31804/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:7558fb0e8c8197c59a5f80c56bf8f56c3690c45fd62f14e9e2081661556e3e64", size = 482233, upload-time = "2025-12-29T17:26:29.399Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/24c7c9e8ef384b19d515a7b1644a500ceb3da3baeff6d579687da1a0f62b/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:27744870e38f017159b9c0241ea51562f94c7fefcfa4c5190fb3ec4a65a7fc63", size = 509806, upload-time = "2025-12-29T17:26:30.605Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/7e/7ba1aeecf0b5859f1855c0e661b4559566b64000f0627698ebd9e83f2138/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:b099750755bb74c280827c7d68de621da0f245189082ab48ff91bda0ec2db9df", size = 586037, upload-time = "2025-12-29T17:26:32.201Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/1a/18f0402b36b9cfb0aea010b5df900cfd42c214f37493561dba3abac90c4e/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5434e86f2836d453ae3e19a2711449683b7e21e107686838d12a255ad256ca99", size = 566220, upload-time = "2025-12-29T17:26:33.5Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/d9/44c098ab31b948bbfd909ec4ae08e1e44c5025a2d846f62991a62ab3ebea/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:407e451f64e2f357c9218f5be4e372bb6102d7ae88582d415262a9d0a4f9b625", size = 630847, upload-time = "2025-12-29T17:26:35.273Z" },
+    { url = "https://files.pythonhosted.org/packages/30/33/e74cb2cfb162d2e9e00dad8bcdf53118ca7786cfd467925d6864732f79cc/backports_zstd-1.3.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:58a071f3c198c781b2df801070290b7174e3ff61875454e9df93ab7ea9ea832b", size = 498665, upload-time = "2025-12-29T17:26:37.123Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/a9/67a24007c333ed22736d5cd79f1aa1d7209f09be772ff82a8fd724c1978e/backports_zstd-1.3.0-cp312-cp312-win32.whl", hash = "sha256:21a9a542ccc7958ddb51ae6e46d8ed25d585b54d0d52aaa1c8da431ea158046a", size = 288809, upload-time = "2025-12-29T17:26:38.373Z" },
+    { url = "https://files.pythonhosted.org/packages/42/24/34b816118ea913debb2ea23e71ffd0fb2e2ac738064c4ac32e3fb62c18bb/backports_zstd-1.3.0-cp312-cp312-win_amd64.whl", hash = "sha256:89ea8281821123b071a06b30b80da8e4d8a2b40a4f57315a19850337a21297ac", size = 313815, upload-time = "2025-12-29T17:26:39.665Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/2f/babd02c9fc4ca35376ada7c291193a208165c7be2455f0f98bc1e1243f31/backports_zstd-1.3.0-cp312-cp312-win_arm64.whl", hash = "sha256:f6843ecb181480e423b02f60fe29e393cbc31a95fb532acdf0d3a2c87bd50ce3", size = 288927, upload-time = "2025-12-29T17:26:40.923Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/7d/53e8da5950cdfc5e8fe23efd5165ce2f4fed5222f9a3292e0cdb03dd8c0d/backports_zstd-1.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e86e03e3661900955f01afed6c59cae9baa63574e3b66896d99b7de97eaffce9", size = 435463, upload-time = "2025-12-29T17:26:42.152Z" },
+    { url = "https://files.pythonhosted.org/packages/da/78/f98e53870f7404071a41e3d04f2ff514302eeeb3279d931d02b220f437aa/backports_zstd-1.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:41974dcacc9824c1effe1c8d2f9d762bcf47d265ca4581a3c63321c7b06c61f0", size = 361740, upload-time = "2025-12-29T17:26:43.377Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/ed/2c64706205a944c9c346d95c17f632d4e3468db3ce60efb6f5caa7c0dcae/backports_zstd-1.3.0-cp313-cp313-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:3090a97738d6ce9545d3ca5446df43370928092a962cbc0153e5445a947e98ed", size = 505651, upload-time = "2025-12-29T17:26:44.495Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/7b/22998f691dc6e0c7e6fa81d611eb4b1f6a72fb27327f322366d4a7ca8fb3/backports_zstd-1.3.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ddc874638abf03ea1ff3b0525b4a26a8d0adf7cb46a448c3449f08e4abc276b3", size = 475859, upload-time = "2025-12-29T17:26:45.722Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/78/0cde898339a339530e5f932634872d2d64549969535447a48d3b98959e11/backports_zstd-1.3.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:db609e57b8ed88b3472930c87e93c08a4bbd5ffeb94608cd9c7c6f0ac0e166c6", size = 581339, upload-time = "2025-12-29T17:26:46.93Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/1d/e0973e0eebe678c12c146473af2c54cda8a3e63b179785ca1a20727ad69c/backports_zstd-1.3.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5f13033a3dd95f323c067199f2e61b4589a7880188ef4ef356c7ffbdb78a9f11", size = 642182, upload-time = "2025-12-29T17:26:48.545Z" },
+    { url = "https://files.pythonhosted.org/packages/82/a2/ac67e79e137eb98aead66c7162bafe3cffcb82ef9cdeb6367ec18d88fbce/backports_zstd-1.3.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c4c7bcda5619a754726e7f5b391827f5efbe4bed8e62e9ec7490d42bff18aa6", size = 490807, upload-time = "2025-12-29T17:26:49.789Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/e9/3514b1d065801ae7dce05246e9389003ed8fb1d7c3d71f85aa07a80f41e6/backports_zstd-1.3.0-cp313-cp313-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:884a94c40f27affe986f394f219a4fd3cbbd08e1cff2e028d29d467574cd266e", size = 566103, upload-time = "2025-12-29T17:26:51.062Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/03/10ddb54cbf032e5fe390c0776d3392611b1fc772d6c3cb5a9bcdff4f915f/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:497f5765126f11a5b3fd8fedfdae0166d1dd867e7179b8148370a3313d047197", size = 481614, upload-time = "2025-12-29T17:26:52.255Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/13/21efa7f94c41447f43aee1563b05fc540a235e61bce4597754f6c11c2e97/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:a6ff6769948bb29bba07e1c2e8582d5a9765192a366108e42d6581a458475881", size = 509207, upload-time = "2025-12-29T17:26:53.496Z" },
+    { url = "https://files.pythonhosted.org/packages/de/e7/12da9256d9e49e71030f0ff75e9f7c258e76091a4eaf5b5f414409be6a57/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:1623e5bff1acd9c8ef90d24fc548110f20df2d14432bfe5de59e76fc036824ef", size = 585765, upload-time = "2025-12-29T17:26:54.99Z" },
+    { url = "https://files.pythonhosted.org/packages/24/bf/59ca9cb4e7be1e59331bb792e8ef1331828efe596b1a2f8cbbc4e3f70d75/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:622c28306dcc429c8f2057fc4421d5722b1f22968d299025b35d71b50cfd4e03", size = 563852, upload-time = "2025-12-29T17:26:56.371Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/ee/5a3eaed9a73bdf2c35dc0c7adc0616a99588e0de28f5ab52f3e0caaaa96f/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:09a2785e410ed2e812cb39b684ef5eb55083a5897bfd0e6f5de3bbd2c6345f70", size = 632549, upload-time = "2025-12-29T17:26:57.598Z" },
+    { url = "https://files.pythonhosted.org/packages/75/b9/c823633afc48a1ac56d6ad34289c8f51b0234685142531bfa8197ca91777/backports_zstd-1.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ade1f4127fdbe36a02f8067d75aa79c1ea1c8a306bf63c7b818bb7b530e1beaa", size = 495104, upload-time = "2025-12-29T17:26:58.826Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/8f/6f7030f18fa7307f87b0f57108a50a3a540b6350e2486d1739c0567629a3/backports_zstd-1.3.0-cp313-cp313-win32.whl", hash = "sha256:668e6fb1805b825cb7504c71436f7b28d4d792bb2663ee901ec9a2bb15804437", size = 288447, upload-time = "2025-12-29T17:27:00.036Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/82/b1df1bbbe4e6d3ffd364d0bcffdeb6c4361115c1eccd91238dbdd0c07fec/backports_zstd-1.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:385bdadf0ea8fe6ba780a95e4c7d7f018db7bafdd630932f0f9f0fad05d608ff", size = 313664, upload-time = "2025-12-29T17:27:01.267Z" },
+    { url = "https://files.pythonhosted.org/packages/45/0f/60918fe4d3f2881de8f4088d73be4837df9e4c6567594109d355a2d548b6/backports_zstd-1.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:4321a8a367537224b3559fe7aeb8012b98aea2a60a737e59e51d86e2e856fe0a", size = 288678, upload-time = "2025-12-29T17:27:02.506Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/b9/35f423c0bcd85020d5e7be6ab8d7517843e3e4441071beb5c3bd8c5216cb/backports_zstd-1.3.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:10057d66fa4f0a7d3f6419ffb84b4fe61088da572e3ac4446134a1c8089e4166", size = 436155, upload-time = "2025-12-29T17:27:03.859Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/14/e504daea24e8916f14ecbc223c354b558d8410cfc846606668ab91d96b38/backports_zstd-1.3.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4abf29d706ba05f658ca0247eb55675bcc00e10f12bca15736e45b05f1f2d2dc", size = 362436, upload-time = "2025-12-29T17:27:05.076Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f7/06e178dbab7edb88c2872aebd68b54137e07a169eba1aeedf614014f7036/backports_zstd-1.3.0-cp313-cp313t-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:127b0d73c745b0684da3d95c31c0939570810dad8967dfe8231eea8f0e047b2f", size = 507600, upload-time = "2025-12-29T17:27:06.254Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/f1/2ce499b81c4389d6fa1eeea7e76f6e0bad48effdbb239da7cbcdaaf24b76/backports_zstd-1.3.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0205ef809fb38bb5ca7f59fa03993596f918768b9378fb7fbd8a68889a6ce028", size = 475496, upload-time = "2025-12-29T17:27:07.939Z" },
+    { url = "https://files.pythonhosted.org/packages/18/1e/c82a586f2866aabf3a601a521af3c58756d83d98b724fda200016ac5e7e2/backports_zstd-1.3.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1c389b667b0b07915781aa28beabf2481f11a6062a1a081873c4c443b98601a7", size = 580919, upload-time = "2025-12-29T17:27:09.1Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/a3/eb5d9b7c4cb69d1b8ccd011abe244ba6815693b70bed07ed4b77ddda4535/backports_zstd-1.3.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8e7ac5ef693d49d6fb35cd7bbb98c4762cfea94a8bd2bf2ab112027004f70b11", size = 639913, upload-time = "2025-12-29T17:27:10.433Z" },
+    { url = "https://files.pythonhosted.org/packages/11/2c/7296b99df79d9f31174a99c81c1964a32de8996ce2b3068f5bc66b413615/backports_zstd-1.3.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5d5543945aae2a76a850b23f283249424f535de6a622d6002957b7d971e6a36d", size = 494800, upload-time = "2025-12-29T17:27:11.59Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/fc/b8ae6e104ba72d20cd5f9dfd9baee36675e89c81d432434927967114f30f/backports_zstd-1.3.0-cp313-cp313t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e38be15ebce82737deda2c9410c1f942f1df9da74121049243a009810432db75", size = 570396, upload-time = "2025-12-29T17:27:13.063Z" },
+    { url = "https://files.pythonhosted.org/packages/30/56/60a7a9de7a5bc951ea1106358b413c95183c93480394f3abc541313c8679/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e3e3f58c76f4730607a4e0130d629173aa114ae72a5c8d3d5ad94e1bf51f18d8", size = 481980, upload-time = "2025-12-29T17:27:14.317Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/bb/93fc1e8e81b8ecba58b0e53a14f7b44375cf837db6354410998f0c4cb6ff/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:b808bf889722d889b792f7894e19c1f904bb0e9092d8c0eb0787b939b08bad9a", size = 511358, upload-time = "2025-12-29T17:27:15.669Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/0f/b165c2a6080d22306975cd86ce97270208493f31a298867e343110570370/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:f7be27d56f2f715bcd252d0c65c232146d8e1e039c7e2835b8a3ad3dc88bc508", size = 585492, upload-time = "2025-12-29T17:27:16.986Z" },
+    { url = "https://files.pythonhosted.org/packages/26/76/85b4bde76e982b24a7eb57a2fb9868807887bef4d2114a3654a6530a67ef/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:cbe341c7fcc723893663a37175ba859328b907a4e6d2d40a4c26629cc55efb67", size = 568309, upload-time = "2025-12-29T17:27:18.28Z" },
+    { url = "https://files.pythonhosted.org/packages/83/64/9490667827a320766fb883f358a7c19171fdc04f19ade156a8c341c36967/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:b4116a9e12dfcd834dd9132cf6a94657bf0d328cba5b295f26de26ea0ae1adc8", size = 630518, upload-time = "2025-12-29T17:27:19.525Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/43/258587233b728bbff457bdb0c52b3e08504c485a8642b3daeb0bdd5a76bc/backports_zstd-1.3.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:1049e804cc8754290b24dab383d4d6ed0b7f794ad8338813ddcb3907d15a89d0", size = 499429, upload-time = "2025-12-29T17:27:21.063Z" },
+    { url = "https://files.pythonhosted.org/packages/32/04/cfab76878f360f124dbb533779e1e4603c801a0f5ada72ae5c742b7c4d7d/backports_zstd-1.3.0-cp313-cp313t-win32.whl", hash = "sha256:7d3f0f2499d2049ec53d2674c605a4b3052c217cc7ee49c05258046411685adc", size = 289389, upload-time = "2025-12-29T17:27:22.287Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/ff/dbcfb6c9c922ab6d98f3d321e7d0c7b34ecfa26f3ca71d930fe1ef639737/backports_zstd-1.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:eb2f8fab0b1ea05148394cb34a9e543a43477178765f2d6e7c84ed332e34935e", size = 314776, upload-time = "2025-12-29T17:27:23.458Z" },
+    { url = "https://files.pythonhosted.org/packages/01/4b/82e4baae3117806639fe1c693b1f2f7e6133a7cefd1fa2e38018c8edcd68/backports_zstd-1.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:c66ad9eb5bfbe28c2387b7fc58ddcdecfb336d6e4e60bcba1694a906c1f21a6c", size = 289315, upload-time = "2025-12-29T17:27:24.601Z" },
+    { url = "https://files.pythonhosted.org/packages/95/b7/e843d32122f25d9568e75d1e7a29c00eae5e5728015604f3f6d02259b3a5/backports_zstd-1.3.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3ab0d5632b84eff4355c42a04668cfe6466f7d390890f718978582bd1ff36949", size = 409771, upload-time = "2025-12-29T17:27:48.869Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/a5/d6a897d4b91732f54b4506858f1da65d7a5b2dc0dbe36a23992a64f09f5a/backports_zstd-1.3.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b97cea95dbb1a97c02afd718155fad93f747815069722107a429804c355e206", size = 339289, upload-time = "2025-12-29T17:27:50.055Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/b0/f0ce566ec221b284508eebbf574a779ba4a8932830db6ea03b6176f336a2/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:477895f2642f9397aeba69618df2c91d7f336e02df83d1e623ac37c5d3a5115e", size = 420335, upload-time = "2025-12-29T17:27:51.455Z" },
+    { url = "https://files.pythonhosted.org/packages/62/6d/bf55652c84c79b2565d3087265bcb097719540a313dee16359a54d83ab4e/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:330172aaf5fd3bfa53f49318abc6d1d4238cb043c384cf71f7b8f0fe2fb7ce31", size = 393880, upload-time = "2025-12-29T17:27:52.869Z" },
+    { url = "https://files.pythonhosted.org/packages/be/e0/d1feebb70ffeb150e2891c6f09700079f4a60085ebc67529eb1ca72fb5c2/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:32974e71eff15897ed3f8b7766a753d9f3197ea4f1c9025d80f8de099a691b99", size = 413840, upload-time = "2025-12-29T17:27:54.527Z" },
+    { url = "https://files.pythonhosted.org/packages/36/28/3b7be27ae51e418d3a724bbc4cb7fea77b6bd38b5007e333a56b0cb165c8/backports_zstd-1.3.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:993e3a34eaba5928a2065545e34bf75c65b9c34ecb67e43d5ef49b16cc182077", size = 299685, upload-time = "2025-12-29T17:27:56.149Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/d9/8c9c246e5ea79a4f45d551088b11b61f2dc7efcdc5dbe6df3be84a506e0c/backports_zstd-1.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:968167d29f012cee7b112ad031a8925e484e97e99288e55e4d62962c3a1013e3", size = 409666, upload-time = "2025-12-29T17:27:57.37Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/4f/a55b33c314ca8c9074e99daab54d04c5d212070ae7dbc435329baf1b139e/backports_zstd-1.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d8f6fc7d62b71083b574193dd8fb3a60e6bb34880cc0132aad242943af301f7a", size = 339199, upload-time = "2025-12-29T17:27:58.542Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/13/ce31bd048b1c88d0f65d7af60b6cf89cfbed826c7c978f0ebca9a8a71cfc/backports_zstd-1.3.0-pp311-pypy311_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:e0f2eca6aac280fdb77991ad3362487ee91a7fb064ad40043fb5a0bf5a376943", size = 420332, upload-time = "2025-12-29T17:28:00.332Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/80/c0cdbc533d0037b57248588403a3afb050b2a83b8c38aa608e31b3a4d600/backports_zstd-1.3.0-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:676eb5e177d4ef528cf3baaeea4fffe05f664e4dd985d3ac06960ef4619c81a9", size = 393879, upload-time = "2025-12-29T17:28:01.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/38/c97428867cac058ed196ccaeddfdf82ecd43b8a65965f2950a6e7547e77a/backports_zstd-1.3.0-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:199eb9bd8aca6a9d489c41a682fad22c587dffe57b613d0fe6d492d0d38ce7c5", size = 413842, upload-time = "2025-12-29T17:28:03.113Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/ec/6247be6536668fe1c7dfae3eaa9c94b00b956b716957c0fc986ba78c3cc4/backports_zstd-1.3.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:2524bd6777a828d5e7ccd7bd1a57f9e7007ae654fc2bd1bc1a207f6428674e4a", size = 299684, upload-time = "2025-12-29T17:28:04.856Z" },
 ]
 
 [[package]]
@@ -347,101 +347,101 @@ wheels = [
 
 [[package]]
 name = "coverage"
-version = "7.13.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/b6/45/2c665ca77ec32ad67e25c77daf1cee28ee4558f3bc571cdbaf88a00b9f23/coverage-7.13.0.tar.gz", hash = "sha256:a394aa27f2d7ff9bc04cf703817773a59ad6dfbd577032e690f961d2460ee936", size = 820905, upload-time = "2025-12-08T13:14:38.055Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/db/08/bdd7ccca14096f7eb01412b87ac11e5d16e4cb54b6e328afc9dee8bdaec1/coverage-7.13.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:02d9fb9eccd48f6843c98a37bd6817462f130b86da8660461e8f5e54d4c06070", size = 217979, upload-time = "2025-12-08T13:12:14.505Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/f0/d1302e3416298a28b5663ae1117546a745d9d19fde7e28402b2c5c3e2109/coverage-7.13.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:367449cf07d33dc216c083f2036bb7d976c6e4903ab31be400ad74ad9f85ce98", size = 218496, upload-time = "2025-12-08T13:12:16.237Z" },
-    { url = "https://files.pythonhosted.org/packages/07/26/d36c354c8b2a320819afcea6bffe72839efd004b98d1d166b90801d49d57/coverage-7.13.0-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:cdb3c9f8fef0a954c632f64328a3935988d33a6604ce4bf67ec3e39670f12ae5", size = 245237, upload-time = "2025-12-08T13:12:17.858Z" },
-    { url = "https://files.pythonhosted.org/packages/91/52/be5e85631e0eec547873d8b08dd67a5f6b111ecfe89a86e40b89b0c1c61c/coverage-7.13.0-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:d10fd186aac2316f9bbb46ef91977f9d394ded67050ad6d84d94ed6ea2e8e54e", size = 247061, upload-time = "2025-12-08T13:12:19.132Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/45/a5e8fa0caf05fbd8fa0402470377bff09cc1f026d21c05c71e01295e55ab/coverage-7.13.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f88ae3e69df2ab62fb0bc5219a597cb890ba5c438190ffa87490b315190bb33", size = 248928, upload-time = "2025-12-08T13:12:20.702Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/42/ffb5069b6fd1b95fae482e02f3fecf380d437dd5a39bae09f16d2e2e7e01/coverage-7.13.0-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c4be718e51e86f553bcf515305a158a1cd180d23b72f07ae76d6017c3cc5d791", size = 245931, upload-time = "2025-12-08T13:12:22.243Z" },
-    { url = "https://files.pythonhosted.org/packages/95/6e/73e809b882c2858f13e55c0c36e94e09ce07e6165d5644588f9517efe333/coverage-7.13.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:a00d3a393207ae12f7c49bb1c113190883b500f48979abb118d8b72b8c95c032", size = 246968, upload-time = "2025-12-08T13:12:23.52Z" },
-    { url = "https://files.pythonhosted.org/packages/87/08/64ebd9e64b6adb8b4a4662133d706fbaccecab972e0b3ccc23f64e2678ad/coverage-7.13.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:3a7b1cd820e1b6116f92c6128f1188e7afe421c7e1b35fa9836b11444e53ebd9", size = 244972, upload-time = "2025-12-08T13:12:24.781Z" },
-    { url = "https://files.pythonhosted.org/packages/12/97/f4d27c6fe0cb375a5eced4aabcaef22de74766fb80a3d5d2015139e54b22/coverage-7.13.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:37eee4e552a65866f15dedd917d5e5f3d59805994260720821e2c1b51ac3248f", size = 245241, upload-time = "2025-12-08T13:12:28.041Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/94/42f8ae7f633bf4c118bf1038d80472f9dade88961a466f290b81250f7ab7/coverage-7.13.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:62d7c4f13102148c78d7353c6052af6d899a7f6df66a32bddcc0c0eb7c5326f8", size = 245847, upload-time = "2025-12-08T13:12:29.337Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/2f/6369ca22b6b6d933f4f4d27765d313d8914cc4cce84f82a16436b1a233db/coverage-7.13.0-cp310-cp310-win32.whl", hash = "sha256:24e4e56304fdb56f96f80eabf840eab043b3afea9348b88be680ec5986780a0f", size = 220573, upload-time = "2025-12-08T13:12:30.905Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/dc/a6a741e519acceaeccc70a7f4cfe5d030efc4b222595f0677e101af6f1f3/coverage-7.13.0-cp310-cp310-win_amd64.whl", hash = "sha256:74c136e4093627cf04b26a35dab8cbfc9b37c647f0502fc313376e11726ba303", size = 221509, upload-time = "2025-12-08T13:12:32.09Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/dc/888bf90d8b1c3d0b4020a40e52b9f80957d75785931ec66c7dfaccc11c7d/coverage-7.13.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0dfa3855031070058add1a59fdfda0192fd3e8f97e7c81de0596c145dea51820", size = 218104, upload-time = "2025-12-08T13:12:33.333Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/ea/069d51372ad9c380214e86717e40d1a743713a2af191cfba30a0911b0a4a/coverage-7.13.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4fdb6f54f38e334db97f72fa0c701e66d8479af0bc3f9bfb5b90f1c30f54500f", size = 218606, upload-time = "2025-12-08T13:12:34.498Z" },
-    { url = "https://files.pythonhosted.org/packages/68/09/77b1c3a66c2aa91141b6c4471af98e5b1ed9b9e6d17255da5eb7992299e3/coverage-7.13.0-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7e442c013447d1d8d195be62852270b78b6e255b79b8675bad8479641e21fd96", size = 248999, upload-time = "2025-12-08T13:12:36.02Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/32/2e2f96e9d5691eaf1181d9040f850b8b7ce165ea10810fd8e2afa534cef7/coverage-7.13.0-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:1ed5630d946859de835a85e9a43b721123a8a44ec26e2830b296d478c7fd4259", size = 250925, upload-time = "2025-12-08T13:12:37.221Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/45/b88ddac1d7978859b9a39a8a50ab323186148f1d64bc068f86fc77706321/coverage-7.13.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f15a931a668e58087bc39d05d2b4bf4b14ff2875b49c994bbdb1c2217a8daeb", size = 253032, upload-time = "2025-12-08T13:12:38.763Z" },
-    { url = "https://files.pythonhosted.org/packages/71/cb/e15513f94c69d4820a34b6bf3d2b1f9f8755fa6021be97c7065442d7d653/coverage-7.13.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:30a3a201a127ea57f7e14ba43c93c9c4be8b7d17a26e03bb49e6966d019eede9", size = 249134, upload-time = "2025-12-08T13:12:40.382Z" },
-    { url = "https://files.pythonhosted.org/packages/09/61/d960ff7dc9e902af3310ce632a875aaa7860f36d2bc8fc8b37ee7c1b82a5/coverage-7.13.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7a485ff48fbd231efa32d58f479befce52dcb6bfb2a88bb7bf9a0b89b1bc8030", size = 250731, upload-time = "2025-12-08T13:12:41.992Z" },
-    { url = "https://files.pythonhosted.org/packages/98/34/c7c72821794afc7c7c2da1db8f00c2c98353078aa7fb6b5ff36aac834b52/coverage-7.13.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:22486cdafba4f9e471c816a2a5745337742a617fef68e890d8baf9f3036d7833", size = 248795, upload-time = "2025-12-08T13:12:43.331Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/5b/e0f07107987a43b2def9aa041c614ddb38064cbf294a71ef8c67d43a0cdd/coverage-7.13.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:263c3dbccc78e2e331e59e90115941b5f53e85cfcc6b3b2fbff1fd4e3d2c6ea8", size = 248514, upload-time = "2025-12-08T13:12:44.546Z" },
-    { url = "https://files.pythonhosted.org/packages/71/c2/c949c5d3b5e9fc6dd79e1b73cdb86a59ef14f3709b1d72bf7668ae12e000/coverage-7.13.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:e5330fa0cc1f5c3c4c3bb8e101b742025933e7848989370a1d4c8c5e401ea753", size = 249424, upload-time = "2025-12-08T13:12:45.759Z" },
-    { url = "https://files.pythonhosted.org/packages/11/f1/bbc009abd6537cec0dffb2cc08c17a7f03de74c970e6302db4342a6e05af/coverage-7.13.0-cp311-cp311-win32.whl", hash = "sha256:0f4872f5d6c54419c94c25dd6ae1d015deeb337d06e448cd890a1e89a8ee7f3b", size = 220597, upload-time = "2025-12-08T13:12:47.378Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/f6/d9977f2fb51c10fbaed0718ce3d0a8541185290b981f73b1d27276c12d91/coverage-7.13.0-cp311-cp311-win_amd64.whl", hash = "sha256:51a202e0f80f241ccb68e3e26e19ab5b3bf0f813314f2c967642f13ebcf1ddfe", size = 221536, upload-time = "2025-12-08T13:12:48.7Z" },
-    { url = "https://files.pythonhosted.org/packages/be/ad/3fcf43fd96fb43e337a3073dea63ff148dcc5c41ba7a14d4c7d34efb2216/coverage-7.13.0-cp311-cp311-win_arm64.whl", hash = "sha256:d2a9d7f1c11487b1c69367ab3ac2d81b9b3721f097aa409a3191c3e90f8f3dd7", size = 220206, upload-time = "2025-12-08T13:12:50.365Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/f1/2619559f17f31ba00fc40908efd1fbf1d0a5536eb75dc8341e7d660a08de/coverage-7.13.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:0b3d67d31383c4c68e19a88e28fc4c2e29517580f1b0ebec4a069d502ce1e0bf", size = 218274, upload-time = "2025-12-08T13:12:52.095Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/11/30d71ae5d6e949ff93b2a79a2c1b4822e00423116c5c6edfaeef37301396/coverage-7.13.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:581f086833d24a22c89ae0fe2142cfaa1c92c930adf637ddf122d55083fb5a0f", size = 218638, upload-time = "2025-12-08T13:12:53.418Z" },
-    { url = "https://files.pythonhosted.org/packages/79/c2/fce80fc6ded8d77e53207489d6065d0fed75db8951457f9213776615e0f5/coverage-7.13.0-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0a3a30f0e257df382f5f9534d4ce3d4cf06eafaf5192beb1a7bd066cb10e78fb", size = 250129, upload-time = "2025-12-08T13:12:54.744Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/b6/51b5d1eb6fcbb9a1d5d6984e26cbe09018475c2922d554fd724dd0f056ee/coverage-7.13.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:583221913fbc8f53b88c42e8dbb8fca1d0f2e597cb190ce45916662b8b9d9621", size = 252885, upload-time = "2025-12-08T13:12:56.401Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/f8/972a5affea41de798691ab15d023d3530f9f56a72e12e243f35031846ff7/coverage-7.13.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f5d9bd30756fff3e7216491a0d6d520c448d5124d3d8e8f56446d6412499e74", size = 253974, upload-time = "2025-12-08T13:12:57.718Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/56/116513aee860b2c7968aa3506b0f59b22a959261d1dbf3aea7b4450a7520/coverage-7.13.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a23e5a1f8b982d56fa64f8e442e037f6ce29322f1f9e6c2344cd9e9f4407ee57", size = 250538, upload-time = "2025-12-08T13:12:59.254Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/75/074476d64248fbadf16dfafbf93fdcede389ec821f74ca858d7c87d2a98c/coverage-7.13.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:9b01c22bc74a7fb44066aaf765224c0d933ddf1f5047d6cdfe4795504a4493f8", size = 251912, upload-time = "2025-12-08T13:13:00.604Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/d2/aa4f8acd1f7c06024705c12609d8698c51b27e4d635d717cd1934c9668e2/coverage-7.13.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:898cce66d0836973f48dda4e3514d863d70142bdf6dfab932b9b6a90ea5b222d", size = 250054, upload-time = "2025-12-08T13:13:01.892Z" },
-    { url = "https://files.pythonhosted.org/packages/19/98/8df9e1af6a493b03694a1e8070e024e7d2cdc77adedc225a35e616d505de/coverage-7.13.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:3ab483ea0e251b5790c2aac03acde31bff0c736bf8a86829b89382b407cd1c3b", size = 249619, upload-time = "2025-12-08T13:13:03.236Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/71/f8679231f3353018ca66ef647fa6fe7b77e6bff7845be54ab84f86233363/coverage-7.13.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:1d84e91521c5e4cb6602fe11ece3e1de03b2760e14ae4fcf1a4b56fa3c801fcd", size = 251496, upload-time = "2025-12-08T13:13:04.511Z" },
-    { url = "https://files.pythonhosted.org/packages/04/86/9cb406388034eaf3c606c22094edbbb82eea1fa9d20c0e9efadff20d0733/coverage-7.13.0-cp312-cp312-win32.whl", hash = "sha256:193c3887285eec1dbdb3f2bd7fbc351d570ca9c02ca756c3afbc71b3c98af6ef", size = 220808, upload-time = "2025-12-08T13:13:06.422Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/59/af483673df6455795daf5f447c2f81a3d2fcfc893a22b8ace983791f6f34/coverage-7.13.0-cp312-cp312-win_amd64.whl", hash = "sha256:4f3e223b2b2db5e0db0c2b97286aba0036ca000f06aca9b12112eaa9af3d92ae", size = 221616, upload-time = "2025-12-08T13:13:07.95Z" },
-    { url = "https://files.pythonhosted.org/packages/64/b0/959d582572b30a6830398c60dd419c1965ca4b5fb38ac6b7093a0d50ca8d/coverage-7.13.0-cp312-cp312-win_arm64.whl", hash = "sha256:086cede306d96202e15a4b77ace8472e39d9f4e5f9fd92dd4fecdfb2313b2080", size = 220261, upload-time = "2025-12-08T13:13:09.581Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/cc/bce226595eb3bf7d13ccffe154c3c487a22222d87ff018525ab4dd2e9542/coverage-7.13.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:28ee1c96109974af104028a8ef57cec21447d42d0e937c0275329272e370ebcf", size = 218297, upload-time = "2025-12-08T13:13:10.977Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/9f/73c4d34600aae03447dff3d7ad1d0ac649856bfb87d1ca7d681cfc913f9e/coverage-7.13.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d1e97353dcc5587b85986cda4ff3ec98081d7e84dd95e8b2a6d59820f0545f8a", size = 218673, upload-time = "2025-12-08T13:13:12.562Z" },
-    { url = "https://files.pythonhosted.org/packages/63/ab/8fa097db361a1e8586535ae5073559e6229596b3489ec3ef2f5b38df8cb2/coverage-7.13.0-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:99acd4dfdfeb58e1937629eb1ab6ab0899b131f183ee5f23e0b5da5cba2fec74", size = 249652, upload-time = "2025-12-08T13:13:13.909Z" },
-    { url = "https://files.pythonhosted.org/packages/90/3a/9bfd4de2ff191feb37ef9465855ca56a6f2f30a3bca172e474130731ac3d/coverage-7.13.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:ff45e0cd8451e293b63ced93161e189780baf444119391b3e7d25315060368a6", size = 252251, upload-time = "2025-12-08T13:13:15.553Z" },
-    { url = "https://files.pythonhosted.org/packages/df/61/b5d8105f016e1b5874af0d7c67542da780ccd4a5f2244a433d3e20ceb1ad/coverage-7.13.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f4f72a85316d8e13234cafe0a9f81b40418ad7a082792fa4165bd7d45d96066b", size = 253492, upload-time = "2025-12-08T13:13:16.849Z" },
-    { url = "https://files.pythonhosted.org/packages/f3/b8/0fad449981803cc47a4694768b99823fb23632150743f9c83af329bb6090/coverage-7.13.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:11c21557d0e0a5a38632cbbaca5f008723b26a89d70db6315523df6df77d6232", size = 249850, upload-time = "2025-12-08T13:13:18.142Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/e9/8d68337c3125014d918cf4327d5257553a710a2995a6a6de2ac77e5aa429/coverage-7.13.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:76541dc8d53715fb4f7a3a06b34b0dc6846e3c69bc6204c55653a85dd6220971", size = 251633, upload-time = "2025-12-08T13:13:19.56Z" },
-    { url = "https://files.pythonhosted.org/packages/55/14/d4112ab26b3a1bc4b3c1295d8452dcf399ed25be4cf649002fb3e64b2d93/coverage-7.13.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:6e9e451dee940a86789134b6b0ffbe31c454ade3b849bb8a9d2cca2541a8e91d", size = 249586, upload-time = "2025-12-08T13:13:20.883Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/a9/22b0000186db663b0d82f86c2f1028099ae9ac202491685051e2a11a5218/coverage-7.13.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:5c67dace46f361125e6b9cace8fe0b729ed8479f47e70c89b838d319375c8137", size = 249412, upload-time = "2025-12-08T13:13:22.22Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/2e/42d8e0d9e7527fba439acdc6ed24a2b97613b1dc85849b1dd935c2cffef0/coverage-7.13.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f59883c643cb19630500f57016f76cfdcd6845ca8c5b5ea1f6e17f74c8e5f511", size = 251191, upload-time = "2025-12-08T13:13:23.899Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/af/8c7af92b1377fd8860536aadd58745119252aaaa71a5213e5a8e8007a9f5/coverage-7.13.0-cp313-cp313-win32.whl", hash = "sha256:58632b187be6f0be500f553be41e277712baa278147ecb7559983c6d9faf7ae1", size = 220829, upload-time = "2025-12-08T13:13:25.182Z" },
-    { url = "https://files.pythonhosted.org/packages/58/f9/725e8bf16f343d33cbe076c75dc8370262e194ff10072c0608b8e5cf33a3/coverage-7.13.0-cp313-cp313-win_amd64.whl", hash = "sha256:73419b89f812f498aca53f757dd834919b48ce4799f9d5cad33ca0ae442bdb1a", size = 221640, upload-time = "2025-12-08T13:13:26.836Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/ff/e98311000aa6933cc79274e2b6b94a2fe0fe3434fca778eba82003675496/coverage-7.13.0-cp313-cp313-win_arm64.whl", hash = "sha256:eb76670874fdd6091eedcc856128ee48c41a9bbbb9c3f1c7c3cf169290e3ffd6", size = 220269, upload-time = "2025-12-08T13:13:28.116Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/cf/bbaa2e1275b300343ea865f7d424cc0a2e2a1df6925a070b2b2d5d765330/coverage-7.13.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6e63ccc6e0ad8986386461c3c4b737540f20426e7ec932f42e030320896c311a", size = 218990, upload-time = "2025-12-08T13:13:29.463Z" },
-    { url = "https://files.pythonhosted.org/packages/21/1d/82f0b3323b3d149d7672e7744c116e9c170f4957e0c42572f0366dbb4477/coverage-7.13.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:494f5459ffa1bd45e18558cd98710c36c0b8fbfa82a5eabcbe671d80ecffbfe8", size = 219340, upload-time = "2025-12-08T13:13:31.524Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/e3/fe3fd4702a3832a255f4d43013eacb0ef5fc155a5960ea9269d8696db28b/coverage-7.13.0-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:06cac81bf10f74034e055e903f5f946e3e26fc51c09fc9f584e4a1605d977053", size = 260638, upload-time = "2025-12-08T13:13:32.965Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/01/63186cb000307f2b4da463f72af9b85d380236965574c78e7e27680a2593/coverage-7.13.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f2ffc92b46ed6e6760f1d47a71e56b5664781bc68986dbd1836b2b70c0ce2071", size = 262705, upload-time = "2025-12-08T13:13:34.378Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/a1/c0dacef0cc865f2455d59eed3548573ce47ed603205ffd0735d1d78b5906/coverage-7.13.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0602f701057c6823e5db1b74530ce85f17c3c5be5c85fc042ac939cbd909426e", size = 265125, upload-time = "2025-12-08T13:13:35.73Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/92/82b99223628b61300bd382c205795533bed021505eab6dd86e11fb5d7925/coverage-7.13.0-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:25dc33618d45456ccb1d37bce44bc78cf269909aa14c4db2e03d63146a8a1493", size = 259844, upload-time = "2025-12-08T13:13:37.69Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/2c/89b0291ae4e6cd59ef042708e1c438e2290f8c31959a20055d8768349ee2/coverage-7.13.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:71936a8b3b977ddd0b694c28c6a34f4fff2e9dd201969a4ff5d5fc7742d614b0", size = 262700, upload-time = "2025-12-08T13:13:39.525Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/f9/a5f992efae1996245e796bae34ceb942b05db275e4b34222a9a40b9fbd3b/coverage-7.13.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:936bc20503ce24770c71938d1369461f0c5320830800933bc3956e2a4ded930e", size = 260321, upload-time = "2025-12-08T13:13:41.172Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/89/a29f5d98c64fedbe32e2ac3c227fbf78edc01cc7572eee17d61024d89889/coverage-7.13.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:af0a583efaacc52ae2521f8d7910aff65cdb093091d76291ac5820d5e947fc1c", size = 259222, upload-time = "2025-12-08T13:13:43.282Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/c3/940fe447aae302a6701ee51e53af7e08b86ff6eed7631e5740c157ee22b9/coverage-7.13.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:f1c23e24a7000da892a312fb17e33c5f94f8b001de44b7cf8ba2e36fbd15859e", size = 261411, upload-time = "2025-12-08T13:13:44.72Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/31/12a4aec689cb942a89129587860ed4d0fd522d5fda81237147fde554b8ae/coverage-7.13.0-cp313-cp313t-win32.whl", hash = "sha256:5f8a0297355e652001015e93be345ee54393e45dc3050af4a0475c5a2b767d46", size = 221505, upload-time = "2025-12-08T13:13:46.332Z" },
-    { url = "https://files.pythonhosted.org/packages/65/8c/3b5fe3259d863572d2b0827642c50c3855d26b3aefe80bdc9eba1f0af3b0/coverage-7.13.0-cp313-cp313t-win_amd64.whl", hash = "sha256:6abb3a4c52f05e08460bd9acf04fec027f8718ecaa0d09c40ffbc3fbd70ecc39", size = 222569, upload-time = "2025-12-08T13:13:47.79Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/39/f71fa8316a96ac72fc3908839df651e8eccee650001a17f2c78cdb355624/coverage-7.13.0-cp313-cp313t-win_arm64.whl", hash = "sha256:3ad968d1e3aa6ce5be295ab5fe3ae1bf5bb4769d0f98a80a0252d543a2ef2e9e", size = 220841, upload-time = "2025-12-08T13:13:49.243Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/4b/9b54bedda55421449811dcd5263a2798a63f48896c24dfb92b0f1b0845bd/coverage-7.13.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:453b7ec753cf5e4356e14fe858064e5520c460d3bbbcb9c35e55c0d21155c256", size = 218343, upload-time = "2025-12-08T13:13:50.811Z" },
-    { url = "https://files.pythonhosted.org/packages/59/df/c3a1f34d4bba2e592c8979f924da4d3d4598b0df2392fbddb7761258e3dc/coverage-7.13.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:af827b7cbb303e1befa6c4f94fd2bf72f108089cfa0f8abab8f4ca553cf5ca5a", size = 218672, upload-time = "2025-12-08T13:13:52.284Z" },
-    { url = "https://files.pythonhosted.org/packages/07/62/eec0659e47857698645ff4e6ad02e30186eb8afd65214fd43f02a76537cb/coverage-7.13.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:9987a9e4f8197a1000280f7cc089e3ea2c8b3c0a64d750537809879a7b4ceaf9", size = 249715, upload-time = "2025-12-08T13:13:53.791Z" },
-    { url = "https://files.pythonhosted.org/packages/23/2d/3c7ff8b2e0e634c1f58d095f071f52ed3c23ff25be524b0ccae8b71f99f8/coverage-7.13.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:3188936845cd0cb114fa6a51842a304cdbac2958145d03be2377ec41eb285d19", size = 252225, upload-time = "2025-12-08T13:13:55.274Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ac/fb03b469d20e9c9a81093575003f959cf91a4a517b783aab090e4538764b/coverage-7.13.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2bdb3babb74079f021696cb46b8bb5f5661165c385d3a238712b031a12355be", size = 253559, upload-time = "2025-12-08T13:13:57.161Z" },
-    { url = "https://files.pythonhosted.org/packages/29/62/14afa9e792383c66cc0a3b872a06ded6e4ed1079c7d35de274f11d27064e/coverage-7.13.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7464663eaca6adba4175f6c19354feea61ebbdd735563a03d1e472c7072d27bb", size = 249724, upload-time = "2025-12-08T13:13:58.692Z" },
-    { url = "https://files.pythonhosted.org/packages/31/b7/333f3dab2939070613696ab3ee91738950f0467778c6e5a5052e840646b7/coverage-7.13.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:8069e831f205d2ff1f3d355e82f511eb7c5522d7d413f5db5756b772ec8697f8", size = 251582, upload-time = "2025-12-08T13:14:00.642Z" },
-    { url = "https://files.pythonhosted.org/packages/81/cb/69162bda9381f39b2287265d7e29ee770f7c27c19f470164350a38318764/coverage-7.13.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:6fb2d5d272341565f08e962cce14cdf843a08ac43bd621783527adb06b089c4b", size = 249538, upload-time = "2025-12-08T13:14:02.556Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/76/350387b56a30f4970abe32b90b2a434f87d29f8b7d4ae40d2e8a85aacfb3/coverage-7.13.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:5e70f92ef89bac1ac8a99b3324923b4749f008fdbd7aa9cb35e01d7a284a04f9", size = 249349, upload-time = "2025-12-08T13:14:04.015Z" },
-    { url = "https://files.pythonhosted.org/packages/86/0d/7f6c42b8d59f4c7e43ea3059f573c0dcfed98ba46eb43c68c69e52ae095c/coverage-7.13.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:4b5de7d4583e60d5fd246dd57fcd3a8aa23c6e118a8c72b38adf666ba8e7e927", size = 251011, upload-time = "2025-12-08T13:14:05.505Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/f1/4bb2dff379721bb0b5c649d5c5eaf438462cad824acf32eb1b7ca0c7078e/coverage-7.13.0-cp314-cp314-win32.whl", hash = "sha256:a6c6e16b663be828a8f0b6c5027d36471d4a9f90d28444aa4ced4d48d7d6ae8f", size = 221091, upload-time = "2025-12-08T13:14:07.127Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/44/c239da52f373ce379c194b0ee3bcc121020e397242b85f99e0afc8615066/coverage-7.13.0-cp314-cp314-win_amd64.whl", hash = "sha256:0900872f2fdb3ee5646b557918d02279dc3af3dfb39029ac4e945458b13f73bc", size = 221904, upload-time = "2025-12-08T13:14:08.542Z" },
-    { url = "https://files.pythonhosted.org/packages/89/1f/b9f04016d2a29c2e4a0307baefefad1a4ec5724946a2b3e482690486cade/coverage-7.13.0-cp314-cp314-win_arm64.whl", hash = "sha256:3a10260e6a152e5f03f26db4a407c4c62d3830b9af9b7c0450b183615f05d43b", size = 220480, upload-time = "2025-12-08T13:14:10.958Z" },
-    { url = "https://files.pythonhosted.org/packages/16/d4/364a1439766c8e8647860584171c36010ca3226e6e45b1753b1b249c5161/coverage-7.13.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:9097818b6cc1cfb5f174e3263eba4a62a17683bcfe5c4b5d07f4c97fa51fbf28", size = 219074, upload-time = "2025-12-08T13:14:13.345Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/f4/71ba8be63351e099911051b2089662c03d5671437a0ec2171823c8e03bec/coverage-7.13.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0018f73dfb4301a89292c73be6ba5f58722ff79f51593352759c1790ded1cabe", size = 219342, upload-time = "2025-12-08T13:14:15.02Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/25/127d8ed03d7711a387d96f132589057213e3aef7475afdaa303412463f22/coverage-7.13.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:166ad2a22ee770f5656e1257703139d3533b4a0b6909af67c6b4a3adc1c98657", size = 260713, upload-time = "2025-12-08T13:14:16.907Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/db/559fbb6def07d25b2243663b46ba9eb5a3c6586c0c6f4e62980a68f0ee1c/coverage-7.13.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:f6aaef16d65d1787280943f1c8718dc32e9cf141014e4634d64446702d26e0ff", size = 262825, upload-time = "2025-12-08T13:14:18.68Z" },
-    { url = "https://files.pythonhosted.org/packages/37/99/6ee5bf7eff884766edb43bd8736b5e1c5144d0fe47498c3779326fe75a35/coverage-7.13.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e999e2dcc094002d6e2c7bbc1fb85b58ba4f465a760a8014d97619330cdbbbf3", size = 265233, upload-time = "2025-12-08T13:14:20.55Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/90/92f18fe0356ea69e1f98f688ed80cec39f44e9f09a1f26a1bbf017cc67f2/coverage-7.13.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:00c3d22cf6fb1cf3bf662aaaa4e563be8243a5ed2630339069799835a9cc7f9b", size = 259779, upload-time = "2025-12-08T13:14:22.367Z" },
-    { url = "https://files.pythonhosted.org/packages/90/5d/b312a8b45b37a42ea7d27d7d3ff98ade3a6c892dd48d1d503e773503373f/coverage-7.13.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:22ccfe8d9bb0d6134892cbe1262493a8c70d736b9df930f3f3afae0fe3ac924d", size = 262700, upload-time = "2025-12-08T13:14:24.309Z" },
-    { url = "https://files.pythonhosted.org/packages/63/f8/b1d0de5c39351eb71c366f872376d09386640840a2e09b0d03973d791e20/coverage-7.13.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:9372dff5ea15930fea0445eaf37bbbafbc771a49e70c0aeed8b4e2c2614cc00e", size = 260302, upload-time = "2025-12-08T13:14:26.068Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/7c/d42f4435bc40c55558b3109a39e2d456cddcec37434f62a1f1230991667a/coverage-7.13.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:69ac2c492918c2461bc6ace42d0479638e60719f2a4ef3f0815fa2df88e9f940", size = 259136, upload-time = "2025-12-08T13:14:27.604Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/d3/23413241dc04d47cfe19b9a65b32a2edd67ecd0b817400c2843ebc58c847/coverage-7.13.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:739c6c051a7540608d097b8e13c76cfa85263ced467168dc6b477bae3df7d0e2", size = 261467, upload-time = "2025-12-08T13:14:29.09Z" },
-    { url = "https://files.pythonhosted.org/packages/13/e6/6e063174500eee216b96272c0d1847bf215926786f85c2bd024cf4d02d2f/coverage-7.13.0-cp314-cp314t-win32.whl", hash = "sha256:fe81055d8c6c9de76d60c94ddea73c290b416e061d40d542b24a5871bad498b7", size = 221875, upload-time = "2025-12-08T13:14:31.106Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/46/f4fb293e4cbe3620e3ac2a3e8fd566ed33affb5861a9b20e3dd6c1896cbc/coverage-7.13.0-cp314-cp314t-win_amd64.whl", hash = "sha256:445badb539005283825959ac9fa4a28f712c214b65af3a2c464f1adc90f5fcbc", size = 222982, upload-time = "2025-12-08T13:14:33.1Z" },
-    { url = "https://files.pythonhosted.org/packages/68/62/5b3b9018215ed9733fbd1ae3b2ed75c5de62c3b55377a52cae732e1b7805/coverage-7.13.0-cp314-cp314t-win_arm64.whl", hash = "sha256:de7f6748b890708578fc4b7bb967d810aeb6fcc9bff4bb77dbca77dab2f9df6a", size = 221016, upload-time = "2025-12-08T13:14:34.601Z" },
-    { url = "https://files.pythonhosted.org/packages/8d/4c/1968f32fb9a2604645827e11ff84a31e59d532e01995f904723b4f5328b3/coverage-7.13.0-py3-none-any.whl", hash = "sha256:850d2998f380b1e266459ca5b47bc9e7daf9af1d070f66317972f382d46f1904", size = 210068, upload-time = "2025-12-08T13:14:36.236Z" },
+version = "7.13.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/23/f9/e92df5e07f3fc8d4c7f9a0f146ef75446bf870351cd37b788cf5897f8079/coverage-7.13.1.tar.gz", hash = "sha256:b7593fe7eb5feaa3fbb461ac79aac9f9fc0387a5ca8080b0c6fe2ca27b091afd", size = 825862, upload-time = "2025-12-28T15:42:56.969Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2d/9a/3742e58fd04b233df95c012ee9f3dfe04708a5e1d32613bd2d47d4e1be0d/coverage-7.13.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e1fa280b3ad78eea5be86f94f461c04943d942697e0dac889fa18fff8f5f9147", size = 218633, upload-time = "2025-12-28T15:40:10.165Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/45/7e6bdc94d89cd7c8017ce735cf50478ddfe765d4fbf0c24d71d30ea33d7a/coverage-7.13.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c3d8c679607220979434f494b139dfb00131ebf70bb406553d69c1ff01a5c33d", size = 219147, upload-time = "2025-12-28T15:40:12.069Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/38/0d6a258625fd7f10773fe94097dc16937a5f0e3e0cdf3adef67d3ac6baef/coverage-7.13.1-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:339dc63b3eba969067b00f41f15ad161bf2946613156fb131266d8debc8e44d0", size = 245894, upload-time = "2025-12-28T15:40:13.556Z" },
+    { url = "https://files.pythonhosted.org/packages/27/58/409d15ea487986994cbd4d06376e9860e9b157cfbfd402b1236770ab8dd2/coverage-7.13.1-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:db622b999ffe49cb891f2fff3b340cdc2f9797d01a0a202a0973ba2562501d90", size = 247721, upload-time = "2025-12-28T15:40:15.37Z" },
+    { url = "https://files.pythonhosted.org/packages/da/bf/6e8056a83fd7a96c93341f1ffe10df636dd89f26d5e7b9ca511ce3bcf0df/coverage-7.13.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d1443ba9acbb593fa7c1c29e011d7c9761545fe35e7652e85ce7f51a16f7e08d", size = 249585, upload-time = "2025-12-28T15:40:17.226Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/15/e1daff723f9f5959acb63cbe35b11203a9df77ee4b95b45fffd38b318390/coverage-7.13.1-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c832ec92c4499ac463186af72f9ed4d8daec15499b16f0a879b0d1c8e5cf4a3b", size = 246597, upload-time = "2025-12-28T15:40:19.028Z" },
+    { url = "https://files.pythonhosted.org/packages/74/a6/1efd31c5433743a6ddbc9d37ac30c196bb07c7eab3d74fbb99b924c93174/coverage-7.13.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:562ec27dfa3f311e0db1ba243ec6e5f6ab96b1edfcfc6cf86f28038bc4961ce6", size = 247626, upload-time = "2025-12-28T15:40:20.846Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/9f/1609267dd3e749f57fdd66ca6752567d1c13b58a20a809dc409b263d0b5f/coverage-7.13.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:4de84e71173d4dada2897e5a0e1b7877e5eefbfe0d6a44edee6ce31d9b8ec09e", size = 245629, upload-time = "2025-12-28T15:40:22.397Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/f6/6815a220d5ec2466383d7cc36131b9fa6ecbe95c50ec52a631ba733f306a/coverage-7.13.1-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:a5a68357f686f8c4d527a2dc04f52e669c2fc1cbde38f6f7eb6a0e58cbd17cae", size = 245901, upload-time = "2025-12-28T15:40:23.836Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/58/40576554cd12e0872faf6d2c0eb3bc85f71d78427946ddd19ad65201e2c0/coverage-7.13.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:77cc258aeb29a3417062758975521eae60af6f79e930d6993555eeac6a8eac29", size = 246505, upload-time = "2025-12-28T15:40:25.421Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/77/9233a90253fba576b0eee81707b5781d0e21d97478e5377b226c5b096c0f/coverage-7.13.1-cp310-cp310-win32.whl", hash = "sha256:bb4f8c3c9a9f34423dba193f241f617b08ffc63e27f67159f60ae6baf2dcfe0f", size = 221257, upload-time = "2025-12-28T15:40:27.217Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/43/e842ff30c1a0a623ec80db89befb84a3a7aad7bfe44a6ea77d5a3e61fedd/coverage-7.13.1-cp310-cp310-win_amd64.whl", hash = "sha256:c8e2706ceb622bc63bac98ebb10ef5da80ed70fbd8a7999a5076de3afaef0fb1", size = 222191, upload-time = "2025-12-28T15:40:28.916Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/9b/77baf488516e9ced25fc215a6f75d803493fc3f6a1a1227ac35697910c2a/coverage-7.13.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a55d509a1dc5a5b708b5dad3b5334e07a16ad4c2185e27b40e4dba796ab7f88", size = 218755, upload-time = "2025-12-28T15:40:30.812Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/cd/7ab01154e6eb79ee2fab76bf4d89e94c6648116557307ee4ebbb85e5c1bf/coverage-7.13.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4d010d080c4888371033baab27e47c9df7d6fb28d0b7b7adf85a4a49be9298b3", size = 219257, upload-time = "2025-12-28T15:40:32.333Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/b11ef7863ffbbdb509da0023fad1e9eda1c0eaea61a6d2ea5b17d4ac706e/coverage-7.13.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d938b4a840fb1523b9dfbbb454f652967f18e197569c32266d4d13f37244c3d9", size = 249657, upload-time = "2025-12-28T15:40:34.1Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/7c/347280982982383621d29b8c544cf497ae07ac41e44b1ca4903024131f55/coverage-7.13.1-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:bf100a3288f9bb7f919b87eb84f87101e197535b9bd0e2c2b5b3179633324fee", size = 251581, upload-time = "2025-12-28T15:40:36.131Z" },
+    { url = "https://files.pythonhosted.org/packages/82/f6/ebcfed11036ade4c0d75fa4453a6282bdd225bc073862766eec184a4c643/coverage-7.13.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ef6688db9bf91ba111ae734ba6ef1a063304a881749726e0d3575f5c10a9facf", size = 253691, upload-time = "2025-12-28T15:40:37.626Z" },
+    { url = "https://files.pythonhosted.org/packages/02/92/af8f5582787f5d1a8b130b2dcba785fa5e9a7a8e121a0bb2220a6fdbdb8a/coverage-7.13.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0b609fc9cdbd1f02e51f67f51e5aee60a841ef58a68d00d5ee2c0faf357481a3", size = 249799, upload-time = "2025-12-28T15:40:39.47Z" },
+    { url = "https://files.pythonhosted.org/packages/24/aa/0e39a2a3b16eebf7f193863323edbff38b6daba711abaaf807d4290cf61a/coverage-7.13.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c43257717611ff5e9a1d79dce8e47566235ebda63328718d9b65dd640bc832ef", size = 251389, upload-time = "2025-12-28T15:40:40.954Z" },
+    { url = "https://files.pythonhosted.org/packages/73/46/7f0c13111154dc5b978900c0ccee2e2ca239b910890e674a77f1363d483e/coverage-7.13.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:e09fbecc007f7b6afdfb3b07ce5bd9f8494b6856dd4f577d26c66c391b829851", size = 249450, upload-time = "2025-12-28T15:40:42.489Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/ca/e80da6769e8b669ec3695598c58eef7ad98b0e26e66333996aee6316db23/coverage-7.13.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:a03a4f3a19a189919c7055098790285cc5c5b0b3976f8d227aea39dbf9f8bfdb", size = 249170, upload-time = "2025-12-28T15:40:44.279Z" },
+    { url = "https://files.pythonhosted.org/packages/af/18/9e29baabdec1a8644157f572541079b4658199cfd372a578f84228e860de/coverage-7.13.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:3820778ea1387c2b6a818caec01c63adc5b3750211af6447e8dcfb9b6f08dbba", size = 250081, upload-time = "2025-12-28T15:40:45.748Z" },
+    { url = "https://files.pythonhosted.org/packages/00/f8/c3021625a71c3b2f516464d322e41636aea381018319050a8114105872ee/coverage-7.13.1-cp311-cp311-win32.whl", hash = "sha256:ff10896fa55167371960c5908150b434b71c876dfab97b69478f22c8b445ea19", size = 221281, upload-time = "2025-12-28T15:40:47.232Z" },
+    { url = "https://files.pythonhosted.org/packages/27/56/c216625f453df6e0559ed666d246fcbaaa93f3aa99eaa5080cea1229aa3d/coverage-7.13.1-cp311-cp311-win_amd64.whl", hash = "sha256:a998cc0aeeea4c6d5622a3754da5a493055d2d95186bad877b0a34ea6e6dbe0a", size = 222215, upload-time = "2025-12-28T15:40:49.19Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/9a/be342e76f6e531cae6406dc46af0d350586f24d9b67fdfa6daee02df71af/coverage-7.13.1-cp311-cp311-win_arm64.whl", hash = "sha256:fea07c1a39a22614acb762e3fbbb4011f65eedafcb2948feeef641ac78b4ee5c", size = 220886, upload-time = "2025-12-28T15:40:51.067Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/8a/87af46cccdfa78f53db747b09f5f9a21d5fc38d796834adac09b30a8ce74/coverage-7.13.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6f34591000f06e62085b1865c9bc5f7858df748834662a51edadfd2c3bfe0dd3", size = 218927, upload-time = "2025-12-28T15:40:52.814Z" },
+    { url = "https://files.pythonhosted.org/packages/82/a8/6e22fdc67242a4a5a153f9438d05944553121c8f4ba70cb072af4c41362e/coverage-7.13.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b67e47c5595b9224599016e333f5ec25392597a89d5744658f837d204e16c63e", size = 219288, upload-time = "2025-12-28T15:40:54.262Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/0a/853a76e03b0f7c4375e2ca025df45c918beb367f3e20a0a8e91967f6e96c/coverage-7.13.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3e7b8bd70c48ffb28461ebe092c2345536fb18bbbf19d287c8913699735f505c", size = 250786, upload-time = "2025-12-28T15:40:56.059Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/b4/694159c15c52b9f7ec7adf49d50e5f8ee71d3e9ef38adb4445d13dd56c20/coverage-7.13.1-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:c223d078112e90dc0e5c4e35b98b9584164bea9fbbd221c0b21c5241f6d51b62", size = 253543, upload-time = "2025-12-28T15:40:57.585Z" },
+    { url = "https://files.pythonhosted.org/packages/96/b2/7f1f0437a5c855f87e17cf5d0dc35920b6440ff2b58b1ba9788c059c26c8/coverage-7.13.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:794f7c05af0763b1bbd1b9e6eff0e52ad068be3b12cd96c87de037b01390c968", size = 254635, upload-time = "2025-12-28T15:40:59.443Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/d1/73c3fdb8d7d3bddd9473c9c6a2e0682f09fc3dfbcb9c3f36412a7368bcab/coverage-7.13.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0642eae483cc8c2902e4af7298bf886d605e80f26382124cddc3967c2a3df09e", size = 251202, upload-time = "2025-12-28T15:41:01.328Z" },
+    { url = "https://files.pythonhosted.org/packages/66/3c/f0edf75dcc152f145d5598329e864bbbe04ab78660fe3e8e395f9fff010f/coverage-7.13.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:9f5e772ed5fef25b3de9f2008fe67b92d46831bd2bc5bdc5dd6bfd06b83b316f", size = 252566, upload-time = "2025-12-28T15:41:03.319Z" },
+    { url = "https://files.pythonhosted.org/packages/17/b3/e64206d3c5f7dcbceafd14941345a754d3dbc78a823a6ed526e23b9cdaab/coverage-7.13.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:45980ea19277dc0a579e432aef6a504fe098ef3a9032ead15e446eb0f1191aee", size = 250711, upload-time = "2025-12-28T15:41:06.411Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/ad/28a3eb970a8ef5b479ee7f0c484a19c34e277479a5b70269dc652b730733/coverage-7.13.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:e4f18eca6028ffa62adbd185a8f1e1dd242f2e68164dba5c2b74a5204850b4cf", size = 250278, upload-time = "2025-12-28T15:41:08.285Z" },
+    { url = "https://files.pythonhosted.org/packages/54/e3/c8f0f1a93133e3e1291ca76cbb63565bd4b5c5df63b141f539d747fff348/coverage-7.13.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:f8dca5590fec7a89ed6826fce625595279e586ead52e9e958d3237821fbc750c", size = 252154, upload-time = "2025-12-28T15:41:09.969Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/bf/9939c5d6859c380e405b19e736321f1c7d402728792f4c752ad1adcce005/coverage-7.13.1-cp312-cp312-win32.whl", hash = "sha256:ff86d4e85188bba72cfb876df3e11fa243439882c55957184af44a35bd5880b7", size = 221487, upload-time = "2025-12-28T15:41:11.468Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/dc/7282856a407c621c2aad74021680a01b23010bb8ebf427cf5eacda2e876f/coverage-7.13.1-cp312-cp312-win_amd64.whl", hash = "sha256:16cc1da46c04fb0fb128b4dc430b78fa2aba8a6c0c9f8eb391fd5103409a6ac6", size = 222299, upload-time = "2025-12-28T15:41:13.386Z" },
+    { url = "https://files.pythonhosted.org/packages/10/79/176a11203412c350b3e9578620013af35bcdb79b651eb976f4a4b32044fa/coverage-7.13.1-cp312-cp312-win_arm64.whl", hash = "sha256:8d9bc218650022a768f3775dd7fdac1886437325d8d295d923ebcfef4892ad5c", size = 220941, upload-time = "2025-12-28T15:41:14.975Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/a4/e98e689347a1ff1a7f67932ab535cef82eb5e78f32a9e4132e114bbb3a0a/coverage-7.13.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:cb237bfd0ef4d5eb6a19e29f9e528ac67ac3be932ea6b44fb6cc09b9f3ecff78", size = 218951, upload-time = "2025-12-28T15:41:16.653Z" },
+    { url = "https://files.pythonhosted.org/packages/32/33/7cbfe2bdc6e2f03d6b240d23dc45fdaf3fd270aaf2d640be77b7f16989ab/coverage-7.13.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:1dcb645d7e34dcbcc96cd7c132b1fc55c39263ca62eb961c064eb3928997363b", size = 219325, upload-time = "2025-12-28T15:41:18.609Z" },
+    { url = "https://files.pythonhosted.org/packages/59/f6/efdabdb4929487baeb7cb2a9f7dac457d9356f6ad1b255be283d58b16316/coverage-7.13.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3d42df8201e00384736f0df9be2ced39324c3907607d17d50d50116c989d84cd", size = 250309, upload-time = "2025-12-28T15:41:20.629Z" },
+    { url = "https://files.pythonhosted.org/packages/12/da/91a52516e9d5aea87d32d1523f9cdcf7a35a3b298e6be05d6509ba3cfab2/coverage-7.13.1-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fa3edde1aa8807de1d05934982416cb3ec46d1d4d91e280bcce7cca01c507992", size = 252907, upload-time = "2025-12-28T15:41:22.257Z" },
+    { url = "https://files.pythonhosted.org/packages/75/38/f1ea837e3dc1231e086db1638947e00d264e7e8c41aa8ecacf6e1e0c05f4/coverage-7.13.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9edd0e01a343766add6817bc448408858ba6b489039eaaa2018474e4001651a4", size = 254148, upload-time = "2025-12-28T15:41:23.87Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/43/f4f16b881aaa34954ba446318dea6b9ed5405dd725dd8daac2358eda869a/coverage-7.13.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:985b7836931d033570b94c94713c6dba5f9d3ff26045f72c3e5dbc5fe3361e5a", size = 250515, upload-time = "2025-12-28T15:41:25.437Z" },
+    { url = "https://files.pythonhosted.org/packages/84/34/8cba7f00078bd468ea914134e0144263194ce849ec3baad187ffb6203d1c/coverage-7.13.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ffed1e4980889765c84a5d1a566159e363b71d6b6fbaf0bebc9d3c30bc016766", size = 252292, upload-time = "2025-12-28T15:41:28.459Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/a4/cffac66c7652d84ee4ac52d3ccb94c015687d3b513f9db04bfcac2ac800d/coverage-7.13.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:8842af7f175078456b8b17f1b73a0d16a65dcbdc653ecefeb00a56b3c8c298c4", size = 250242, upload-time = "2025-12-28T15:41:30.02Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/78/9a64d462263dde416f3c0067efade7b52b52796f489b1037a95b0dc389c9/coverage-7.13.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:ccd7a6fca48ca9c131d9b0a2972a581e28b13416fc313fb98b6d24a03ce9a398", size = 250068, upload-time = "2025-12-28T15:41:32.007Z" },
+    { url = "https://files.pythonhosted.org/packages/69/c8/a8994f5fece06db7c4a97c8fc1973684e178599b42e66280dded0524ef00/coverage-7.13.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0403f647055de2609be776965108447deb8e384fe4a553c119e3ff6bfbab4784", size = 251846, upload-time = "2025-12-28T15:41:33.946Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/f7/91fa73c4b80305c86598a2d4e54ba22df6bf7d0d97500944af7ef155d9f7/coverage-7.13.1-cp313-cp313-win32.whl", hash = "sha256:549d195116a1ba1e1ae2f5ca143f9777800f6636eab917d4f02b5310d6d73461", size = 221512, upload-time = "2025-12-28T15:41:35.519Z" },
+    { url = "https://files.pythonhosted.org/packages/45/0b/0768b4231d5a044da8f75e097a8714ae1041246bb765d6b5563bab456735/coverage-7.13.1-cp313-cp313-win_amd64.whl", hash = "sha256:5899d28b5276f536fcf840b18b61a9fce23cc3aec1d114c44c07fe94ebeaa500", size = 222321, upload-time = "2025-12-28T15:41:37.371Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/b8/bdcb7253b7e85157282450262008f1366aa04663f3e3e4c30436f596c3e2/coverage-7.13.1-cp313-cp313-win_arm64.whl", hash = "sha256:868a2fae76dfb06e87291bcbd4dcbcc778a8500510b618d50496e520bd94d9b9", size = 220949, upload-time = "2025-12-28T15:41:39.553Z" },
+    { url = "https://files.pythonhosted.org/packages/70/52/f2be52cc445ff75ea8397948c96c1b4ee14f7f9086ea62fc929c5ae7b717/coverage-7.13.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:67170979de0dacac3f3097d02b0ad188d8edcea44ccc44aaa0550af49150c7dc", size = 219643, upload-time = "2025-12-28T15:41:41.567Z" },
+    { url = "https://files.pythonhosted.org/packages/47/79/c85e378eaa239e2edec0c5523f71542c7793fe3340954eafb0bc3904d32d/coverage-7.13.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:f80e2bb21bfab56ed7405c2d79d34b5dc0bc96c2c1d2a067b643a09fb756c43a", size = 219997, upload-time = "2025-12-28T15:41:43.418Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/9b/b1ade8bfb653c0bbce2d6d6e90cc6c254cbb99b7248531cc76253cb4da6d/coverage-7.13.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:f83351e0f7dcdb14d7326c3d8d8c4e915fa685cbfdc6281f9470d97a04e9dfe4", size = 261296, upload-time = "2025-12-28T15:41:45.207Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/af/ebf91e3e1a2473d523e87e87fd8581e0aa08741b96265730e2d79ce78d8d/coverage-7.13.1-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:bb3f6562e89bad0110afbe64e485aac2462efdce6232cdec7862a095dc3412f6", size = 263363, upload-time = "2025-12-28T15:41:47.163Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/8b/fb2423526d446596624ac7fde12ea4262e66f86f5120114c3cfd0bb2befa/coverage-7.13.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:77545b5dcda13b70f872c3b5974ac64c21d05e65b1590b441c8560115dc3a0d1", size = 265783, upload-time = "2025-12-28T15:41:49.03Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/26/ef2adb1e22674913b89f0fe7490ecadcef4a71fa96f5ced90c60ec358789/coverage-7.13.1-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a4d240d260a1aed814790bbe1f10a5ff31ce6c21bc78f0da4a1e8268d6c80dbd", size = 260508, upload-time = "2025-12-28T15:41:51.035Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/7d/f0f59b3404caf662e7b5346247883887687c074ce67ba453ea08c612b1d5/coverage-7.13.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:d2287ac9360dec3837bfdad969963a5d073a09a85d898bd86bea82aa8876ef3c", size = 263357, upload-time = "2025-12-28T15:41:52.631Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/b1/29896492b0b1a047604d35d6fa804f12818fa30cdad660763a5f3159e158/coverage-7.13.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:0d2c11f3ea4db66b5cbded23b20185c35066892c67d80ec4be4bab257b9ad1e0", size = 260978, upload-time = "2025-12-28T15:41:54.589Z" },
+    { url = "https://files.pythonhosted.org/packages/48/f2/971de1238a62e6f0a4128d37adadc8bb882ee96afbe03ff1570291754629/coverage-7.13.1-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:3fc6a169517ca0d7ca6846c3c5392ef2b9e38896f61d615cb75b9e7134d4ee1e", size = 259877, upload-time = "2025-12-28T15:41:56.263Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/fc/0474efcbb590ff8628830e9aaec5f1831594874360e3251f1fdec31d07a3/coverage-7.13.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:d10a2ed46386e850bb3de503a54f9fe8192e5917fcbb143bfef653a9355e9a53", size = 262069, upload-time = "2025-12-28T15:41:58.093Z" },
+    { url = "https://files.pythonhosted.org/packages/88/4f/3c159b7953db37a7b44c0eab8a95c37d1aa4257c47b4602c04022d5cb975/coverage-7.13.1-cp313-cp313t-win32.whl", hash = "sha256:75a6f4aa904301dab8022397a22c0039edc1f51e90b83dbd4464b8a38dc87842", size = 222184, upload-time = "2025-12-28T15:41:59.763Z" },
+    { url = "https://files.pythonhosted.org/packages/58/a5/6b57d28f81417f9335774f20679d9d13b9a8fb90cd6160957aa3b54a2379/coverage-7.13.1-cp313-cp313t-win_amd64.whl", hash = "sha256:309ef5706e95e62578cda256b97f5e097916a2c26247c287bbe74794e7150df2", size = 223250, upload-time = "2025-12-28T15:42:01.52Z" },
+    { url = "https://files.pythonhosted.org/packages/81/7c/160796f3b035acfbb58be80e02e484548595aa67e16a6345e7910ace0a38/coverage-7.13.1-cp313-cp313t-win_arm64.whl", hash = "sha256:92f980729e79b5d16d221038dbf2e8f9a9136afa072f9d5d6ed4cb984b126a09", size = 221521, upload-time = "2025-12-28T15:42:03.275Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/8e/ba0e597560c6563fc0adb902fda6526df5d4aa73bb10adf0574d03bd2206/coverage-7.13.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:97ab3647280d458a1f9adb85244e81587505a43c0c7cff851f5116cd2814b894", size = 218996, upload-time = "2025-12-28T15:42:04.978Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/8e/764c6e116f4221dc7aa26c4061181ff92edb9c799adae6433d18eeba7a14/coverage-7.13.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:8f572d989142e0908e6acf57ad1b9b86989ff057c006d13b76c146ec6a20216a", size = 219326, upload-time = "2025-12-28T15:42:06.691Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/a6/6130dc6d8da28cdcbb0f2bf8865aeca9b157622f7c0031e48c6cf9a0e591/coverage-7.13.1-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d72140ccf8a147e94274024ff6fd8fb7811354cf7ef88b1f0a988ebaa5bc774f", size = 250374, upload-time = "2025-12-28T15:42:08.786Z" },
+    { url = "https://files.pythonhosted.org/packages/82/2b/783ded568f7cd6b677762f780ad338bf4b4750205860c17c25f7c708995e/coverage-7.13.1-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:d3c9f051b028810f5a87c88e5d6e9af3c0ff32ef62763bf15d29f740453ca909", size = 252882, upload-time = "2025-12-28T15:42:10.515Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/b2/9808766d082e6a4d59eb0cc881a57fc1600eb2c5882813eefff8254f71b5/coverage-7.13.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f398ba4df52d30b1763f62eed9de5620dcde96e6f491f4c62686736b155aa6e4", size = 254218, upload-time = "2025-12-28T15:42:12.208Z" },
+    { url = "https://files.pythonhosted.org/packages/44/ea/52a985bb447c871cb4d2e376e401116520991b597c85afdde1ea9ef54f2c/coverage-7.13.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:132718176cc723026d201e347f800cd1a9e4b62ccd3f82476950834dad501c75", size = 250391, upload-time = "2025-12-28T15:42:14.21Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/1d/125b36cc12310718873cfc8209ecfbc1008f14f4f5fa0662aa608e579353/coverage-7.13.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9e549d642426e3579b3f4b92d0431543b012dcb6e825c91619d4e93b7363c3f9", size = 252239, upload-time = "2025-12-28T15:42:16.292Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/16/10c1c164950cade470107f9f14bbac8485f8fb8515f515fca53d337e4a7f/coverage-7.13.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:90480b2134999301eea795b3a9dbf606c6fbab1b489150c501da84a959442465", size = 250196, upload-time = "2025-12-28T15:42:18.54Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/c6/cd860fac08780c6fd659732f6ced1b40b79c35977c1356344e44d72ba6c4/coverage-7.13.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:e825dbb7f84dfa24663dd75835e7257f8882629fc11f03ecf77d84a75134b864", size = 250008, upload-time = "2025-12-28T15:42:20.365Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3a/a8c58d3d38f82a5711e1e0a67268362af48e1a03df27c03072ac30feefcf/coverage-7.13.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:623dcc6d7a7ba450bbdbeedbaa0c42b329bdae16491af2282f12a7e809be7eb9", size = 251671, upload-time = "2025-12-28T15:42:22.114Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/bc/fd4c1da651d037a1e3d53e8cb3f8182f4b53271ffa9a95a2e211bacc0349/coverage-7.13.1-cp314-cp314-win32.whl", hash = "sha256:6e73ebb44dca5f708dc871fe0b90cf4cff1a13f9956f747cc87b535a840386f5", size = 221777, upload-time = "2025-12-28T15:42:23.919Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/50/71acabdc8948464c17e90b5ffd92358579bd0910732c2a1c9537d7536aa6/coverage-7.13.1-cp314-cp314-win_amd64.whl", hash = "sha256:be753b225d159feb397bd0bf91ae86f689bad0da09d3b301478cd39b878ab31a", size = 222592, upload-time = "2025-12-28T15:42:25.619Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/c8/a6fb943081bb0cc926499c7907731a6dc9efc2cbdc76d738c0ab752f1a32/coverage-7.13.1-cp314-cp314-win_arm64.whl", hash = "sha256:228b90f613b25ba0019361e4ab81520b343b622fc657daf7e501c4ed6a2366c0", size = 221169, upload-time = "2025-12-28T15:42:27.629Z" },
+    { url = "https://files.pythonhosted.org/packages/16/61/d5b7a0a0e0e40d62e59bc8c7aa1afbd86280d82728ba97f0673b746b78e2/coverage-7.13.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:60cfb538fe9ef86e5b2ab0ca8fc8d62524777f6c611dcaf76dc16fbe9b8e698a", size = 219730, upload-time = "2025-12-28T15:42:29.306Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/2c/8881326445fd071bb49514d1ce97d18a46a980712b51fee84f9ab42845b4/coverage-7.13.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:57dfc8048c72ba48a8c45e188d811e5efd7e49b387effc8fb17e97936dde5bf6", size = 220001, upload-time = "2025-12-28T15:42:31.319Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/d7/50de63af51dfa3a7f91cc37ad8fcc1e244b734232fbc8b9ab0f3c834a5cd/coverage-7.13.1-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3f2f725aa3e909b3c5fdb8192490bdd8e1495e85906af74fe6e34a2a77ba0673", size = 261370, upload-time = "2025-12-28T15:42:32.992Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/2c/d31722f0ec918fd7453b2758312729f645978d212b410cd0f7c2aed88a94/coverage-7.13.1-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9ee68b21909686eeb21dfcba2c3b81fee70dcf38b140dcd5aa70680995fa3aa5", size = 263485, upload-time = "2025-12-28T15:42:34.759Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/7a/2c114fa5c5fc08ba0777e4aec4c97e0b4a1afcb69c75f1f54cff78b073ab/coverage-7.13.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:724b1b270cb13ea2e6503476e34541a0b1f62280bc997eab443f87790202033d", size = 265890, upload-time = "2025-12-28T15:42:36.517Z" },
+    { url = "https://files.pythonhosted.org/packages/65/d9/f0794aa1c74ceabc780fe17f6c338456bbc4e96bd950f2e969f48ac6fb20/coverage-7.13.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:916abf1ac5cf7eb16bc540a5bf75c71c43a676f5c52fcb9fe75a2bd75fb944e8", size = 260445, upload-time = "2025-12-28T15:42:38.646Z" },
+    { url = "https://files.pythonhosted.org/packages/49/23/184b22a00d9bb97488863ced9454068c79e413cb23f472da6cbddc6cfc52/coverage-7.13.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:776483fd35b58d8afe3acbd9988d5de592ab6da2d2a865edfdbc9fdb43e7c486", size = 263357, upload-time = "2025-12-28T15:42:40.788Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/bd/58af54c0c9199ea4190284f389005779d7daf7bf3ce40dcd2d2b2f96da69/coverage-7.13.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:b6f3b96617e9852703f5b633ea01315ca45c77e879584f283c44127f0f1ec564", size = 260959, upload-time = "2025-12-28T15:42:42.808Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/2a/6839294e8f78a4891bf1df79d69c536880ba2f970d0ff09e7513d6e352e9/coverage-7.13.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:bd63e7b74661fed317212fab774e2a648bc4bb09b35f25474f8e3325d2945cd7", size = 259792, upload-time = "2025-12-28T15:42:44.818Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/c3/528674d4623283310ad676c5af7414b9850ab6d55c2300e8aa4b945ec554/coverage-7.13.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:933082f161bbb3e9f90d00990dc956120f608cdbcaeea15c4d897f56ef4fe416", size = 262123, upload-time = "2025-12-28T15:42:47.108Z" },
+    { url = "https://files.pythonhosted.org/packages/06/c5/8c0515692fb4c73ac379d8dc09b18eaf0214ecb76ea6e62467ba7a1556ff/coverage-7.13.1-cp314-cp314t-win32.whl", hash = "sha256:18be793c4c87de2965e1c0f060f03d9e5aff66cfeae8e1dbe6e5b88056ec153f", size = 222562, upload-time = "2025-12-28T15:42:49.144Z" },
+    { url = "https://files.pythonhosted.org/packages/05/0e/c0a0c4678cb30dac735811db529b321d7e1c9120b79bd728d4f4d6b010e9/coverage-7.13.1-cp314-cp314t-win_amd64.whl", hash = "sha256:0e42e0ec0cd3e0d851cb3c91f770c9301f48647cb2877cb78f74bdaa07639a79", size = 223670, upload-time = "2025-12-28T15:42:51.218Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/5f/b177aa0011f354abf03a8f30a85032686d290fdeed4222b27d36b4372a50/coverage-7.13.1-cp314-cp314t-win_arm64.whl", hash = "sha256:eaecf47ef10c72ece9a2a92118257da87e460e113b83cc0d2905cbbe931792b4", size = 221707, upload-time = "2025-12-28T15:42:53.034Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/48/d9f421cb8da5afaa1a64570d9989e00fb7955e6acddc5a12979f7666ef60/coverage-7.13.1-py3-none-any.whl", hash = "sha256:2016745cb3ba554469d02819d78958b571792bb68e31302610e898f80dd3a573", size = 210722, upload-time = "2025-12-28T15:42:54.901Z" },
 ]
 
 [package.optional-dependencies]
@@ -515,11 +515,11 @@ sdist = { url = "https://files.pythonhosted.org/packages/a2/55/8f8cab2afd404cf57
 
 [[package]]
 name = "docutils"
-version = "0.22.3"
+version = "0.22.4"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/d9/02/111134bfeb6e6c7ac4c74594e39a59f6c0195dc4846afbeac3cba60f1927/docutils-0.22.3.tar.gz", hash = "sha256:21486ae730e4ca9f622677b1412b879af1791efcfba517e4c6f60be543fc8cdd", size = 2290153, upload-time = "2025-11-06T02:35:55.655Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ae/b6/03bb70946330e88ffec97aefd3ea75ba575cb2e762061e0e62a213befee8/docutils-0.22.4.tar.gz", hash = "sha256:4db53b1fde9abecbb74d91230d32ab626d94f6badfc575d6db9194a49df29968", size = 2291750, upload-time = "2025-12-18T19:00:26.443Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/11/a8/c6a4b901d17399c77cd81fb001ce8961e9f5e04d3daf27e8925cb012e163/docutils-0.22.3-py3-none-any.whl", hash = "sha256:bd772e4aca73aff037958d44f2be5229ded4c09927fcf8690c577b66234d6ceb", size = 633032, upload-time = "2025-11-06T02:35:52.391Z" },
+    { url = "https://files.pythonhosted.org/packages/02/10/5da547df7a391dcde17f59520a231527b8571e6f46fc8efb02ccb370ab12/docutils-0.22.4-py3-none-any.whl", hash = "sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de", size = 633196, upload-time = "2025-12-18T19:00:18.077Z" },
 ]
 
 [[package]]
@@ -536,11 +536,11 @@ wheels = [
 
 [[package]]
 name = "filelock"
-version = "3.20.0"
+version = "3.20.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/58/46/0028a82567109b5ef6e4d2a1f04a583fb513e6cf9527fcdd09afd817deeb/filelock-3.20.0.tar.gz", hash = "sha256:711e943b4ec6be42e1d4e6690b48dc175c822967466bb31c0c293f34334c13f4", size = 18922, upload-time = "2025-10-08T18:03:50.056Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a7/23/ce7a1126827cedeb958fc043d61745754464eb56c5937c35bbf2b8e26f34/filelock-3.20.1.tar.gz", hash = "sha256:b8360948b351b80f420878d8516519a2204b07aefcdcfd24912a5d33127f188c", size = 19476, upload-time = "2025-12-15T23:54:28.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/91/7216b27286936c16f5b4d0c530087e4a54eead683e6b0b73dd0c64844af6/filelock-3.20.0-py3-none-any.whl", hash = "sha256:339b4732ffda5cd79b13f4e2711a31b0365ce445d95d243bb996273d072546a2", size = 16054, upload-time = "2025-10-08T18:03:48.35Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7f/a1a97644e39e7316d850784c642093c99df1290a460df4ede27659056834/filelock-3.20.1-py3-none-any.whl", hash = "sha256:15d9e9a67306188a44baa72f569d2bfd803076269365fdea0934385da4dc361a", size = 16666, upload-time = "2025-12-15T23:54:26.874Z" },
 ]
 
 [[package]]
@@ -557,14 +557,14 @@ wheels = [
 
 [[package]]
 name = "gitpython"
-version = "3.1.45"
+version = "3.1.46"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "gitdb" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9a/c8/dd58967d119baab745caec2f9d853297cec1989ec1d63f677d3880632b88/gitpython-3.1.45.tar.gz", hash = "sha256:85b0ee964ceddf211c41b9f27a49086010a190fd8132a24e21f362a4b36a791c", size = 215076, upload-time = "2025-07-24T03:45:54.871Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/df/b5/59d16470a1f0dfe8c793f9ef56fd3826093fc52b3bd96d6b9d6c26c7e27b/gitpython-3.1.46.tar.gz", hash = "sha256:400124c7d0ef4ea03f7310ac2fbf7151e09ff97f2a3288d64a440c584a29c37f", size = 215371, upload-time = "2026-01-01T15:37:32.073Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/01/61/d4b89fec821f72385526e1b9d9a3a0385dda4a72b206d28049e2c7cd39b8/gitpython-3.1.45-py3-none-any.whl", hash = "sha256:8908cb2e02fb3b93b7eb0f2827125cb699869470432cc885f019b8fd0fccff77", size = 208168, upload-time = "2025-07-24T03:45:52.517Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/09/e21df6aef1e1ffc0c816f0522ddc3f6dcded766c3261813131c78a704470/gitpython-3.1.46-py3-none-any.whl", hash = "sha256:79812ed143d9d25b6d176a10bb511de0f9c67b1fa641d82097b0ab90398a2058", size = 208620, upload-time = "2026-01-01T15:37:30.574Z" },
 ]
 
 [[package]]
@@ -692,14 +692,14 @@ wheels = [
 
 [[package]]
 name = "importlib-metadata"
-version = "8.7.0"
+version = "8.7.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "zipp" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/76/66/650a33bd90f786193e4de4b3ad86ea60b53c89b669a5c7be931fac31cdb0/importlib_metadata-8.7.0.tar.gz", hash = "sha256:d13b81ad223b890aa16c5471f2ac3056cf76c5f10f82d6f9292f0b415f389000", size = 56641, upload-time = "2025-04-27T15:29:01.736Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f3/49/3b30cad09e7771a4982d9975a8cbf64f00d4a1ececb53297f1d9a7be1b10/importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb", size = 57107, upload-time = "2025-12-21T10:00:19.278Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/20/b0/36bd937216ec521246249be3bf9855081de4c5e06a0c9b4219dbeda50373/importlib_metadata-8.7.0-py3-none-any.whl", hash = "sha256:e5dd1551894c77868a30651cef00984d50e1002d06942a7101d34870c5f02afd", size = 27656, upload-time = "2025-04-27T15:29:00.214Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/5e/f8e9a1d23b9c20a551a8a02ea3637b4642e22c2626e3a13a9a29cdea99eb/importlib_metadata-8.7.1-py3-none-any.whl", hash = "sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151", size = 27865, upload-time = "2025-12-21T10:00:18.329Z" },
 ]
 
 [[package]]
@@ -725,26 +725,26 @@ wheels = [
 
 [[package]]
 name = "jaraco-context"
-version = "6.0.1"
+version = "6.0.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "backports-tarfile", marker = "python_full_version < '3.12'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/df/ad/f3777b81bf0b6e7bc7514a1656d3e637b2e8e15fab2ce3235730b3e7a4e6/jaraco_context-6.0.1.tar.gz", hash = "sha256:9bae4ea555cf0b14938dc0aee7c9f32ed303aa20a3b73e7dc80111628792d1b3", size = 13912, upload-time = "2024-08-20T03:39:27.358Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8d/7d/41acf8e22d791bde812cb6c2c36128bb932ed8ae066bcb5e39cb198e8253/jaraco_context-6.0.2.tar.gz", hash = "sha256:953ae8dddb57b1d791bf72ea1009b32088840a7dd19b9ba16443f62be919ee57", size = 14994, upload-time = "2025-12-24T19:21:35.784Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ff/db/0c52c4cf5e4bd9f5d7135ec7669a3a767af21b3a308e1ed3674881e52b62/jaraco.context-6.0.1-py3-none-any.whl", hash = "sha256:f797fc481b490edb305122c9181830a3a5b76d84ef6d1aef2fb9b47ab956f9e4", size = 6825, upload-time = "2024-08-20T03:39:25.966Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/0c/1e0096ced9c55f9c6c6655446798df74165780375d3f5ab5f33751e087ae/jaraco_context-6.0.2-py3-none-any.whl", hash = "sha256:55fc21af4b4f9ca94aa643b6ee7fe13b1e4c01abf3aeb98ca4ad9c80b741c786", size = 6988, upload-time = "2025-12-24T19:21:34.557Z" },
 ]
 
 [[package]]
 name = "jaraco-functools"
-version = "4.3.0"
+version = "4.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "more-itertools" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f7/ed/1aa2d585304ec07262e1a83a9889880701079dde796ac7b1d1826f40c63d/jaraco_functools-4.3.0.tar.gz", hash = "sha256:cfd13ad0dd2c47a3600b439ef72d8615d482cedcff1632930d6f28924d92f294", size = 19755, upload-time = "2025-08-18T20:05:09.91Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0f/27/056e0638a86749374d6f57d0b0db39f29509cce9313cf91bdc0ac4d91084/jaraco_functools-4.4.0.tar.gz", hash = "sha256:da21933b0417b89515562656547a77b4931f98176eb173644c0d35032a33d6bb", size = 19943, upload-time = "2025-12-21T09:29:43.6Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b4/09/726f168acad366b11e420df31bf1c702a54d373a83f968d94141a8c3fde0/jaraco_functools-4.3.0-py3-none-any.whl", hash = "sha256:227ff8ed6f7b8f62c56deff101545fa7543cf2c8e7b82a7c2116e672f29c26e8", size = 10408, upload-time = "2025-08-18T20:05:08.69Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/c4/813bb09f0985cb21e959f21f2464169eca882656849adf727ac7bb7e1767/jaraco_functools-4.4.0-py3-none-any.whl", hash = "sha256:9eec1e36f45c818d9bf307c8948eb03b2b56cd44087b3cdc989abca1f20b9176", size = 10481, upload-time = "2025-12-21T09:29:42.27Z" },
 ]
 
 [[package]]
@@ -774,6 +774,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/81/db/e655086b7f3a705df045bf0933bdd9c2f79bb3c97bfef1384598bb79a217/keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f", size = 39160, upload-time = "2025-11-16T16:26:08.402Z" },
 ]
 
+[[package]]
+name = "markdown"
+version = "3.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/ab/7dd27d9d863b3376fcf23a5a13cb5d024aed1db46f963f1b5735ae43b3be/markdown-3.10.tar.gz", hash = "sha256:37062d4f2aa4b2b6b32aefb80faa300f82cc790cb949a35b8caede34f2b68c0e", size = 364931, upload-time = "2025-11-03T19:51:15.007Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/70/81/54e3ce63502cd085a0c556652a4e1b919c45a446bd1e5300e10c44c8c521/markdown-3.10-py3-none-any.whl", hash = "sha256:b5b99d6951e2e4948d939255596523444c0e677c669700b1d17aa4a8a464cb7c", size = 107678, upload-time = "2025-11-03T19:51:13.887Z" },
+]
+
 [[package]]
 name = "markdown-it-py"
 version = "4.0.0"
@@ -848,11 +857,11 @@ wheels = [
 
 [[package]]
 name = "nodeenv"
-version = "1.9.1"
+version = "1.10.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/43/16/fc88b08840de0e0a72a2f9d8c6bae36be573e475a6326ae854bcc549fc45/nodeenv-1.9.1.tar.gz", hash = "sha256:6ec12890a2dab7946721edbfbcd91f3319c6ccc9aec47be7c7e6b7011ee6645f", size = 47437, upload-time = "2024-06-04T18:44:11.171Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/24/bf/d1bda4f6168e0b2e9e5958945e01910052158313224ada5ce1fb2e1113b8/nodeenv-1.10.0.tar.gz", hash = "sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb", size = 55611, upload-time = "2025-12-20T14:08:54.006Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d2/1d/1b658dbd2b9fa9c4c9f32accbfc0205d532c8c6194dc0f2a4c0428e7128a/nodeenv-1.9.1-py2.py3-none-any.whl", hash = "sha256:ba11c9782d29c27c70ffbdda2d7415098754709be8a7056d79a737cd901155c9", size = 22314, upload-time = "2024-06-04T18:44:08.352Z" },
+    { url = "https://files.pythonhosted.org/packages/88/b2/d0896bdcdc8d28a7fc5717c305f1a861c26e18c05047949fb371034d98bd/nodeenv-1.10.0-py2.py3-none-any.whl", hash = "sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827", size = 23438, upload-time = "2025-12-20T14:08:52.782Z" },
 ]
 
 [[package]]
@@ -905,7 +914,7 @@ wheels = [
 
 [[package]]
 name = "pre-commit"
-version = "4.5.0"
+version = "4.5.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cfgv" },
@@ -914,9 +923,9 @@ dependencies = [
     { name = "pyyaml" },
     { name = "virtualenv" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f4/9b/6a4ffb4ed980519da959e1cf3122fc6cb41211daa58dbae1c73c0e519a37/pre_commit-4.5.0.tar.gz", hash = "sha256:dc5a065e932b19fc1d4c653c6939068fe54325af8e741e74e88db4d28a4dd66b", size = 198428, upload-time = "2025-11-22T21:02:42.304Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/40/f1/6d86a29246dfd2e9b6237f0b5823717f60cad94d47ddc26afa916d21f525/pre_commit-4.5.1.tar.gz", hash = "sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61", size = 198232, upload-time = "2025-12-16T21:14:33.552Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5d/c4/b2d28e9d2edf4f1713eb3c29307f1a63f3d67cf09bdda29715a36a68921a/pre_commit-4.5.0-py2.py3-none-any.whl", hash = "sha256:25e2ce09595174d9c97860a95609f9f852c0614ba602de3561e267547f2335e1", size = 226429, upload-time = "2025-11-22T21:02:40.836Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/19/fd3ef348460c80af7bb4669ea7926651d1f95c23ff2df18b9d24bab4f3fa/pre_commit-4.5.1-py2.py3-none-any.whl", hash = "sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77", size = 226437, upload-time = "2025-12-16T21:14:32.409Z" },
 ]
 
 [[package]]
@@ -1184,28 +1193,28 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.14.8"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ed/d9/f7a0c4b3a2bf2556cd5d99b05372c29980249ef71e8e32669ba77428c82c/ruff-0.14.8.tar.gz", hash = "sha256:774ed0dd87d6ce925e3b8496feb3a00ac564bea52b9feb551ecd17e0a23d1eed", size = 5765385, upload-time = "2025-12-04T15:06:17.669Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/48/b8/9537b52010134b1d2b72870cc3f92d5fb759394094741b09ceccae183fbe/ruff-0.14.8-py3-none-linux_armv6l.whl", hash = "sha256:ec071e9c82eca417f6111fd39f7043acb53cd3fde9b1f95bbed745962e345afb", size = 13441540, upload-time = "2025-12-04T15:06:14.896Z" },
-    { url = "https://files.pythonhosted.org/packages/24/00/99031684efb025829713682012b6dd37279b1f695ed1b01725f85fd94b38/ruff-0.14.8-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:8cdb162a7159f4ca36ce980a18c43d8f036966e7f73f866ac8f493b75e0c27e9", size = 13669384, upload-time = "2025-12-04T15:06:51.809Z" },
-    { url = "https://files.pythonhosted.org/packages/72/64/3eb5949169fc19c50c04f28ece2c189d3b6edd57e5b533649dae6ca484fe/ruff-0.14.8-py3-none-macosx_11_0_arm64.whl", hash = "sha256:2e2fcbefe91f9fad0916850edf0854530c15bd1926b6b779de47e9ab619ea38f", size = 12806917, upload-time = "2025-12-04T15:06:08.925Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/08/5250babb0b1b11910f470370ec0cbc67470231f7cdc033cee57d4976f941/ruff-0.14.8-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a9d70721066a296f45786ec31916dc287b44040f553da21564de0ab4d45a869b", size = 13256112, upload-time = "2025-12-04T15:06:23.498Z" },
-    { url = "https://files.pythonhosted.org/packages/78/4c/6c588e97a8e8c2d4b522c31a579e1df2b4d003eddfbe23d1f262b1a431ff/ruff-0.14.8-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2c87e09b3cd9d126fc67a9ecd3b5b1d3ded2b9c7fce3f16e315346b9d05cfb52", size = 13227559, upload-time = "2025-12-04T15:06:33.432Z" },
-    { url = "https://files.pythonhosted.org/packages/23/ce/5f78cea13eda8eceac71b5f6fa6e9223df9b87bb2c1891c166d1f0dce9f1/ruff-0.14.8-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d62cb310c4fbcb9ee4ac023fe17f984ae1e12b8a4a02e3d21489f9a2a5f730c", size = 13896379, upload-time = "2025-12-04T15:06:02.687Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/79/13de4517c4dadce9218a20035b21212a4c180e009507731f0d3b3f5df85a/ruff-0.14.8-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:1af35c2d62633d4da0521178e8a2641c636d2a7153da0bac1b30cfd4ccd91344", size = 15372786, upload-time = "2025-12-04T15:06:29.828Z" },
-    { url = "https://files.pythonhosted.org/packages/00/06/33df72b3bb42be8a1c3815fd4fae83fa2945fc725a25d87ba3e42d1cc108/ruff-0.14.8-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:25add4575ffecc53d60eed3f24b1e934493631b48ebbc6ebaf9d8517924aca4b", size = 14990029, upload-time = "2025-12-04T15:06:36.812Z" },
-    { url = "https://files.pythonhosted.org/packages/64/61/0f34927bd90925880394de0e081ce1afab66d7b3525336f5771dcf0cb46c/ruff-0.14.8-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4c943d847b7f02f7db4201a0600ea7d244d8a404fbb639b439e987edcf2baf9a", size = 14407037, upload-time = "2025-12-04T15:06:39.979Z" },
-    { url = "https://files.pythonhosted.org/packages/96/bc/058fe0aefc0fbf0d19614cb6d1a3e2c048f7dc77ca64957f33b12cfdc5ef/ruff-0.14.8-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cb6e8bf7b4f627548daa1b69283dac5a296bfe9ce856703b03130732e20ddfe2", size = 14102390, upload-time = "2025-12-04T15:06:46.372Z" },
-    { url = "https://files.pythonhosted.org/packages/af/a4/e4f77b02b804546f4c17e8b37a524c27012dd6ff05855d2243b49a7d3cb9/ruff-0.14.8-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:7aaf2974f378e6b01d1e257c6948207aec6a9b5ba53fab23d0182efb887a0e4a", size = 14230793, upload-time = "2025-12-04T15:06:20.497Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/52/bb8c02373f79552e8d087cedaffad76b8892033d2876c2498a2582f09dcf/ruff-0.14.8-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:e5758ca513c43ad8a4ef13f0f081f80f08008f410790f3611a21a92421ab045b", size = 13160039, upload-time = "2025-12-04T15:06:49.06Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/ad/b69d6962e477842e25c0b11622548df746290cc6d76f9e0f4ed7456c2c31/ruff-0.14.8-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:f74f7ba163b6e85a8d81a590363bf71618847e5078d90827749bfda1d88c9cdf", size = 13205158, upload-time = "2025-12-04T15:06:54.574Z" },
-    { url = "https://files.pythonhosted.org/packages/06/63/54f23da1315c0b3dfc1bc03fbc34e10378918a20c0b0f086418734e57e74/ruff-0.14.8-py3-none-musllinux_1_2_i686.whl", hash = "sha256:eed28f6fafcc9591994c42254f5a5c5ca40e69a30721d2ab18bb0bb3baac3ab6", size = 13469550, upload-time = "2025-12-04T15:05:59.209Z" },
-    { url = "https://files.pythonhosted.org/packages/70/7d/a4d7b1961e4903bc37fffb7ddcfaa7beb250f67d97cfd1ee1d5cddb1ec90/ruff-0.14.8-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:21d48fa744c9d1cb8d71eb0a740c4dd02751a5de9db9a730a8ef75ca34cf138e", size = 14211332, upload-time = "2025-12-04T15:06:06.027Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/93/2a5063341fa17054e5c86582136e9895db773e3c2ffb770dde50a09f35f0/ruff-0.14.8-py3-none-win32.whl", hash = "sha256:15f04cb45c051159baebb0f0037f404f1dc2f15a927418f29730f411a79bc4e7", size = 13151890, upload-time = "2025-12-04T15:06:11.668Z" },
-    { url = "https://files.pythonhosted.org/packages/02/1c/65c61a0859c0add13a3e1cbb6024b42de587456a43006ca2d4fd3d1618fe/ruff-0.14.8-py3-none-win_amd64.whl", hash = "sha256:9eeb0b24242b5bbff3011409a739929f497f3fb5fe3b5698aba5e77e8c833097", size = 14537826, upload-time = "2025-12-04T15:06:26.409Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/63/8b41cea3afd7f58eb64ac9251668ee0073789a3bc9ac6f816c8c6fef986d/ruff-0.14.8-py3-none-win_arm64.whl", hash = "sha256:965a582c93c63fe715fd3e3f8aa37c4b776777203d8e1d8aa3cc0c14424a4b99", size = 13634522, upload-time = "2025-12-04T15:06:43.212Z" },
+version = "0.14.10"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/57/08/52232a877978dd8f9cf2aeddce3e611b40a63287dfca29b6b8da791f5e8d/ruff-0.14.10.tar.gz", hash = "sha256:9a2e830f075d1a42cd28420d7809ace390832a490ed0966fe373ba288e77aaf4", size = 5859763, upload-time = "2025-12-18T19:28:57.98Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/60/01/933704d69f3f05ee16ef11406b78881733c186fe14b6a46b05cfcaf6d3b2/ruff-0.14.10-py3-none-linux_armv6l.whl", hash = "sha256:7a3ce585f2ade3e1f29ec1b92df13e3da262178df8c8bdf876f48fa0e8316c49", size = 13527080, upload-time = "2025-12-18T19:29:25.642Z" },
+    { url = "https://files.pythonhosted.org/packages/df/58/a0349197a7dfa603ffb7f5b0470391efa79ddc327c1e29c4851e85b09cc5/ruff-0.14.10-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:674f9be9372907f7257c51f1d4fc902cb7cf014b9980152b802794317941f08f", size = 13797320, upload-time = "2025-12-18T19:29:02.571Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/82/36be59f00a6082e38c23536df4e71cdbc6af8d7c707eade97fcad5c98235/ruff-0.14.10-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d85713d522348837ef9df8efca33ccb8bd6fcfc86a2cde3ccb4bc9d28a18003d", size = 12918434, upload-time = "2025-12-18T19:28:51.202Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/00/45c62a7f7e34da92a25804f813ebe05c88aa9e0c25e5cb5a7d23dd7450e3/ruff-0.14.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6987ebe0501ae4f4308d7d24e2d0fe3d7a98430f5adfd0f1fead050a740a3a77", size = 13371961, upload-time = "2025-12-18T19:29:04.991Z" },
+    { url = "https://files.pythonhosted.org/packages/40/31/a5906d60f0405f7e57045a70f2d57084a93ca7425f22e1d66904769d1628/ruff-0.14.10-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:16a01dfb7b9e4eee556fbfd5392806b1b8550c9b4a9f6acd3dbe6812b193c70a", size = 13275629, upload-time = "2025-12-18T19:29:21.381Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/60/61c0087df21894cf9d928dc04bcd4fb10e8b2e8dca7b1a276ba2155b2002/ruff-0.14.10-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7165d31a925b7a294465fa81be8c12a0e9b60fb02bf177e79067c867e71f8b1f", size = 14029234, upload-time = "2025-12-18T19:29:00.132Z" },
+    { url = "https://files.pythonhosted.org/packages/44/84/77d911bee3b92348b6e5dab5a0c898d87084ea03ac5dc708f46d88407def/ruff-0.14.10-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:c561695675b972effb0c0a45db233f2c816ff3da8dcfbe7dfc7eed625f218935", size = 15449890, upload-time = "2025-12-18T19:28:53.573Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/36/480206eaefa24a7ec321582dda580443a8f0671fdbf6b1c80e9c3e93a16a/ruff-0.14.10-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4bb98fcbbc61725968893682fd4df8966a34611239c9fd07a1f6a07e7103d08e", size = 15123172, upload-time = "2025-12-18T19:29:23.453Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/38/68e414156015ba80cef5473d57919d27dfb62ec804b96180bafdeaf0e090/ruff-0.14.10-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f24b47993a9d8cb858429e97bdf8544c78029f09b520af615c1d261bf827001d", size = 14460260, upload-time = "2025-12-18T19:29:27.808Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/19/9e050c0dca8aba824d67cc0db69fb459c28d8cd3f6855b1405b3f29cc91d/ruff-0.14.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:59aabd2e2c4fd614d2862e7939c34a532c04f1084476d6833dddef4afab87e9f", size = 14229978, upload-time = "2025-12-18T19:29:11.32Z" },
+    { url = "https://files.pythonhosted.org/packages/51/eb/e8dd1dd6e05b9e695aa9dd420f4577debdd0f87a5ff2fedda33c09e9be8c/ruff-0.14.10-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:213db2b2e44be8625002dbea33bb9c60c66ea2c07c084a00d55732689d697a7f", size = 14338036, upload-time = "2025-12-18T19:29:09.184Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/12/f3e3a505db7c19303b70af370d137795fcfec136d670d5de5391e295c134/ruff-0.14.10-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:b914c40ab64865a17a9a5b67911d14df72346a634527240039eb3bd650e5979d", size = 13264051, upload-time = "2025-12-18T19:29:13.431Z" },
+    { url = "https://files.pythonhosted.org/packages/08/64/8c3a47eaccfef8ac20e0484e68e0772013eb85802f8a9f7603ca751eb166/ruff-0.14.10-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:1484983559f026788e3a5c07c81ef7d1e97c1c78ed03041a18f75df104c45405", size = 13283998, upload-time = "2025-12-18T19:29:06.994Z" },
+    { url = "https://files.pythonhosted.org/packages/12/84/534a5506f4074e5cc0529e5cd96cfc01bb480e460c7edf5af70d2bcae55e/ruff-0.14.10-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c70427132db492d25f982fffc8d6c7535cc2fd2c83fc8888f05caaa248521e60", size = 13601891, upload-time = "2025-12-18T19:28:55.811Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/1e/14c916087d8598917dbad9b2921d340f7884824ad6e9c55de948a93b106d/ruff-0.14.10-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:5bcf45b681e9f1ee6445d317ce1fa9d6cba9a6049542d1c3d5b5958986be8830", size = 14336660, upload-time = "2025-12-18T19:29:16.531Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/1c/d7b67ab43f30013b47c12b42d1acd354c195351a3f7a1d67f59e54227ede/ruff-0.14.10-py3-none-win32.whl", hash = "sha256:104c49fc7ab73f3f3a758039adea978869a918f31b73280db175b43a2d9b51d6", size = 13196187, upload-time = "2025-12-18T19:29:19.006Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/9c/896c862e13886fae2af961bef3e6312db9ebc6adc2b156fe95e615dee8c1/ruff-0.14.10-py3-none-win_amd64.whl", hash = "sha256:466297bd73638c6bdf06485683e812db1c00c7ac96d4ddd0294a338c62fdc154", size = 14661283, upload-time = "2025-12-18T19:29:30.16Z" },
+    { url = "https://files.pythonhosted.org/packages/74/31/b0e29d572670dca3674eeee78e418f20bdf97fa8aa9ea71380885e175ca0/ruff-0.14.10-py3-none-win_arm64.whl", hash = "sha256:e51d046cf6dda98a4633b8a8a771451107413b0f07183b2bef03f075599e44e6", size = 13729839, upload-time = "2025-12-18T19:28:48.636Z" },
 ]
 
 [[package]]
@@ -1241,24 +1250,25 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.22"
+version = "3.0.25"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c1/87/054e1cc4593127361773d782f7d0544e32d0f5f299f3493392bfe426af70/socketdev-3.0.22.tar.gz", hash = "sha256:11cb1e0b5bfad44c1130edcc5cbfc2b1268157718e424b486ae492e00b3f93ec", size = 164883, upload-time = "2025-12-10T14:55:28.067Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/88/49/207860555b4a78d621d5f45db2255754010862292aa09c212893dc3161ab/socketdev-3.0.25.tar.gz", hash = "sha256:422d06ae6ba50ed1fb07b6ede3b20bfc9fbbeae144d03aeed3fdbd8190966a9a", size = 168706, upload-time = "2026-01-01T21:58:40.829Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e6/38/4f6fa954d5c0e9ed5422d59b56499ee57b95482c85c477c06667ce5e0654/socketdev-3.0.22-py3-none-any.whl", hash = "sha256:066e1647257132d7ef4d0a515251389ba91a869d4c64f903c220513dcc21180f", size = 59691, upload-time = "2025-12-10T14:55:26.246Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/1f/49ca3bfa137921899f050b030af072b5679dba3f72f0162cacd5910a8a79/socketdev-3.0.25-py3-none-any.whl", hash = "sha256:a23f76f1536a6c7473c54608e57e33735d01cd287d8f2ae75a5378f2ddedf7e5", size = 65711, upload-time = "2026-01-01T21:58:39Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.50"
+version = "2.2.59"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
     { name = "gitpython" },
+    { name = "markdown" },
     { name = "mdutils" },
     { name = "packaging" },
     { name = "prettytable" },
@@ -1293,6 +1303,7 @@ requires-dist = [
     { name = "bs4", specifier = ">=0.0.2" },
     { name = "gitpython" },
     { name = "hatch", marker = "extra == 'dev'" },
+    { name = "markdown", specifier = ">=3.10" },
     { name = "mdutils" },
     { name = "packaging" },
     { name = "pre-commit", marker = "extra == 'dev'" },
@@ -1305,7 +1316,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.22,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.25,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]
@@ -1316,11 +1327,11 @@ dev = [{ name = "pre-commit", specifier = ">=4.3.0" }]
 
 [[package]]
 name = "soupsieve"
-version = "2.8"
+version = "2.8.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6d/e6/21ccce3262dd4889aa3332e5a119a3491a95e8f60939870a3a035aabac0d/soupsieve-2.8.tar.gz", hash = "sha256:e2dd4a40a628cb5f28f6d4b0db8800b8f581b65bb380b97de22ba5ca8d72572f", size = 103472, upload-time = "2025-08-27T15:39:51.78Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/89/23/adf3796d740536d63a6fbda113d07e60c734b6ed5d3058d1e47fc0495e47/soupsieve-2.8.1.tar.gz", hash = "sha256:4cf733bc50fa805f5df4b8ef4740fc0e0fa6218cf3006269afd3f9d6d80fd350", size = 117856, upload-time = "2025-12-18T13:50:34.655Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/14/a0/bb38d3b76b8cae341dad93a2dd83ab7462e6dbcdd84d43f54ee60a8dc167/soupsieve-2.8-py3-none-any.whl", hash = "sha256:0cc76456a30e20f5d7f2e14a98a4ae2ee4e5abdc7c5ea0aafe795f344bc7984c", size = 36679, upload-time = "2025-08-27T15:39:50.179Z" },
+    { url = "https://files.pythonhosted.org/packages/48/f3/b67d6ea49ca9154453b6d70b34ea22f3996b9fa55da105a79d8732227adc/soupsieve-2.8.1-py3-none-any.whl", hash = "sha256:a11fe2a6f3d76ab3cf2de04eb339c1be5b506a8a47f2ceb6d139803177f85434", size = 36710, upload-time = "2025-12-18T13:50:33.267Z" },
 ]
 
 [[package]]
@@ -1430,11 +1441,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.1"
+version = "2.6.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/5e/1d/0f3a93cca1ac5e8287842ed4eebbd0f7a991315089b1a0b01c7788aa7b63/urllib3-2.6.1.tar.gz", hash = "sha256:5379eb6e1aba4088bae84f8242960017ec8d8e3decf30480b3a1abdaa9671a3f", size = 432678, upload-time = "2025-12-08T15:25:26.773Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1e/24/a2a2ed9addd907787d7aa0355ba36a6cadf1768b934c652ea78acbd59dcd/urllib3-2.6.2.tar.gz", hash = "sha256:016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797", size = 432930, upload-time = "2025-12-11T15:56:40.252Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bc/56/190ceb8cb10511b730b564fb1e0293fa468363dbad26145c34928a60cb0c/urllib3-2.6.1-py3-none-any.whl", hash = "sha256:e67d06fe947c36a7ca39f4994b08d73922d40e6cca949907be05efa6fd75110b", size = 131138, upload-time = "2025-12-08T15:25:25.51Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b9/4095b668ea3678bf6a0af005527f39de12fb026516fb3df17495a733b7f8/urllib3-2.6.2-py3-none-any.whl", hash = "sha256:ec21cddfe7724fc7cb4ba4bea7aa8e2ef36f607a4bab81aa6ce42a13dc3f03dd", size = 131182, upload-time = "2025-12-11T15:56:38.584Z" },
 ]
 
 [[package]]
@@ -1451,28 +1462,28 @@ wheels = [
 
 [[package]]
 name = "uv"
-version = "0.9.17"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/52/1a/cb0c37ae8513b253bcbc13d42392feb7d95ea696eb398b37535a28df9040/uv-0.9.17.tar.gz", hash = "sha256:6d93ab9012673e82039cfa7f9f66f69b388bc3f910f9e8a2ebee211353f620aa", size = 3815957, upload-time = "2025-12-09T23:01:21.756Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/2b/e2/b6e2d473bdc37f4d86307151b53c0776e9925de7376ce297e92eab2e8894/uv-0.9.17-py3-none-linux_armv6l.whl", hash = "sha256:c708e6560ae5bc3cda1ba93f0094148ce773b6764240ced433acf88879e57a67", size = 21254511, upload-time = "2025-12-09T23:00:36.604Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/40/75f1529a8bf33cc5c885048e64a014c3096db5ac7826c71e20f2b731b588/uv-0.9.17-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:233b3d90f104c59d602abf434898057876b87f64df67a37129877d6dab6e5e10", size = 20384366, upload-time = "2025-12-09T23:01:17.293Z" },
-    { url = "https://files.pythonhosted.org/packages/de/30/b3a343893681a569cbb74f8747a1c24e5f18ca9e07de0430aceaf9389ef4/uv-0.9.17-py3-none-macosx_11_0_arm64.whl", hash = "sha256:4b8e5513d48a267bfa180ca7fefaf6f27b1267e191573b3dba059981143e88ef", size = 18924624, upload-time = "2025-12-09T23:01:10.291Z" },
-    { url = "https://files.pythonhosted.org/packages/21/56/9daf8bbe4a9a36eb0b9257cf5e1e20f9433d0ce996778ccf1929cbe071a4/uv-0.9.17-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:8f283488bbcf19754910cc1ae7349c567918d6367c596e5a75d4751e0080eee0", size = 20671687, upload-time = "2025-12-09T23:00:51.927Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/c8/4050ff7dc692770092042fcef57223b8852662544f5981a7f6cac8fc488d/uv-0.9.17-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:9cf8052ba669dc17bdba75dae655094d820f4044990ea95c01ec9688c182f1da", size = 20861866, upload-time = "2025-12-09T23:01:12.555Z" },
-    { url = "https://files.pythonhosted.org/packages/84/d4/208e62b7db7a65cb3390a11604c59937e387d07ed9f8b63b54edb55e2292/uv-0.9.17-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:06749461b11175a884be193120044e7f632a55e2624d9203398808907d346aad", size = 21858420, upload-time = "2025-12-09T23:01:00.009Z" },
-    { url = "https://files.pythonhosted.org/packages/86/2c/91288cd5a04db37dfc1e0dad26ead84787db5832d9836b4cc8e0fa7f3c53/uv-0.9.17-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:35eb1a519688209160e48e1bb8032d36d285948a13b4dd21afe7ec36dc2a9787", size = 23471658, upload-time = "2025-12-09T23:00:49.503Z" },
-    { url = "https://files.pythonhosted.org/packages/44/ba/493eba650ffad1df9e04fd8eabfc2d0aebc23e8f378acaaee9d95ca43518/uv-0.9.17-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2bfb60a533e82690ab17dfe619ff7f294d053415645800d38d13062170230714", size = 23062950, upload-time = "2025-12-09T23:00:39.055Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/9e/f7f679503c06843ba59451e3193f35fb7c782ff0afc697020d4718a7de46/uv-0.9.17-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:cd0f3e380ff148aff3d769e95a9743cb29c7f040d7ef2896cafe8063279a6bc1", size = 22080299, upload-time = "2025-12-09T23:00:44.026Z" },
-    { url = "https://files.pythonhosted.org/packages/32/2e/76ba33c7d9efe9f17480db1b94d3393025062005e346bb8b3660554526da/uv-0.9.17-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cd2c3d25fbd8f91b30d0fac69a13b8e2c2cd8e606d7e6e924c1423e4ff84e616", size = 22087554, upload-time = "2025-12-09T23:00:41.715Z" },
-    { url = "https://files.pythonhosted.org/packages/14/db/ef4aae4a6c49076db2acd2a7b0278ddf3dbf785d5172b3165018b96ba2fb/uv-0.9.17-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:330e7085857e4205c5196a417aca81cfbfa936a97dd2a0871f6560a88424ebf2", size = 20823225, upload-time = "2025-12-09T23:00:57.041Z" },
-    { url = "https://files.pythonhosted.org/packages/11/73/e0f816cacd802a1cb25e71de9d60e57fa1f6c659eb5599cef708668618cc/uv-0.9.17-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:45880faa9f6cf91e3cda4e5f947da6a1004238fdc0ed4ebc18783a12ce197312", size = 22004893, upload-time = "2025-12-09T23:01:15.011Z" },
-    { url = "https://files.pythonhosted.org/packages/15/6b/700f6256ee191136eb06e40d16970a4fc687efdccf5e67c553a258063019/uv-0.9.17-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:8e775a1b94c6f248e22f0ce2f86ed37c24e10ae31fb98b7e1b9f9a3189d25991", size = 20853850, upload-time = "2025-12-09T23:01:02.694Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/6a/13f02e2ed6510223c40f74804586b09e5151d9319f93aab1e49d91db13bb/uv-0.9.17-py3-none-musllinux_1_1_i686.whl", hash = "sha256:8650c894401ec96488a6fd84a5b4675e09be102f5525c902a12ba1c8ef8ff230", size = 21322623, upload-time = "2025-12-09T23:00:46.806Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/18/2d19780cebfbec877ea645463410c17859f8070f79c1a34568b153d78e1d/uv-0.9.17-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:673066b72d8b6c86be0dae6d5f73926bcee8e4810f1690d7b8ce5429d919cde3", size = 22290123, upload-time = "2025-12-09T23:00:54.394Z" },
-    { url = "https://files.pythonhosted.org/packages/77/69/ab79bde3f7b6d2ac89f839ea40411a9cf3e67abede2278806305b6ba797e/uv-0.9.17-py3-none-win32.whl", hash = "sha256:7407d45afeae12399de048f7c8c2256546899c94bd7892dbddfae6766616f5a3", size = 20070709, upload-time = "2025-12-09T23:01:05.105Z" },
-    { url = "https://files.pythonhosted.org/packages/08/a0/ab5b1850197bf407d095361b214352e40805441791fed35b891621cb1562/uv-0.9.17-py3-none-win_amd64.whl", hash = "sha256:22fcc26755abebdf366becc529b2872a831ce8bb14b36b6a80d443a1d7f84d3b", size = 22122852, upload-time = "2025-12-09T23:01:07.783Z" },
-    { url = "https://files.pythonhosted.org/packages/37/ef/813cfedda3c8e49d8b59a41c14fcc652174facfd7a1caf9fee162b40ccbd/uv-0.9.17-py3-none-win_arm64.whl", hash = "sha256:6761076b27a763d0ede2f5e72455d2a46968ff334badf8312bb35988c5254831", size = 20435751, upload-time = "2025-12-09T23:01:19.732Z" },
+version = "0.9.21"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e2/2b/4e2090bc3a6265b445b3d31ca6fff20c6458d11145069f7e48ade3e2d75b/uv-0.9.21.tar.gz", hash = "sha256:aa4ca6ccd68e81b5ebaa3684d3c4df2b51a982ac16211eadf0707741d36e6488", size = 3834762, upload-time = "2025-12-30T16:12:51.927Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/da/26/0750c5bb1637ebefe1db0936dc76ead8ce97f17368cda950642bfd90fa3f/uv-0.9.21-py3-none-linux_armv6l.whl", hash = "sha256:0b330eaced2fd9d94e2a70f3bb6c8fd7beadc9d9bf9f1227eb14da44039c413a", size = 21266556, upload-time = "2025-12-30T16:12:47.311Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/ef/f019466c1e367ea68003cf35f4d44cc328694ed4a59b6004aa7dcacb2b35/uv-0.9.21-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:1d8e0940bddd37a55f4479d61adaa6b302b780d473f037fc084e48b09a1678e7", size = 20485648, upload-time = "2025-12-30T16:12:15.746Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/41/f735bd9a5b4848b6f4f1028e6d768f581559d68eddb6403eb0f19ca4c843/uv-0.9.21-py3-none-macosx_11_0_arm64.whl", hash = "sha256:cb420ddab7bcdd12c2352d4b551ced428d104311c0b98ce205675ab5c97072db", size = 18986976, upload-time = "2025-12-30T16:12:25.034Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/5f/01d537e05927594dc379ff8bc04f8cde26384d25108a9f63758eae2a7936/uv-0.9.21-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:a36d164438a6310c9fceebd041d80f7cffcc63ba80a7c83ee98394fadf2b8545", size = 20819312, upload-time = "2025-12-30T16:12:41.802Z" },
+    { url = "https://files.pythonhosted.org/packages/18/89/9497395f57e007a2daed8172042ecccade3ff5569fd367d093f49bd6a4a8/uv-0.9.21-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:c0ad83ce874cbbf9eda569ba793a9fb70870db426e9862300db8cf2950a7fe3b", size = 20900227, upload-time = "2025-12-30T16:12:19.242Z" },
+    { url = "https://files.pythonhosted.org/packages/04/61/a3f6dfc75d278cce96b370e00b6f03d73ec260e5304f622504848bad219d/uv-0.9.21-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9076191c934b813147060e4cd97e33a58999de0f9c46f8ac67f614e154dae5c8", size = 21965424, upload-time = "2025-12-30T16:12:01.589Z" },
+    { url = "https://files.pythonhosted.org/packages/18/3e/344e8c1078cfea82159c6608b8694f24fdfe850ce329a4708c026cb8b0ff/uv-0.9.21-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:2ce0f6aca91f7fbf1192e43c063f4de3666fd43126aacc71ff7d5a79f831af59", size = 23540343, upload-time = "2025-12-30T16:12:13.139Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/20/5826659a81526687c6e5b5507f3f79f4f4b7e3022f3efae2ba36b19864c3/uv-0.9.21-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0b4817642d5ef248b74ca7be3505e5e012a06be050669b80d1f7ced5ad50d188", size = 23171564, upload-time = "2025-12-30T16:12:22.219Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/8d/404c54e019bb99ce474dc21e6b96c8a1351ba3c06e5e19fd8dcae0ba1899/uv-0.9.21-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4fb42237fa309d79905fb73f653f63c1fe45a51193411c614b13512cf5506df3", size = 22202400, upload-time = "2025-12-30T16:12:04.612Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/f0/aa3d0081a2004050564364a1ef3277ddf889c9989a7278c0a9cce8284926/uv-0.9.21-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f1d22f0ac03635d661e811c69d7c0b292751f90699acc6a1fb1509e17c936474", size = 22206448, upload-time = "2025-12-30T16:12:30.626Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/a9/7a375e723a588f31f305ddf9ae2097af0b9dc7f7813641788b5b9764a237/uv-0.9.21-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:cdd805909d360ad67640201376c8eb02de08dcf1680a1a81aebd9519daed6023", size = 20940568, upload-time = "2025-12-30T16:12:27.533Z" },
+    { url = "https://files.pythonhosted.org/packages/18/d5/6187ffb7e1d24df34defe2718db8c4c3c08f153d3e7da22c250134b79cd1/uv-0.9.21-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:82e438595a609cbe4e45c413a54bd5756d37c8c39108ce7b2799aff15f7d3337", size = 22085077, upload-time = "2025-12-30T16:12:10.153Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/fa/8e211167d0690d9f15a08da610a0383d2f43a6c838890878e14948472284/uv-0.9.21-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:fc1c06e1e5df423e1517e350ea2c9d85ecefd0919188a0a9f19bd239bbbdeeaf", size = 20862893, upload-time = "2025-12-30T16:12:49.87Z" },
+    { url = "https://files.pythonhosted.org/packages/33/b2/9d24d84cb9a1a6a5ea98d03a29abf800d87e5710d25e53896dc73aeb63a5/uv-0.9.21-py3-none-musllinux_1_1_i686.whl", hash = "sha256:9ef3d2a213c7720f4dae336e5123fe88427200d7523c78091c4ab7f849c3f13f", size = 21428397, upload-time = "2025-12-30T16:12:07.483Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/40/1e8e4c2e1308432c708eaa66dccdb83d2ee6120ea2b7d65e04fc06f48ff8/uv-0.9.21-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:8da20914d92ba4cc35f071414d3da7365294fc0b7114da8ac2ab3a86c695096f", size = 22450537, upload-time = "2025-12-30T16:12:33.36Z" },
+    { url = "https://files.pythonhosted.org/packages/18/b8/99c4731d001f512e844dfdc740db2bf2fea56d538749b639d21f5117a74a/uv-0.9.21-py3-none-win32.whl", hash = "sha256:e716e23bc0ec8cbb0811f99e653745e0cf15223e7ba5d8857d46be5b40b3045b", size = 20032654, upload-time = "2025-12-30T16:12:36.007Z" },
+    { url = "https://files.pythonhosted.org/packages/29/6b/da441bf335f5e1c0c100b7dfb9702b6fed367ba703e543037bf1e70bf8c3/uv-0.9.21-py3-none-win_amd64.whl", hash = "sha256:64a7bb0e4e6a4c2d98c2d55f42aead7c2df0ceb17d5911d1a42b76228cab4525", size = 22206744, upload-time = "2025-12-30T16:12:38.953Z" },
+    { url = "https://files.pythonhosted.org/packages/98/02/afbed8309fe07aaa9fa58a98941cebffbcd300fe70499a02a6806d93517b/uv-0.9.21-py3-none-win_arm64.whl", hash = "sha256:6c13c40966812f6bd6ecb6546e5d3e27e7fe9cefa07018f074f51d703cb29e1c", size = 20591604, upload-time = "2025-12-30T16:12:44.634Z" },
 ]
 
 [[package]]

From 58bcf7658b689e1eb44286b36cc79b87015d3532 Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Sun, 4 Jan 2026 18:00:40 -0800
Subject: [PATCH 12/80] Added support to do a Slack Bot instead of just a Slack
 WebHook (#145)

* Added support to do a Slack Bot instead of just a Slack WebHook

* Updated README with new Slack bot directions
---
 README.md                       |  86 ++++++++++--
 pyproject.toml                  |   2 +-
 session.md                      | 127 +++++++++++++++++
 socketsecurity/__init__.py      |   2 +-
 socketsecurity/core/__init__.py |   5 +-
 socketsecurity/plugins/slack.py | 233 +++++++++++++++++++++++++++++++-
 socketsecurity/socketcli.py     |   1 +
 7 files changed, 439 insertions(+), 17 deletions(-)
 create mode 100644 session.md

diff --git a/README.md b/README.md
index dacc8a9..f0d3c27 100644
--- a/README.md
+++ b/README.md
@@ -221,43 +221,113 @@ Example `SOCKET_JIRA_CONFIG_JSON` value
 
 | Environment Variable     | Required | Default | Description                        |
 |:-------------------------|:---------|:--------|:-----------------------------------|
-| SOCKET_SLACK_CONFIG_JSON | False    | None    | Slack webhook configuration (enables plugin when set). Alternatively, use --slack-webhook CLI flag. |
+| SOCKET_SLACK_CONFIG_JSON | False    | None    | Slack configuration (enables plugin when set). Supports webhook or bot mode. Alternatively, use --slack-webhook CLI flag for simple webhook mode. |
+| SOCKET_SLACK_BOT_TOKEN   | False    | None    | Slack Bot User OAuth Token (starts with `xoxb-`). Required when using bot mode. |
 
-Example `SOCKET_SLACK_CONFIG_JSON` value (simple webhook):
+**Slack supports two modes:**
+
+1. **Webhook Mode** (default): Posts to incoming webhooks
+2. **Bot Mode**: Posts via Slack API with bot token authentication
+
+###### Webhook Mode Examples
+
+Simple webhook:
 
 ````json
-{"url": "https://REPLACE_ME_WEBHOOK"}
+{"url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"}
 ````
 
-Example with advanced filtering (reachability-only alerts):
+Multiple webhooks with advanced filtering:
 
 ````json
 {
+  "mode": "webhook",
   "url": [
     {
       "name": "prod_alerts",
       "url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+    },
+    {
+      "name": "critical_only",
+      "url": "https://hooks.slack.com/services/YOUR/OTHER/WEBHOOK/URL"
     }
   ],
   "url_configs": {
     "prod_alerts": {
       "reachability_alerts_only": true,
-      "always_send_reachability": true
+      "severities": ["high", "critical"]
+    },
+    "critical_only": {
+      "severities": ["critical"]
     }
   }
 }
 ````
 
-**Advanced Configuration Options:**
+###### Bot Mode Examples
+
+**Setting up a Slack Bot:**
+1. Go to https://api.slack.com/apps and create a new app
+2. Under "OAuth & Permissions", add the `chat:write` bot scope
+3. Install the app to your workspace and copy the "Bot User OAuth Token"
+4. Invite the bot to your channels: `/invite @YourBotName`
+
+Basic bot configuration:
+
+````json
+{
+  "mode": "bot",
+  "bot_configs": [
+    {
+      "name": "security_alerts",
+      "channels": ["security-alerts", "dev-team"]
+    }
+  ]
+}
+````
+
+Bot with filtering (reachability-only alerts):
+
+````json
+{
+  "mode": "bot",
+  "bot_configs": [
+    {
+      "name": "critical_reachable",
+      "channels": ["security-critical"],
+      "severities": ["critical", "high"],
+      "reachability_alerts_only": true
+    },
+    {
+      "name": "all_alerts",
+      "channels": ["security-all"],
+      "repos": ["myorg/backend", "myorg/frontend"]
+    }
+  ]
+}
+````
+
+Set the bot token:
+```bash
+export SOCKET_SLACK_BOT_TOKEN="xoxb-your-bot-token-here"
+```
 
-The `url_configs` object allows per-webhook filtering:
+**Configuration Options:**
 
+Webhook mode (`url_configs`):
 - `reachability_alerts_only` (boolean, default: false): When `--reach` is enabled, only send blocking alerts (error=true) from diff scans
-- `always_send_reachability` (boolean, default: true): Send reachability alerts even on non-diff scans when `--reach` is enabled. Set to false to only send reachability alerts when there are diff alerts.
 - `repos` (array): Only send alerts for specific repositories (e.g., `["owner/repo1", "owner/repo2"]`)
 - `alert_types` (array): Only send specific alert types (e.g., `["malware", "typosquat"]`)
 - `severities` (array): Only send alerts with specific severities (e.g., `["high", "critical"]`)
 
+Bot mode (`bot_configs` array items):
+- `name` (string, required): Friendly name for this configuration
+- `channels` (array, required): Channel names (without #) where alerts will be posted
+- `severities` (array, optional): Only send alerts with specific severities (e.g., `["high", "critical"]`)
+- `repos` (array, optional): Only send alerts for specific repositories
+- `alert_types` (array, optional): Only send specific alert types
+- `reachability_alerts_only` (boolean, default: false): Only send reachable vulnerabilities when using `--reach`
+
 ## Automatic Git Detection
 
 The CLI now automatically detects repository information from your git environment, significantly simplifying usage in CI/CD pipelines:
diff --git a/pyproject.toml b/pyproject.toml
index d906dc6..47c55cf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.60"
+version = "2.2.62"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/session.md b/session.md
new file mode 100644
index 0000000..5707e67
--- /dev/null
+++ b/session.md
@@ -0,0 +1,127 @@
+# Session Directions: Add Slack Bot Mode Support
+
+## Context
+The Socket Python CLI currently supports Slack notifications via incoming webhooks. We need to add an alternative "bot" mode that uses a Slack App with Bot Token for more flexible channel routing.
+
+## Current Implementation
+- File: `socketsecurity/plugins/slack.py`
+- File: `socketsecurity/config.py`
+- Env var: `SOCKET_SLACK_CONFIG_JSON`
+- Current config uses `url` and `url_configs` for webhook routing
+
+## Requirements
+
+### 1. Add Mode Selection
+- Add top-level `mode` field to Slack config
+- Valid values: "webhook" (default), "bot"
+- Mode determines which authentication and routing method to use
+
+### 2. Webhook Mode (existing, default)
+```json
+{
+  "enabled": true,
+  "mode": "webhook",
+  "url": ["https://hooks.slack.com/..."],
+  "url_configs": {
+    "webhook_0": {"repos": ["repo1"], "severities": ["critical"]}
+  }
+}
+```
+Keep all existing webhook functionality unchanged.
+
+### 3. Bot Mode (new)
+```json
+{
+  "enabled": true,
+  "mode": "bot",
+  "bot_configs": [
+    {
+      "name": "critical_alerts",
+      "channels": ["security-alerts", "critical-incidents"],
+      "repos": ["prod-app"],
+      "severities": ["critical"],
+      "reachability_alerts_only": true
+    },
+    {
+      "name": "all_alerts", 
+      "channels": ["dev-alerts"],
+      "severities": ["high", "medium"]
+    }
+  ]
+}
+```
+
+- New env var: `SOCKET_SLACK_BOT_TOKEN` (Bot User OAuth Token starting with `xoxb-`)
+- Use `bot_configs` array instead of `url` + `url_configs`
+- Each bot_config has:
+  - `name`: identifier for logging
+  - `channels`: array of Slack channel names or IDs to post to
+  - All existing filter options: `repos`, `severities`, `alert_types`, `reachability_alerts_only`, `always_send_reachability`
+
+### 4. Channel Routing
+- Slack API accepts both channel names (without #) and channel IDs (C1234567890)
+- Recommend supporting both: try name first, fallback to ID if needed
+- API endpoint: `https://slack.com/api/chat.postMessage`
+- Request format:
+```python
+{
+    "channel": "channel-name",  # or "C1234567890"
+    "blocks": blocks
+}
+```
+- Headers: `{"Authorization": f"Bearer {bot_token}", "Content-Type": "application/json"}`
+
+### 5. Implementation Tasks
+
+#### config.py
+- No changes needed (config is loaded from JSON env var)
+
+#### slack.py
+1. Update `send()` method:
+   - Check `self.config.get("mode", "webhook")` 
+   - If "webhook": call existing `_send_webhook_alerts()` (refactor current logic)
+   - If "bot": call new `_send_bot_alerts()`
+
+2. Create `_send_bot_alerts()` method:
+   - Get bot token from env: `os.getenv("SOCKET_SLACK_BOT_TOKEN")`
+   - Validate token exists and starts with "xoxb-"
+   - Get `bot_configs` from config
+   - For each bot_config, filter alerts same way as webhooks
+   - For each channel in bot_config's channels array, post message via chat.postMessage API
+
+3. Create `_post_to_slack_api()` helper method:
+   - Takes bot_token, channel, blocks
+   - Posts to https://slack.com/api/chat.postMessage
+   - Returns response
+   - Log errors with channel name/ID for debugging
+
+4. Error handling:
+   - Log if bot token missing when mode is "bot"
+   - Handle API errors (invalid channel, missing permissions, rate limits)
+   - Parse Slack API response JSON (it returns 200 with error in body)
+
+5. Reuse existing:
+   - All filtering logic (`_filter_alerts`)
+   - All block building (`create_slack_blocks_from_diff`, `_create_reachability_slack_blocks_from_structured`)
+   - All reachability data loading
+
+### 6. Testing Considerations
+- Test both modes don't interfere with each other
+- Test channel name resolution
+- Test channel ID usage
+- Test multiple channels per bot_config
+- Test error handling when bot token invalid or missing
+- Verify block count limits still respected (50 blocks)
+
+### 7. Documentation Updates (README.md)
+Add bot mode configuration examples and SOCKET_SLACK_BOT_TOKEN env var documentation.
+
+## Key Files to Modify
+1. `socketsecurity/plugins/slack.py` - main implementation
+2. `README.md` - add bot mode documentation
+
+## Notes
+- Slack chat.postMessage returns HTTP 200 even on errors. Check response JSON for `"ok": false`
+- Rate limit: 1 message per second per channel (more generous than webhooks)
+- Channel names are case-insensitive, don't need # prefix
+- Public and private channels both work if bot is invited
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index b4aba6c..13f0729 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.60'
+__version__ = '2.2.62'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 9da7915..fa227b6 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -553,7 +553,10 @@ def create_full_scan(self, files: List[str], params: FullScanParams, base_paths:
 
         # Finalize tier1 scan if reachability analysis was enabled
         if self.cli_config and self.cli_config.reach:
-            facts_file_path = self.cli_config.reach_output_file or ".socket.facts.json"
+            facts_file_path = os.path.join(
+                self.cli_config.target_path or ".", 
+                self.cli_config.reach_output_file
+            )
             log.debug(f"Reachability analysis enabled, finalizing tier1 scan for full scan {full_scan.id}")
             try:
                 success = self.finalize_tier1_scan(full_scan.id, facts_file_path)
diff --git a/socketsecurity/plugins/slack.py b/socketsecurity/plugins/slack.py
index ba2cd6c..ab41cc5 100644
--- a/socketsecurity/plugins/slack.py
+++ b/socketsecurity/plugins/slack.py
@@ -1,4 +1,5 @@
 import logging
+import os
 import requests
 from socketsecurity.config import CliConfig
 from .base import Plugin
@@ -20,10 +21,19 @@ def get_name():
         return "slack"
 
     def send(self, diff, config: CliConfig):
-        if not self.config.get("enabled", False):
-            if config.enable_debug:
-                logger.debug("Slack plugin is disabled - skipping webhook notification")
+        # Check mode and route to appropriate handler
+        mode = self.config.get("mode", "webhook")
+        
+        if mode == "webhook":
+            self._send_webhook_alerts(diff, config)
+        elif mode == "bot":
+            self._send_bot_alerts(diff, config)
+        else:
+            logger.error(f"Invalid Slack mode '{mode}'. Valid modes are 'webhook' or 'bot'.")
             return
+
+    def _send_webhook_alerts(self, diff, config: CliConfig):
+        """Send alerts using webhook mode."""
         if not self.config.get("url"):
             logger.warning("Slack webhook URL not configured.")
             if config.enable_debug:
@@ -37,7 +47,7 @@ def send(self, diff, config: CliConfig):
             logger.warning("No valid Slack webhook URLs configured.")
             return
 
-        logger.debug("Slack Plugin Enabled")
+        logger.debug("Slack Plugin Enabled (webhook mode)")
         logger.debug("Alert levels: %s", self.config.get("levels"))
 
         # Get url_configs parameter (filtering configuration)
@@ -117,6 +127,214 @@ def send(self, diff, config: CliConfig):
                 elif config.enable_debug:
                     logger.debug(f"Slack webhook response for {name}: {response.status_code}")
 
+    def _send_bot_alerts(self, diff, config: CliConfig):
+        """Send alerts using bot mode with Slack API."""
+        # Get bot token from environment
+        bot_token = os.getenv("SOCKET_SLACK_BOT_TOKEN")
+        
+        if not bot_token:
+            logger.error("SOCKET_SLACK_BOT_TOKEN environment variable not set for bot mode.")
+            return
+        
+        if not bot_token.startswith("xoxb-"):
+            logger.error("SOCKET_SLACK_BOT_TOKEN must start with 'xoxb-' (Bot User OAuth Token).")
+            return
+        
+        # Get bot_configs from configuration
+        bot_configs = self.config.get("bot_configs", [])
+        
+        if not bot_configs:
+            logger.warning("No bot_configs configured for bot mode.")
+            return
+        
+        logger.debug("Slack Plugin Enabled (bot mode)")
+        logger.debug("Alert levels: %s", self.config.get("levels"))
+        logger.debug(f"Number of bot_configs: {len(bot_configs)}")
+        logger.debug(f"config.reach: {config.reach}")
+        logger.debug(f"len(diff.new_alerts): {len(diff.new_alerts) if diff.new_alerts else 0}")
+        
+        # Get repo name from config
+        repo_name = config.repo or ""
+        
+        # Handle reachability data if --reach is enabled
+        if config.reach:
+            self._send_bot_reachability_alerts(bot_configs, bot_token, repo_name, config, diff)
+        
+        # Handle diff alerts (if any)
+        if not diff.new_alerts:
+            logger.debug("No new diff alerts to notify via Slack.")
+        else:
+            # Send to each configured bot_config with filtering
+            for bot_config in bot_configs:
+                name = bot_config.get("name", "unnamed")
+                channels = bot_config.get("channels", [])
+                
+                if not channels:
+                    logger.warning(f"No channels configured for bot_config '{name}'. Skipping.")
+                    continue
+                
+                # Filter alerts based on bot config
+                # When --reach is used, reachability_alerts_only applies to diff alerts
+                filtered_alerts = self._filter_alerts(
+                    diff.new_alerts, 
+                    bot_config, 
+                    repo_name, 
+                    config,
+                    is_reachability_data=False,
+                    apply_reachability_only_filter=config.reach
+                )
+                
+                if not filtered_alerts:
+                    logger.debug(f"No diff alerts match filter criteria for bot_config '{name}'. Skipping.")
+                    continue
+                
+                # Create a temporary diff object with filtered alerts for message creation
+                filtered_diff = Diff(
+                    new_alerts=filtered_alerts,
+                    diff_url=getattr(diff, "diff_url", ""),
+                    new_packages=getattr(diff, "new_packages", []),
+                    removed_packages=getattr(diff, "removed_packages", []),
+                    packages=getattr(diff, "packages", {})
+                )
+                
+                message = self.create_slack_blocks_from_diff(filtered_diff, config)
+                
+                if config.enable_debug:
+                    logger.debug(f"Bot config '{name}': Total diff alerts: {len(diff.new_alerts)}, Filtered alerts: {len(filtered_alerts)}")
+                    logger.debug(f"Message blocks count: {len(message)}")
+                
+                # Send to each channel in the bot_config
+                for channel in channels:
+                    logger.debug(f"Sending diff alerts message to channel '{channel}' (bot_config: {name})")
+                    self._post_to_slack_api(bot_token, channel, message, config, name)
+
+    def _send_bot_reachability_alerts(self, bot_configs: list, bot_token: str, repo_name: str, config: CliConfig, diff=None):
+        """Send reachability alerts using bot mode with Slack API."""
+        # Construct path to socket facts file
+        facts_file_path = os.path.join(config.target_path or ".", f"{config.reach_output_file}")
+        logger.debug(f"Loading reachability data from {facts_file_path}")
+        
+        # Load socket facts file
+        facts_data = load_socket_facts(facts_file_path)
+        
+        if not facts_data:
+            logger.debug("No .socket.facts.json file found or failed to load")
+            return
+        
+        # Get components with vulnerabilities
+        components_with_vulns = get_components_with_vulnerabilities(facts_data)
+        
+        if not components_with_vulns:
+            logger.debug("No components with vulnerabilities found in .socket.facts.json")
+            return
+        
+        # Convert to alerts format
+        components_with_alerts = convert_to_alerts(components_with_vulns)
+        
+        if not components_with_alerts:
+            logger.debug("No alerts generated from .socket.facts.json")
+            return
+        
+        logger.debug(f"Found {len(components_with_alerts)} components with reachability alerts")
+        
+        # Send to each configured bot_config with filtering
+        for bot_config in bot_configs:
+            name = bot_config.get("name", "unnamed")
+            channels = bot_config.get("channels", [])
+            
+            if not channels:
+                logger.warning(f"No channels configured for bot_config '{name}'. Skipping.")
+                continue
+            
+            # Filter components based on severities only (for reachability data)
+            filtered_components = []
+            for component in components_with_alerts:
+                component_alerts = component.get('alerts', [])
+                # Filter alerts using only severities
+                filtered_component_alerts = self._filter_alerts(
+                    component_alerts,
+                    bot_config,
+                    repo_name,
+                    config,
+                    is_reachability_data=True
+                )
+                
+                if filtered_component_alerts:
+                    # Create a copy of component with only filtered alerts
+                    filtered_component = component.copy()
+                    filtered_component['alerts'] = filtered_component_alerts
+                    filtered_components.append(filtered_component)
+            
+            if not filtered_components:
+                logger.debug(f"No reachability alerts match filter criteria for bot_config '{name}'. Skipping.")
+                continue
+            
+            # Format for Slack using the formatter (max 45 blocks for findings + 5 for header/footer)
+            slack_notifications = format_socket_facts_for_slack(
+                filtered_components,
+                max_blocks=45,
+                include_traces=True
+            )
+            
+            # Convert to Slack blocks format and send
+            for notification in slack_notifications:
+                blocks = self._create_reachability_slack_blocks_from_structured(
+                    notification,
+                    config,
+                    diff
+                )
+                
+                if config.enable_debug:
+                    logger.debug(f"Bot config '{name}': Reachability components: {len(filtered_components)}")
+                    logger.debug(f"Message blocks count: {len(blocks)}")
+                
+                # Send to each channel in the bot_config
+                for channel in channels:
+                    logger.debug(f"Sending reachability alerts message to channel '{channel}' (bot_config: {name})")
+                    self._post_to_slack_api(bot_token, channel, blocks, config, name)
+
+    def _post_to_slack_api(self, bot_token: str, channel: str, blocks: list, config: CliConfig, config_name: str = None):
+        """Post message to Slack using chat.postMessage API.
+        
+        Args:
+            bot_token: Slack bot token (starts with xoxb-)
+            channel: Channel name (without #) or channel ID (C1234567890)
+            blocks: List of Slack blocks to send
+            config: CliConfig object for debug logging
+            config_name: Name of the bot_config for logging
+        
+        Returns:
+            Response dict from Slack API
+        """
+        url = "https://slack.com/api/chat.postMessage"
+        headers = {
+            "Authorization": f"Bearer {bot_token}",
+            "Content-Type": "application/json"
+        }
+        payload = {
+            "channel": channel,
+            "blocks": blocks
+        }
+        
+        try:
+            response = requests.post(url, headers=headers, json=payload)
+            response_data = response.json()
+            
+            # Slack returns 200 even on errors, check response JSON
+            if not response_data.get("ok", False):
+                error_msg = response_data.get("error", "unknown error")
+                logger.error(f"Slack API error for channel '{channel}': {error_msg}")
+                if config.enable_debug:
+                    logger.debug(f"Full response: {response_data}")
+            elif config.enable_debug:
+                logger.debug(f"Successfully posted to channel '{channel}' (config: {config_name})")
+            
+            return response_data
+            
+        except Exception as e:
+            logger.error(f"Exception posting to Slack channel '{channel}': {str(e)}")
+            return {"ok": False, "error": str(e)}
+
     def _filter_alerts(
         self, 
         alerts: list, 
@@ -210,10 +428,13 @@ def _send_reachability_alerts(self, valid_webhooks: list, webhook_configs: dict,
             config: CliConfig object
             diff: Diff object containing diff_url for report link
         """
-        logger.debug("Loading reachability data from .socket.facts.json")
+        # Construct path to socket facts file
+        import os as os_module
+        facts_file_path = os_module.path.join(config.target_path or ".", config.reach_output_file)
+        logger.debug(f"Loading reachability data from {facts_file_path}")
         
         # Load socket facts file
-        facts_data = load_socket_facts(".socket.facts.json")
+        facts_data = load_socket_facts(facts_file_path)
         
         if not facts_data:
             logger.debug("No .socket.facts.json file found or failed to load")
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 332d3e4..3045a17 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -591,6 +591,7 @@ def main_code():
             )
             log.info(f"Full scan created with ID: {diff.id}")
             log.info(f"Full scan report URL: {diff.report_url}")
+            output_handler.handle_output(diff)
         else:
             log.info("API Mode")
             diff = core.create_new_diff(

From d0886a5639cf0090d1b96ce313115584cb8b82a1 Mon Sep 17 00:00:00 2001
From: Douglas <douglas@socket.dev>
Date: Mon, 5 Jan 2026 14:36:33 -0800
Subject: [PATCH 13/80] Incremented to newer SDK support for fix for PR Number
 (#146)

---
 pyproject.toml             |  4 ++--
 socketsecurity/__init__.py |  2 +-
 uv.lock                    | 10 +++++-----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 47c55cf..280708f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.62"
+version = "2.2.63"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.25,<4.0.0",
+    "socketdev>=3.0.28,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 13f0729..52754b7 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.62'
+__version__ = '2.2.63'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index c387cb9..f2b7477 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1250,20 +1250,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.25"
+version = "3.0.28"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/88/49/207860555b4a78d621d5f45db2255754010862292aa09c212893dc3161ab/socketdev-3.0.25.tar.gz", hash = "sha256:422d06ae6ba50ed1fb07b6ede3b20bfc9fbbeae144d03aeed3fdbd8190966a9a", size = 168706, upload-time = "2026-01-01T21:58:40.829Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f8/db/3446da069f8f2e0235970fa3e1cbcc2cf9a2da9ab75bd965f00e7ab3c7ab/socketdev-3.0.28.tar.gz", hash = "sha256:60f8635502fa291a9bf4fb0f2a13c8dfeb1d3dc2dc395ec5265a1e2f4147cf52", size = 170539, upload-time = "2026-01-05T22:24:53.637Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cf/1f/49ca3bfa137921899f050b030af072b5679dba3f72f0162cacd5910a8a79/socketdev-3.0.25-py3-none-any.whl", hash = "sha256:a23f76f1536a6c7473c54608e57e33735d01cd287d8f2ae75a5378f2ddedf7e5", size = 65711, upload-time = "2026-01-01T21:58:39Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/72/4bbd4a70e5fa317f4e33a134f5871793eeaba45e05b949685f3502e451b4/socketdev-3.0.28-py3-none-any.whl", hash = "sha256:61a9e09ab24180e7b033ad1e141110b90f1f714336b04f21c20035b901311229", size = 66681, upload-time = "2026-01-05T22:24:51.736Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.59"
+version = "2.2.62"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.25,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.28,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 0f0127ac665484e39bdfc8471b1f185ebea1716f Mon Sep 17 00:00:00 2001
From: Oskar Haarklou Veileborg <ohv1020@hotmail.com>
Date: Fri, 16 Jan 2026 04:22:57 +0100
Subject: [PATCH 14/80] feat: add PyPy installation for Alpine on x86_64 (#148)

* feat: add PyPy installation for Alpine on x86_64

Install Alpine-compatible PyPy3.11 build on amd64 platforms to enable
faster Python reachability analysis.

* Fix versions & changelog

* Bump version to 2.2.65

---------

Co-authored-by: Douglas Coburn <douglas@dactbc.com>
---
 CHANGELOG.md               |  4 ++++
 Dockerfile                 | 18 +++++++++++++++++-
 pyproject.toml             |  2 +-
 socketsecurity/__init__.py |  2 +-
 uv.lock                    |  2 +-
 5 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 604c602..62aaae7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.64
+
+- Included PyPy in the Docker image.
+
 ## 2.2.57
 
 - Fixed Dockerfile to set `GOROOT` to `/usr/lib/go` when using system Go (`GO_VERSION=system`) instead of always using `/usr/local/go`.
diff --git a/Dockerfile b/Dockerfile
index c4d483a..7f18272 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -58,6 +58,22 @@ RUN if [ "$DOTNET_VERSION" = "6" ]; then \
         echo "Unsupported .NET version: $DOTNET_VERSION. Supported: 6, 8" && exit 1; \
     fi
 
+# Install PyPy (Alpine-compatible build for x86_64 only)
+# PyPy is an alternative Python interpreter that makes the Python reachability analysis faster.
+# This is a custom build of PyPy3.11 for Alpine on x86-64.
+ARG TARGETARCH  # Passed by Docker buildx
+RUN if [ "$TARGETARCH" = "amd64" ]; then \
+        PYPY_URL="https://github.com/BarrensZeppelin/alpine-pypy/releases/download/alp3.23.1-pypy3.11-7.3.20/pypy3.11-v7.3.20-linux64-alpine3.21.tar.bz2" && \
+        PYPY_SHA256="60847fea6ffe96f10a3cd4b703686e944bb4fbcc01b7200c044088dd228425e1" && \
+        curl -L -o /tmp/pypy.tar.bz2 "$PYPY_URL" && \
+        echo "$PYPY_SHA256  /tmp/pypy.tar.bz2" | sha256sum -c - && \
+        mkdir -p /opt/pypy && \
+        tar -xj --strip-components=1 -C /opt/pypy -f /tmp/pypy.tar.bz2 && \
+        rm /tmp/pypy.tar.bz2 && \
+        ln -s /opt/pypy/bin/pypy3 /bin/pypy3 && \
+        pypy3 --version; \
+    fi
+
 # Install additional tools
 RUN npm install @coana-tech/cli socket -g && \
     gem install bundler && \
@@ -104,4 +120,4 @@ RUN mkdir -p /go/src && chmod -R 777 /go
 COPY scripts/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
\ No newline at end of file
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
diff --git a/pyproject.toml b/pyproject.toml
index 280708f..0ad67b9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.63"
+version = "2.2.65"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 52754b7..97ca4ed 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.63'
+__version__ = '2.2.65'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index f2b7477..90efc43 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1263,7 +1263,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.62"
+version = "2.2.64"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 54e6ec7093435e0b558e594bac7b2f917f77e979 Mon Sep 17 00:00:00 2001
From: jonathanStrange0 <44637027+jonathanStrange0@users.noreply.github.com>
Date: Fri, 16 Jan 2026 14:03:23 -0500
Subject: [PATCH 15/80] Mucha dev fail on any block (#149)

* feat: add --strict-blocking flag to fail on any existing security violations

Introduces a new --strict-blocking flag that causes builds to fail on ANY
security policy violations with blocking severity, not just new ones. This
enables enforcement of a zero-tolerance policy on security issues.

Key features:
- Works in diff mode only (logs warning in API mode)
- Only fails on error-level alerts (not warnings)
- --disable-blocking takes precedence when both flags are set
- Enhanced console output distinguishes NEW vs EXISTING violations
- Comprehensive test coverage for all scenarios

Implementation details:
- Added unchanged_alerts and removed_alerts fields to Diff class
- Created get_unchanged_alerts() method to extract alerts from unchanged packages
- Updated report_pass() to check both new and unchanged alerts when enabled
- Added validation warnings for conflicting flags and API mode limitations

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* chore: update uv.lock with version 2.2.63

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs: add --strict-blocking flag documentation to README

Added comprehensive documentation for the new --strict-blocking feature:

- Added flag to Advanced Configuration parameters table
- Created dedicated "Strict Blocking Mode" section with:
  - Behavior comparison (standard vs strict)
  - Usage examples for different CI/CD platforms
  - Output examples showing NEW vs EXISTING violations
  - Common use cases and implementation strategies
  - Important notes about limitations and flag priority
  - Flag combination examples
  - Migration strategy guidance
  - Links to GitLab CI example files

The documentation clearly explains:
- Zero-tolerance security policy enforcement
- Diff mode requirement
- Error-level filtering (not warnings)
- --disable-blocking precedence
- First scan behavior

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* chore: bump version to 2.3.1 for --strict-blocking feature

Bumped version from 2.2.63 to 2.3.1 following semantic versioning
(minor version bump for new feature).

This version number avoids conflict with the mucha-dev-gitlab-security-output
branch which uses 2.3.0 for the GitLab Security Dashboard feature.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* version sync

* Bumping version

---------

Co-authored-by: Jonathan Mucha <jonathan@mucha.local>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Douglas Coburn <douglas@dactbc.com>
---
 README.md                       |  94 ++++++++++++++++++++++++++++
 pyproject.toml                  |   2 +-
 socketsecurity/__init__.py      |   2 +-
 socketsecurity/config.py        |   8 +++
 socketsecurity/core/__init__.py |  94 +++++++++++++++++++++++++++-
 socketsecurity/core/classes.py  |   8 +++
 socketsecurity/output.py        |  53 ++++++++++++++--
 socketsecurity/socketcli.py     |  17 +++--
 tests/core/test_diff_alerts.py  |  79 +++++++++++++++++++++++
 tests/unit/test_cli_config.py   |  22 ++++++-
 tests/unit/test_output.py       | 107 +++++++++++++++++++++++++++++++-
 uv.lock                         |   2 +-
 12 files changed, 474 insertions(+), 14 deletions(-)
 create mode 100644 tests/core/test_diff_alerts.py

diff --git a/README.md b/README.md
index f0d3c27..575e744 100644
--- a/README.md
+++ b/README.md
@@ -193,6 +193,7 @@ The CLI will automatically install @coana-tech/cli if not present. Use `--reach`
 |:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
 | --ignore-commit-files    | False    | False   | Ignore commit files                                                   |
 | --disable-blocking       | False    | False   | Disable blocking mode                                                 |
+| --strict-blocking        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
 | --enable-diff            | False    | False   | Enable diff mode even when using --integration api (forces diff mode without SCM integration) |
 | --scm                    | False    | api     | Source control management type                                        |
 | --timeout                | False    |         | Timeout in seconds for API requests                                   |
@@ -328,6 +329,99 @@ Bot mode (`bot_configs` array items):
 - `alert_types` (array, optional): Only send specific alert types
 - `reachability_alerts_only` (boolean, default: false): Only send reachable vulnerabilities when using `--reach`
 
+## Strict Blocking Mode
+
+The `--strict-blocking` flag enforces a zero-tolerance security policy by failing builds when **ANY** security violations with blocking severity exist, not just new ones introduced in the current changes.
+
+### Standard vs Strict Blocking Behavior
+
+**Standard Behavior (Default)**:
+- ✅ Passes if no NEW violations are introduced
+- ❌ Fails only on NEW violations from your changes
+- 🟡 Existing violations are ignored
+
+**Strict Blocking Behavior (`--strict-blocking`)**:
+- ✅ Passes only if NO violations exist (new or existing)
+- ❌ Fails on ANY violation (new OR existing)
+- 🔴 Enforces zero-tolerance policy
+
+### Usage Examples
+
+**Basic strict blocking:**
+```bash
+socketcli --target-path ./my-project --strict-blocking
+```
+
+**In GitLab CI:**
+```bash
+socketcli --target-path $CI_PROJECT_DIR --scm gitlab --pr-number ${CI_MERGE_REQUEST_IID:-0} --strict-blocking
+```
+
+**In GitHub Actions:**
+```bash
+socketcli --target-path $GITHUB_WORKSPACE --scm github --pr-number $PR_NUMBER --strict-blocking
+```
+
+### Output Differences
+
+**Standard scan output:**
+```
+Security issues detected by Socket Security:
+  - NEW blocking issues: 2
+  - NEW warning issues: 1
+```
+
+**Strict blocking scan output:**
+```
+Security issues detected by Socket Security:
+  - NEW blocking issues: 2
+  - NEW warning issues: 1
+  - EXISTING blocking issues: 5 (causing failure due to --strict-blocking)
+  - EXISTING warning issues: 3
+```
+
+### Use Cases
+
+1. **Zero-Tolerance Security Policy**: Enforce that no security violations exist in your codebase at any time
+2. **Gradual Security Improvement**: Use alongside standard scans to monitor existing violations while blocking new ones
+3. **Protected Branch Enforcement**: Require all violations to be resolved before merging to main/production
+4. **Security Audits**: Scheduled scans that fail if any violations accumulate
+
+### Important Notes
+
+- **Diff Mode Only**: The flag only works in diff mode (with SCM integration). In API mode, a warning is logged.
+- **Error-Level Only**: Only fails on `error=True` alerts (blocking severity), not warnings.
+- **Priority**: `--disable-blocking` takes precedence - if both flags are set, the build will always pass.
+- **First Scan**: On the very first scan of a repository, there are no "existing" violations, so behavior is identical to standard mode.
+
+### Flag Combinations
+
+**Strict blocking with debugging:**
+```bash
+socketcli --strict-blocking --enable-debug
+```
+
+**Strict blocking with JSON output:**
+```bash
+socketcli --strict-blocking --enable-json > security-report.json
+```
+
+**Override for testing** (passes even with violations):
+```bash
+socketcli --strict-blocking --disable-blocking
+```
+
+### Migration Strategy
+
+**Phase 1: Assessment** - Add strict scan with `allow_failure: true` in CI
+**Phase 2: Remediation** - Fix or triage all violations
+**Phase 3: Enforcement** - Set `allow_failure: false` to block merges
+
+For complete GitLab CI/CD examples, see:
+- [`.gitlab-ci-strict-blocking-demo.yml`](.gitlab-ci-strict-blocking-demo.yml) - Comprehensive demo
+- [`.gitlab-ci-strict-blocking-production.yml`](.gitlab-ci-strict-blocking-production.yml) - Production-ready template
+- [`STRICT-BLOCKING-GITLAB-CI.md`](STRICT-BLOCKING-GITLAB-CI.md) - Full documentation
+
 ## Automatic Git Detection
 
 The CLI now automatically detects repository information from your git environment, significantly simplifying usage in CI/CD pipelines:
diff --git a/pyproject.toml b/pyproject.toml
index 0ad67b9..e524c2e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.65"
+version = "2.2.66"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 97ca4ed..eab582e 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.65'
+__version__ = '2.2.66'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index b32a3d2..602d741 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -45,6 +45,7 @@ class CliConfig:
     files: str = None
     ignore_commit_files: bool = False
     disable_blocking: bool = False
+    strict_blocking: bool = False
     integration_type: IntegrationType = "api"
     integration_org_slug: Optional[str] = None
     pending_head: bool = False
@@ -123,6 +124,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'files': args.files,
             'ignore_commit_files': args.ignore_commit_files,
             'disable_blocking': args.disable_blocking,
+            'strict_blocking': args.strict_blocking,
             'integration_type': args.integration,
             'pending_head': args.pending_head,
             'timeout': args.timeout,
@@ -523,6 +525,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=argparse.SUPPRESS
     )
+    advanced_group.add_argument(
+        "--strict-blocking",
+        dest="strict_blocking",
+        action="store_true",
+        help="Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode."
+    )
     advanced_group.add_argument(
         "--enable-diff",
         dest="enable_diff",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index fa227b6..9bf6ac0 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1091,7 +1091,13 @@ def create_new_diff(
             packages
         ) = self.get_added_and_removed_packages(head_full_scan_id, new_full_scan.id)
 
-        diff = self.create_diff_report(added_packages, removed_packages)
+        # Separate unchanged packages from added/removed for --strict-blocking support
+        unchanged_packages = {
+            pkg_id: pkg for pkg_id, pkg in packages.items()
+            if pkg_id not in added_packages and pkg_id not in removed_packages
+        }
+
+        diff = self.create_diff_report(added_packages, removed_packages, unchanged_packages)
         diff.packages = packages
 
         base_socket = "https://socket.dev/dashboard/org"
@@ -1114,6 +1120,7 @@ def create_diff_report(
         self,
         added_packages: Dict[str, Package],
         removed_packages: Dict[str, Package],
+        unchanged_packages: Optional[Dict[str, Package]] = None,
         direct_only: bool = True
     ) -> Diff:
         """
@@ -1123,10 +1130,12 @@ def create_diff_report(
         1. Records new/removed packages (direct only by default)
         2. Collects alerts from both sets of packages
         3. Determines new capabilities introduced
+        4. Optionally collects alerts from unchanged packages for --strict-blocking
 
         Args:
             added_packages: Dict of packages added in new scan
             removed_packages: Dict of packages removed in new scan
+            unchanged_packages: Dict of packages that didn't change (for --strict-blocking)
             direct_only: If True, only direct dependencies are included in new/removed lists
                         (but alerts are still processed for all packages)
 
@@ -1137,6 +1146,7 @@ def create_diff_report(
 
         alerts_in_added_packages: Dict[str, List[Issue]] = {}
         alerts_in_removed_packages: Dict[str, List[Issue]] = {}
+        alerts_in_unchanged_packages: Dict[str, List[Issue]] = {}
 
         seen_new_packages = set()
         seen_removed_packages = set()
@@ -1169,11 +1179,34 @@ def create_diff_report(
                 packages=removed_packages
             )
 
+        # Process unchanged packages for --strict-blocking support
+        if unchanged_packages:
+            for package_id, package in unchanged_packages.items():
+                # Skip packages that are in added or removed (they're already processed)
+                if package_id in added_packages or package_id in removed_packages:
+                    continue
+
+                self.add_package_alerts_to_collection(
+                    package=package,
+                    alerts_collection=alerts_in_unchanged_packages,
+                    packages=unchanged_packages
+                )
+
         diff.new_alerts = Core.get_new_alerts(
             alerts_in_added_packages,
             alerts_in_removed_packages
         )
 
+        # Get unchanged alerts (for --strict-blocking mode)
+        diff.unchanged_alerts = Core.get_unchanged_alerts(
+            alerts_in_unchanged_packages
+        )
+
+        # Get removed alerts (for completeness)
+        diff.removed_alerts = Core.get_removed_alerts(
+            alerts_in_removed_packages
+        )
+
         diff.new_capabilities = Core.get_capabilities_for_added_packages(added_packages)
 
         Core.add_purl_capabilities(diff)
@@ -1433,3 +1466,62 @@ def get_new_alerts(
                             consolidated_alerts.add(alert_str)
 
         return alerts
+
+    @staticmethod
+    def get_unchanged_alerts(
+        unchanged_package_alerts: Dict[str, List[Issue]]
+    ) -> List[Issue]:
+        """
+        Extract all alerts from unchanged packages that are errors or warnings.
+
+        This is used for --strict-blocking mode to identify existing violations
+        that should cause builds to fail.
+
+        Args:
+            unchanged_package_alerts: Dictionary of alerts from packages that didn't change
+
+        Returns:
+            List of all error/warning alerts from unchanged packages
+        """
+        alerts: List[Issue] = []
+        consolidated_alerts = set()
+
+        for alert_key in unchanged_package_alerts:
+            for alert in unchanged_package_alerts[alert_key]:
+                # Consolidate by package and alert type
+                alert_str = f"{alert.purl},{alert.type}"
+
+                # Only include error or warning alerts
+                if (alert.error or alert.warn) and alert_str not in consolidated_alerts:
+                    alerts.append(alert)
+                    consolidated_alerts.add(alert_str)
+
+        return alerts
+
+    @staticmethod
+    def get_removed_alerts(
+        removed_package_alerts: Dict[str, List[Issue]]
+    ) -> List[Issue]:
+        """
+        Extract all alerts from removed packages.
+
+        This is mainly for informational purposes - to show alerts that were removed.
+
+        Args:
+            removed_package_alerts: Dictionary of alerts from packages that were removed
+
+        Returns:
+            List of all alerts from removed packages
+        """
+        alerts: List[Issue] = []
+        consolidated_alerts = set()
+
+        for alert_key in removed_package_alerts:
+            for alert in removed_package_alerts[alert_key]:
+                alert_str = f"{alert.purl},{alert.type}"
+
+                if alert_str not in consolidated_alerts:
+                    alerts.append(alert)
+                    consolidated_alerts.add(alert_str)
+
+        return alerts
diff --git a/socketsecurity/core/classes.py b/socketsecurity/core/classes.py
index e81312c..506c107 100644
--- a/socketsecurity/core/classes.py
+++ b/socketsecurity/core/classes.py
@@ -474,6 +474,8 @@ class Diff:
     packages: dict[str, Package]
     new_capabilities: Dict[str, List[str]]
     new_alerts: list[Issue]
+    unchanged_alerts: list[Issue]
+    removed_alerts: list[Issue]
     id: str
     sbom: str
     report_url: str
@@ -490,6 +492,10 @@ def __init__(self, **kwargs):
             self.removed_packages = []
         if not hasattr(self, "new_alerts"):
             self.new_alerts = []
+        if not hasattr(self, "unchanged_alerts"):
+            self.unchanged_alerts = []
+        if not hasattr(self, "removed_alerts"):
+            self.removed_alerts = []
         if not hasattr(self, "new_capabilities"):
             self.new_capabilities = {}
 
@@ -508,6 +514,8 @@ def to_dict(self) -> dict:
             "new_capabilities": self.new_capabilities,
             "removed_packages": [p.to_dict() for p in self.removed_packages],
             "new_alerts": [alert.__dict__ for alert in self.new_alerts],
+            "unchanged_alerts": [alert.__dict__ for alert in self.unchanged_alerts] if hasattr(self, "unchanged_alerts") else [],
+            "removed_alerts": [alert.__dict__ for alert in self.removed_alerts] if hasattr(self, "removed_alerts") else [],
             "id": self.id,
             "sbom": self.sbom if hasattr(self, "sbom") else [],
             "packages": {k: v.to_dict() for k, v in self.packages.items()} if hasattr(self, "packages") else {},
diff --git a/socketsecurity/output.py b/socketsecurity/output.py
index 2948bb2..65004c1 100644
--- a/socketsecurity/output.py
+++ b/socketsecurity/output.py
@@ -77,12 +77,40 @@ def return_exit_code(self, diff_report: Diff) -> int:
 
     def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Outputs formatted console comments"""
-        if len(diff_report.new_alerts) == 0:
+        has_new_alerts = len(diff_report.new_alerts) > 0
+        has_unchanged_alerts = (
+            self.config.strict_blocking and
+            hasattr(diff_report, 'unchanged_alerts') and
+            len(diff_report.unchanged_alerts) > 0
+        )
+
+        if not has_new_alerts and not has_unchanged_alerts:
             self.logger.info("No issues found")
             return
 
+        # Count blocking vs warning alerts
+        new_blocking = sum(1 for issue in diff_report.new_alerts if issue.error)
+        new_warning = sum(1 for issue in diff_report.new_alerts if issue.warn)
+
+        unchanged_blocking = 0
+        unchanged_warning = 0
+        if has_unchanged_alerts:
+            unchanged_blocking = sum(1 for issue in diff_report.unchanged_alerts if issue.error)
+            unchanged_warning = sum(1 for issue in diff_report.unchanged_alerts if issue.warn)
+
         console_security_comment = Messages.create_console_security_alert_table(diff_report)
+
+        # Build status message
         self.logger.info("Security issues detected by Socket Security:")
+        if new_blocking > 0:
+            self.logger.info(f"  - NEW blocking issues: {new_blocking}")
+        if new_warning > 0:
+            self.logger.info(f"  - NEW warning issues: {new_warning}")
+        if unchanged_blocking > 0:
+            self.logger.info(f"  - EXISTING blocking issues: {unchanged_blocking} (causing failure due to --strict-blocking)")
+        if unchanged_warning > 0:
+            self.logger.info(f"  - EXISTING warning issues: {unchanged_warning}")
+
         self.logger.info(f"Diff Url: {diff_report.diff_url}")
         self.logger.info(f"\n{console_security_comment}")
 
@@ -105,13 +133,30 @@ def output_console_sarif(self, diff_report: Diff, sbom_file_name: Optional[str]
 
     def report_pass(self, diff_report: Diff) -> bool:
         """Determines if the report passes security checks"""
-        if not diff_report.new_alerts:
+        # Priority 1: --disable-blocking always passes
+        if self.config.disable_blocking:
             return True
 
-        if self.config.disable_blocking:
+        # Check new alerts for blocking issues
+        has_new_blocking_alerts = any(issue.error for issue in diff_report.new_alerts)
+
+        # Check unchanged alerts if --strict-blocking is enabled
+        has_unchanged_blocking_alerts = False
+        if self.config.strict_blocking and hasattr(diff_report, 'unchanged_alerts'):
+            has_unchanged_blocking_alerts = any(
+                issue.error for issue in diff_report.unchanged_alerts
+            )
+
+        # If no alerts at all, pass
+        if not diff_report.new_alerts and not (
+            self.config.strict_blocking and
+            hasattr(diff_report, 'unchanged_alerts') and
+            diff_report.unchanged_alerts
+        ):
             return True
 
-        return not any(issue.error for issue in diff_report.new_alerts)
+        # Fail if there are any blocking alerts (new or unchanged with --strict-blocking)
+        return not (has_new_blocking_alerts or has_unchanged_blocking_alerts)
 
     def save_sbom_file(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Saves SBOM file if filename is provided"""
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 3045a17..a92b34b 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -49,7 +49,12 @@ def main_code():
     config = CliConfig.from_args()
     log.info(f"Starting Socket Security CLI version {config.version}")
     log.debug(f"config: {config.to_dict()}")
-    
+
+    # Warn if strict-blocking is used with disable-blocking
+    if config.strict_blocking and config.disable_blocking:
+        log.warning("Both --strict-blocking and --disable-blocking specified. "
+                   "--disable-blocking takes precedence and will always return exit code 0.")
+
     # Validate API token
     if not config.api_token:
         log.info("Socket API Token not found. Please set it using either:\n"
@@ -625,9 +630,13 @@ def main_code():
         core.save_file(config.license_file_name, json.dumps(all_packages))
 
     # If we forced API mode due to no supported files, behave as if --disable-blocking was set
-    if force_api_mode and not config.disable_blocking:
-        log.debug("Temporarily enabling disable_blocking due to no supported manifest files")
-        config.disable_blocking = True
+    if force_api_mode:
+        if config.strict_blocking:
+            log.warning("--strict-blocking is only supported in diff mode. "
+                       "API mode (no diff) cannot evaluate existing violations.")
+        if not config.disable_blocking:
+            log.debug("Temporarily enabling disable_blocking due to no supported manifest files")
+            config.disable_blocking = True
 
     sys.exit(output_handler.return_exit_code(diff))
 
diff --git a/tests/core/test_diff_alerts.py b/tests/core/test_diff_alerts.py
new file mode 100644
index 0000000..5455e3c
--- /dev/null
+++ b/tests/core/test_diff_alerts.py
@@ -0,0 +1,79 @@
+import pytest
+from socketsecurity.core import Core
+from socketsecurity.core.classes import Issue
+
+
+class TestDiffAlerts:
+    """Test alert collection for diff reports"""
+
+    def test_get_unchanged_alerts_filters_errors(self):
+        """Test that get_unchanged_alerts only returns error/warn alerts"""
+        alerts_dict = {
+            'alert1': [
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious'),
+                Issue(error=False, warn=False, purl='npm/pkg1', type='info', monitor=True)
+            ],
+            'alert2': [
+                Issue(error=False, warn=True, purl='npm/pkg2', type='typosquat')
+            ]
+        }
+
+        result = Core.get_unchanged_alerts(alerts_dict)
+
+        # Should only include error=True and warn=True alerts
+        assert len(result) == 2
+        assert any(alert.error for alert in result)
+        assert any(alert.warn for alert in result)
+        assert not any(alert.monitor and not (alert.error or alert.warn) for alert in result)
+
+    def test_get_unchanged_alerts_deduplicates(self):
+        """Test that get_unchanged_alerts deduplicates by purl+type"""
+        alerts_dict = {
+            'alert1': [
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious'),
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious')  # Duplicate
+            ]
+        }
+
+        result = Core.get_unchanged_alerts(alerts_dict)
+
+        # Should deduplicate
+        assert len(result) == 1
+
+    def test_get_unchanged_alerts_empty(self):
+        """Test that get_unchanged_alerts handles empty input"""
+        result = Core.get_unchanged_alerts({})
+        assert len(result) == 0
+
+    def test_get_removed_alerts_all_alerts(self):
+        """Test that get_removed_alerts returns all alerts from removed packages"""
+        alerts_dict = {
+            'alert1': [
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious'),
+                Issue(error=False, warn=True, purl='npm/pkg1', type='typosquat')
+            ]
+        }
+
+        result = Core.get_removed_alerts(alerts_dict)
+
+        # Should include all alerts, not just error/warn
+        assert len(result) == 2
+
+    def test_get_removed_alerts_deduplicates(self):
+        """Test that get_removed_alerts deduplicates by purl+type"""
+        alerts_dict = {
+            'alert1': [
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious'),
+                Issue(error=True, warn=False, purl='npm/pkg1', type='malicious')  # Duplicate
+            ]
+        }
+
+        result = Core.get_removed_alerts(alerts_dict)
+
+        # Should deduplicate
+        assert len(result) == 1
+
+    def test_get_removed_alerts_empty(self):
+        """Test that get_removed_alerts handles empty input"""
+        result = Core.get_removed_alerts({})
+        assert len(result) == 0
diff --git a/tests/unit/test_cli_config.py b/tests/unit/test_cli_config.py
index 40178d3..b72ed9b 100644
--- a/tests/unit/test_cli_config.py
+++ b/tests/unit/test_cli_config.py
@@ -40,4 +40,24 @@ def test_enable_diff_with_integration_api(self):
         """Test that enable_diff can be used with integration api"""
         config = CliConfig.from_args(["--api-token", "test", "--integration", "api", "--enable-diff"])
         assert config.enable_diff is True
-        assert config.integration_type == "api"
\ No newline at end of file
+        assert config.integration_type == "api"
+
+    def test_strict_blocking_flag(self):
+        """Test that --strict-blocking flag is parsed correctly"""
+        config = CliConfig.from_args(["--api-token", "test", "--strict-blocking"])
+        assert config.strict_blocking is True
+
+    def test_strict_blocking_default_false(self):
+        """Test that strict_blocking defaults to False"""
+        config = CliConfig.from_args(["--api-token", "test"])
+        assert config.strict_blocking is False
+
+    def test_strict_blocking_with_disable_blocking(self):
+        """Test that both flags can be set (disable-blocking should win)"""
+        config = CliConfig.from_args([
+            "--api-token", "test",
+            "--strict-blocking",
+            "--disable-blocking"
+        ])
+        assert config.strict_blocking is True
+        assert config.disable_blocking is True
\ No newline at end of file
diff --git a/tests/unit/test_output.py b/tests/unit/test_output.py
index 35a0c4f..458714c 100644
--- a/tests/unit/test_output.py
+++ b/tests/unit/test_output.py
@@ -51,4 +51,109 @@ def test_sbom_file_saving(self, handler, tmp_path):
         diff.sbom = {"test": "data"}
         sbom_path = tmp_path / "test.json"
         handler.save_sbom_file(diff, str(sbom_path))
-        assert sbom_path.exists()
\ No newline at end of file
+        assert sbom_path.exists()
+
+    def test_report_pass_with_strict_blocking_new_alerts(self):
+        """Test that strict-blocking fails on new blocking alerts"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        # Create config with strict_blocking
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = True
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = [Issue(error=True, warn=False)]
+        diff.unchanged_alerts = []
+
+        assert not handler.report_pass(diff)
+
+    def test_report_pass_with_strict_blocking_unchanged_alerts(self):
+        """Test that strict-blocking fails on unchanged blocking alerts"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = True
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = []
+        diff.unchanged_alerts = [Issue(error=True, warn=False)]
+
+        assert not handler.report_pass(diff)
+
+    def test_report_pass_with_strict_blocking_both_alerts(self):
+        """Test that strict-blocking fails when both new and unchanged alerts exist"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = True
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = [Issue(error=True, warn=False)]
+        diff.unchanged_alerts = [Issue(error=True, warn=False)]
+
+        assert not handler.report_pass(diff)
+
+    def test_report_pass_with_strict_blocking_only_warnings(self):
+        """Test that strict-blocking passes when only warnings (not errors) exist"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = True
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = [Issue(error=False, warn=True)]
+        diff.unchanged_alerts = [Issue(error=False, warn=True)]
+
+        assert handler.report_pass(diff)
+
+    def test_report_pass_strict_blocking_disabled(self):
+        """Test that strict-blocking without the flag passes with unchanged alerts"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = False  # Flag not set
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = []
+        diff.unchanged_alerts = [Issue(error=True, warn=False)]
+
+        # Should pass because strict_blocking is False
+        assert handler.report_pass(diff)
+
+    def test_disable_blocking_overrides_strict_blocking(self):
+        """Test that disable-blocking takes precedence over strict-blocking"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = True
+        config.strict_blocking = True
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.new_alerts = [Issue(error=True, warn=False)]
+        diff.unchanged_alerts = [Issue(error=True, warn=False)]
+
+        # Should pass because disable_blocking takes precedence
+        assert handler.report_pass(diff)
\ No newline at end of file
diff --git a/uv.lock b/uv.lock
index 90efc43..3101764 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1263,7 +1263,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.64"
+version = "2.2.65"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 3defe2ee1695f5a3a57c555aa065d1040765a601 Mon Sep 17 00:00:00 2001
From: jonathanStrange0 <44637027+jonathanStrange0@users.noreply.github.com>
Date: Fri, 16 Jan 2026 15:54:54 -0500
Subject: [PATCH 16/80] Mucha dev gitlab security output (#147)

* feat: add GitLab Security Dashboard integration with Dependency Scanning report output

Adds support for generating GitLab-compatible Dependency Scanning reports that integrate with GitLab's Security Dashboard. This feature enables Socket security findings to be displayed natively in GitLab merge requests and security dashboards.

Key Features:
- New --enable-gitlab-security flag to generate GitLab reports
- New --gitlab-security-file flag for custom output paths (default: gl-dependency-scanning-report.json)
- Generates GitLab Dependency Scanning schema v15.0.0 compliant reports
- Supports multiple simultaneous output formats (JSON, SARIF, GitLab)
- Includes actionable security alerts (error/warn level) in vulnerability reports
- Maps Socket severity levels to GitLab severity (Critical, High, Medium, Low)
- Extracts CVE identifiers and dependency chain information
- Generates deterministic UUIDs for vulnerability tracking

Implementation:
- Added GitLab report generator in messages.py with helper functions for severity mapping, identifier extraction, and location parsing
- Refactored OutputHandler to support multiple simultaneous output formats
- Added comprehensive unit tests (test_gitlab_format.py) and integration tests
- Updated documentation with usage examples, CI/CD integration guide, and alert filtering details

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* capturing all recent changes

* chore: bump version to 2.3.0 for GitLab Security Dashboard feature

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* bumping version

* Removing unneeded files

---------

Co-authored-by: Jonathan Mucha <jonathan@mucha.local>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-authored-by: Douglas Coburn <douglas@dactbc.com>
---
 README.md                        | 172 +++++++++++++-
 pyproject.toml                   |   2 +-
 socketsecurity/__init__.py       |   2 +-
 socketsecurity/config.py         |  17 ++
 socketsecurity/core/messages.py  | 181 ++++++++++++++
 socketsecurity/output.py         |  58 ++++-
 tests/unit/test_gitlab_format.py | 393 +++++++++++++++++++++++++++++++
 7 files changed, 811 insertions(+), 14 deletions(-)
 create mode 100644 tests/unit/test_gitlab_format.py

diff --git a/README.md b/README.md
index 575e744..b2c2d9a 100644
--- a/README.md
+++ b/README.md
@@ -79,6 +79,32 @@ This will:
 - Create a repository in Socket named like `my-repo-mobile-web`
 - Preserve git context (commits, branch info) from the repository root
 
+**Generate GitLab Security Dashboard report:**
+```bash
+socketcli --enable-gitlab-security \
+          --repo owner/repo \
+          --target-path .
+```
+
+This will:
+- Scan all manifest files in the current directory
+- Generate a GitLab-compatible Dependency Scanning report
+- Save to `gl-dependency-scanning-report.json`
+- Include all actionable security alerts (error/warn level)
+
+**Multiple output formats:**
+```bash
+socketcli --enable-json \
+          --enable-sarif \
+          --enable-gitlab-security \
+          --repo owner/repo
+```
+
+This will simultaneously generate:
+- JSON output to console
+- SARIF format to console
+- GitLab Security Dashboard report to file
+
 ### Requirements
 
 - Both `--sub-path` and `--workspace-name` must be specified together
@@ -88,14 +114,15 @@ This will:
 ## Usage
 
 ```` shell
-socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}] 
-          [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]] 
+socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
+          [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
-          [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME] 
-          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug] 
-          [--enable-json] [--enable-sarif] [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue] 
-          [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders] 
-          [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT] 
+          [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
+          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
+          [--enable-json] [--enable-sarif] [--enable-gitlab-security] [--gitlab-security-file <path>]
+          [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
+          [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
+          [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-exclude-paths REACH_EXCLUDE_PATHS]
           [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-output-file REACH_OUTPUT_FILE]
           [--only-facts-file] [--version]
@@ -154,6 +181,8 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --enable-debug            | False    | False   | Enable debug logging                                                              |
 | --enable-json             | False    | False   | Output in JSON format                                                             |
 | --enable-sarif            | False    | False   | Enable SARIF output of results instead of table or JSON format                    |
+| --enable-gitlab-security  | False    | False   | Enable GitLab Security Dashboard output format (Dependency Scanning report)       |
+| --gitlab-security-file    | False    | gl-dependency-scanning-report.json | Output file path for GitLab Security report                |
 | --disable-overview        | False    | False   | Disable overview output                                                           |
 | --exclude-license-details | False    | False   | Exclude license details from the diff report (boosts performance for large repos) |
 | --version                 | False    | False   | Show program's version number and exit                                            |
@@ -624,9 +653,136 @@ The manifest archive feature is useful for:
 
 ### Differential scan skipped on octopus merge
 
-When your repo uses an **octopus merge** (3+ parents), the CLI may not detect all changed files.  
+When your repo uses an **octopus merge** (3+ parents), the CLI may not detect all changed files.
 This is expected Git behavior: the default diff only compares the merge result to the first parent.
 
+## GitLab Security Dashboard Integration
+
+Socket CLI can generate reports compatible with GitLab's Security Dashboard, allowing vulnerability information to be displayed directly in merge requests and security dashboards. This feature complements the existing [Socket GitLab integration](https://docs.socket.dev/docs/gitlab) by providing standardized dependency scanning reports.
+
+### Generating GitLab Security Reports
+
+To generate a GitLab-compatible security report:
+
+```bash
+socketcli --enable-gitlab-security --repo owner/repo
+```
+
+This creates a `gl-dependency-scanning-report.json` file following GitLab's Dependency Scanning report schema.
+
+### GitLab CI/CD Integration
+
+Add Socket Security scanning to your GitLab CI pipeline to generate Security Dashboard reports:
+
+```yaml
+# .gitlab-ci.yml
+socket_security_scan:
+  stage: security
+  image: python:3.11
+  before_script:
+    - pip install socketsecurity
+  script:
+    - socketcli
+        --api-token $SOCKET_API_TOKEN
+        --repo $CI_PROJECT_PATH
+        --branch $CI_COMMIT_REF_NAME
+        --commit-sha $CI_COMMIT_SHA
+        --enable-gitlab-security
+  artifacts:
+    reports:
+      dependency_scanning: gl-dependency-scanning-report.json
+    paths:
+      - gl-dependency-scanning-report.json
+    expire_in: 1 week
+  only:
+    - merge_requests
+    - main
+```
+
+**Note**: This Security Dashboard integration can be used alongside the [Socket GitLab App](https://docs.socket.dev/docs/gitlab) for comprehensive protection:
+- **Socket GitLab App**: Real-time PR comments, policy enforcement, and blocking
+- **Security Dashboard**: Centralized vulnerability tracking and reporting in GitLab's native interface
+
+### Custom Output Path
+
+Specify a custom output path for the GitLab security report:
+
+```bash
+socketcli --enable-gitlab-security --gitlab-security-file custom-path.json
+```
+
+### Multiple Output Formats
+
+GitLab security reports can be generated alongside other output formats:
+
+```bash
+socketcli --enable-json --enable-gitlab-security --enable-sarif
+```
+
+This command will:
+- Output JSON format to console
+- Save GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
+- Save SARIF report (if configured)
+
+### Security Dashboard Features
+
+The GitLab Security Dashboard will display:
+- **Vulnerability Severity**: Critical, High, Medium, Low levels
+- **Affected Packages**: Package name, version, and ecosystem
+- **CVE Identifiers**: Direct links to CVE databases when available
+- **Dependency Chains**: Distinction between direct and transitive dependencies
+- **Remediation Suggestions**: Fix recommendations from Socket Security
+- **Alert Categories**: Supply chain risks, malware, vulnerabilities, and more
+
+### Alert Filtering
+
+The GitLab report includes **actionable security alerts** based on your Socket policy configuration:
+
+**Included Alerts** ✅:
+- **Error-level alerts** (`error: true`) - Security policy violations that block merges
+- **Warning-level alerts** (`warn: true`) - Important security concerns requiring attention
+
+**Excluded Alerts** ❌:
+- **Ignored alerts** (`ignore: true`) - Alerts explicitly ignored in your policy
+- **Monitor-only alerts** (`monitor: true` without error/warn) - Tracked but not actionable
+
+**Socket Alert Types Detected**:
+- Supply chain risks (malware, typosquatting, suspicious behavior)
+- Security vulnerabilities (CVEs, unsafe code patterns)
+- Risky permissions (network access, filesystem access, shell access)
+- License policy violations
+
+All alert types are included in the GitLab report if they're marked as `error` or `warn` by your Socket Security policy, ensuring the Security Dashboard shows only actionable findings.
+
+### Report Schema
+
+Socket CLI generates reports compliant with [GitLab Dependency Scanning schema version 15.0.0](https://docs.gitlab.com/ee/development/integrations/secure.html). The reports include:
+
+- **Scan metadata**: Analyzer and scanner information
+- **Vulnerabilities**: Detailed vulnerability data with:
+  - Unique deterministic UUIDs for tracking
+  - Package location and dependency information
+  - Severity levels mapped from Socket's analysis
+  - Socket-specific alert types and CVE identifiers
+  - Links to Socket.dev for detailed analysis
+
+### Requirements
+
+- **GitLab Version**: GitLab 12.0 or later (for Security Dashboard support)
+- **Socket API Token**: Set via `$SOCKET_API_TOKEN` environment variable or `--api-token` parameter
+- **CI/CD Artifacts**: Reports must be uploaded as `dependency_scanning` artifacts
+
+### Troubleshooting
+
+**Report not appearing in Security Dashboard:**
+- Verify the artifact is correctly configured in `.gitlab-ci.yml`
+- Check that the job succeeded and artifacts were uploaded
+- Ensure the report file follows the correct schema format
+
+**Empty vulnerabilities array:**
+- This is normal if no new security issues were detected
+- Check Socket.dev dashboard for full analysis details
+
 ## Development
 
 This project uses `pyproject.toml` as the primary dependency specification.
diff --git a/pyproject.toml b/pyproject.toml
index e524c2e..7d4f6e2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.66"
+version = "2.2.68"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index eab582e..766405e 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.66'
+__version__ = '2.2.68'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 602d741..ea78382 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -40,6 +40,8 @@ class CliConfig:
     allow_unverified: bool = False
     enable_json: bool = False
     enable_sarif: bool = False
+    enable_gitlab_security: bool = False
+    gitlab_security_file: Optional[str] = None
     disable_overview: bool = False
     disable_security_issue: bool = False
     files: str = None
@@ -119,6 +121,8 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'allow_unverified': args.allow_unverified,
             'enable_json': args.enable_json,
             'enable_sarif': args.enable_sarif,
+            'enable_gitlab_security': args.enable_gitlab_security,
+            'gitlab_security_file': args.gitlab_security_file,
             'disable_overview': args.disable_overview,
             'disable_security_issue': args.disable_security_issue,
             'files': args.files,
@@ -451,6 +455,19 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Enable SARIF output of results instead of table or JSON format"
     )
+    output_group.add_argument(
+        "--enable-gitlab-security",
+        dest="enable_gitlab_security",
+        action="store_true",
+        help="Enable GitLab Security Dashboard output format (Dependency Scanning report)"
+    )
+    output_group.add_argument(
+        "--gitlab-security-file",
+        dest="gitlab_security_file",
+        metavar="<path>",
+        default="gl-dependency-scanning-report.json",
+        help="Output file path for GitLab Security report (default: gl-dependency-scanning-report.json)"
+    )
     output_group.add_argument(
         "--disable-overview",
         dest="disable_overview",
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index 5678bad..43033a2 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -2,6 +2,8 @@
 import logging
 import os
 import re
+import uuid
+from datetime import datetime
 from pathlib import Path
 from mdutils import MdUtils
 from prettytable import PrettyTable
@@ -387,6 +389,185 @@ def create_security_comment_json(diff: Diff) -> dict:
             output["new_alerts"].append(json.loads(str(alert)))
         return output
 
+    @staticmethod
+    def map_socket_severity_to_gitlab(severity: str) -> str:
+        """
+        Map Socket severity levels to GitLab severity levels.
+
+        Socket: critical, high, medium/middle, low
+        GitLab: Critical, High, Medium, Low, Info, Unknown
+        """
+        severity_mapping = {
+            "critical": "Critical",
+            "high": "High",
+            "medium": "Medium",
+            "middle": "Medium",  # Socket's older format
+            "low": "Low",
+        }
+        return severity_mapping.get(severity.lower(), "Unknown")
+
+    @staticmethod
+    def generate_uuid_from_alert_gitlab(alert: Issue) -> str:
+        """
+        Generate deterministic UUID for vulnerability based on alert properties.
+        This ensures consistent IDs across runs for the same vulnerability.
+        """
+        # Create unique string from alert key properties
+        unique_str = f"{alert.pkg_name}:{alert.pkg_version}:{alert.type}:{alert.severity}"
+
+        # Generate UUID5 (deterministic) from namespace and unique string
+        namespace = uuid.UUID('6ba7b810-9dad-11d1-80b4-00c04fd430c8')  # DNS namespace
+        return str(uuid.uuid5(namespace, unique_str))
+
+    @staticmethod
+    def extract_identifiers_gitlab(alert: Issue) -> list:
+        """
+        Extract CVE and other identifiers from alert properties.
+
+        Socket stores CVE info in alert.props dict.
+        Returns array of identifier objects per GitLab schema.
+        """
+        identifiers = []
+
+        # Primary identifier: Socket alert type
+        identifiers.append({
+            "type": "socket_alert",
+            "name": f"Socket {alert.type}",
+            "value": alert.type,
+            "url": alert.url if hasattr(alert, 'url') and alert.url else None
+        })
+
+        # Extract CVE identifiers from props
+        if hasattr(alert, 'props') and alert.props:
+            if 'cve' in alert.props:
+                cves = alert.props['cve']
+                if isinstance(cves, list):
+                    for cve in cves:
+                        identifiers.append({
+                            "type": "cve",
+                            "name": cve,
+                            "value": cve,
+                            "url": f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cve}"
+                        })
+                elif isinstance(cves, str):
+                    identifiers.append({
+                        "type": "cve",
+                        "name": cves,
+                        "value": cves,
+                        "url": f"https://cve.mitre.org/cgi-bin/cvename.cgi?name={cves}"
+                    })
+
+        return identifiers
+
+    @staticmethod
+    def extract_location_gitlab(alert: Issue) -> dict:
+        """
+        Extract location information for GitLab report.
+
+        GitLab location requires:
+        - file: path to manifest file
+        - dependency: package name and version
+        - dependency_path (optional): dependency chain
+        """
+        # Get manifest file from introduced_by or manifests attribute
+        manifest_file = "unknown"
+        dependency_path = []
+        is_direct = True
+
+        if hasattr(alert, 'introduced_by') and alert.introduced_by:
+            if isinstance(alert.introduced_by, list) and len(alert.introduced_by) > 0:
+                first_entry = alert.introduced_by[0]
+                if isinstance(first_entry, (list, tuple)) and len(first_entry) >= 2:
+                    dependency_path_str = first_entry[0]
+                    manifest_file = first_entry[1].split(';')[0] if ';' in first_entry[1] else first_entry[1]
+
+                    # Parse dependency path
+                    if ' > ' in dependency_path_str:
+                        dependency_path = dependency_path_str.split(' > ')
+                        # If there's a chain, it's transitive (not direct)
+                        is_direct = len(dependency_path) <= 1
+
+        elif hasattr(alert, 'manifests') and alert.manifests:
+            manifest_file = alert.manifests.split(';')[0]
+
+        location = {
+            "file": manifest_file,
+            "dependency": {
+                "package": {
+                    "name": alert.pkg_name
+                },
+                "version": alert.pkg_version,
+                "direct": is_direct
+            }
+        }
+
+        return location
+
+    @staticmethod
+    def create_security_comment_gitlab(diff: Diff) -> dict:
+        """
+        Create GitLab Dependency Scanning report format from Socket scan results.
+
+        Spec: https://docs.gitlab.com/ee/development/integrations/secure.html
+        Schema: https://gitlab.com/gitlab-org/security-products/security-report-schemas
+
+        Args:
+            diff: Diff report containing new_alerts and package information
+
+        Returns:
+            Dictionary compliant with GitLab Dependency Scanning schema
+        """
+        from socketsecurity import __version__
+
+        gitlab_report = {
+            "version": "15.0.0",  # GitLab schema version
+            "scan": {
+                "analyzer": {
+                    "id": "socket-security",
+                    "name": "Socket Security",
+                    "version": __version__,
+                    "vendor": {
+                        "name": "Socket"
+                    }
+                },
+                "scanner": {
+                    "id": "socket-cli",
+                    "name": "Socket CLI",
+                    "version": __version__,
+                    "vendor": {
+                        "name": "Socket"
+                    }
+                },
+                "type": "dependency_scanning",
+                "start_time": datetime.utcnow().isoformat() + "Z",
+                "end_time": datetime.utcnow().isoformat() + "Z",
+                "status": "success"
+            },
+            "vulnerabilities": []
+        }
+
+        # Process each alert
+        for alert in diff.new_alerts:
+            vulnerability = {
+                "id": Messages.generate_uuid_from_alert_gitlab(alert),
+                "category": "dependency_scanning",
+                "name": alert.title if hasattr(alert, 'title') else f"{alert.type} in {alert.pkg_name}",
+                "message": f"{alert.pkg_name}@{alert.pkg_version}: {alert.title if hasattr(alert, 'title') else alert.type}",
+                "description": alert.description if hasattr(alert, 'description') and alert.description else "",
+                "severity": Messages.map_socket_severity_to_gitlab(alert.severity),
+                "identifiers": Messages.extract_identifiers_gitlab(alert),
+                "links": [{"url": alert.url}] if hasattr(alert, 'url') and alert.url else [],
+                "location": Messages.extract_location_gitlab(alert)
+            }
+
+            # Add solution if available
+            if hasattr(alert, 'suggestion') and alert.suggestion:
+                vulnerability["solution"] = alert.suggestion
+
+            gitlab_report["vulnerabilities"].append(vulnerability)
+
+        return gitlab_report
+
     @staticmethod
     def security_comment_template(diff: Diff, config=None) -> str:
         """
diff --git a/socketsecurity/output.py b/socketsecurity/output.py
index 65004c1..478f2b2 100644
--- a/socketsecurity/output.py
+++ b/socketsecurity/output.py
@@ -19,12 +19,28 @@ def __init__(self, config: CliConfig, sdk: socketdev):
 
     def handle_output(self, diff_report: Diff) -> None:
         """Main output handler that determines output format"""
+        # Determine which formats to output
+        formats_to_output = []
+
         if self.config.enable_json:
-            self.output_console_json(diff_report, self.config.sbom_file)
-        elif self.config.enable_sarif:
-            self.output_console_sarif(diff_report, self.config.sbom_file)
-        else:
+            formats_to_output.append('json')
+        if self.config.enable_sarif:
+            formats_to_output.append('sarif')
+        if self.config.enable_gitlab_security:
+            formats_to_output.append('gitlab')
+
+        # If no format specified, default to console comments
+        if not formats_to_output:
             self.output_console_comments(diff_report, self.config.sbom_file)
+        else:
+            # Output all enabled formats
+            for format_type in formats_to_output:
+                if format_type == 'json':
+                    self.output_console_json(diff_report, self.config.sbom_file)
+                elif format_type == 'sarif':
+                    self.output_console_sarif(diff_report, self.config.sbom_file)
+                elif format_type == 'gitlab':
+                    self.output_gitlab_security(diff_report)
         if self.config.jira_plugin.enabled:
             jira_config = {
                 "enabled": self.config.jira_plugin.enabled,
@@ -169,6 +185,40 @@ def save_sbom_file(self, diff_report: Diff, sbom_file_name: Optional[str] = None
         with open(sbom_path, "w") as f:
             json.dump(diff_report.sbom, f, indent=2)
 
+    def output_gitlab_security(self, diff_report: Diff) -> None:
+        """
+        Generate GitLab Security Dashboard (Dependency Scanning) output
+        and save to file.
+
+        Args:
+            diff_report: Diff report containing vulnerability data
+        """
+        if diff_report.id != "NO_DIFF_RAN":
+            # Generate GitLab report structure
+            gitlab_report = Messages.create_security_comment_gitlab(diff_report)
+
+            # Determine output file path
+            output_path = self.config.gitlab_security_file or "gl-dependency-scanning-report.json"
+
+            # Save to file
+            self.save_gitlab_security_file(gitlab_report, output_path)
+
+            self.logger.info(f"GitLab Security report saved to {output_path}")
+
+    def save_gitlab_security_file(self, report: dict, file_path: str) -> None:
+        """
+        Save GitLab Security Dashboard report to file.
+
+        Args:
+            report: GitLab report dictionary
+            file_path: Path to save the report file
+        """
+        gitlab_path = Path(file_path)
+        gitlab_path.parent.mkdir(parents=True, exist_ok=True)
+
+        with open(gitlab_path, "w") as f:
+            json.dump(report, f, indent=2)
+
     def _output_issue(self, issue: Issue) -> None:
         """Helper method to format and output a single issue"""
         severity = issue.severity.upper() if issue.severity else "UNKNOWN"
diff --git a/tests/unit/test_gitlab_format.py b/tests/unit/test_gitlab_format.py
new file mode 100644
index 0000000..1799dcf
--- /dev/null
+++ b/tests/unit/test_gitlab_format.py
@@ -0,0 +1,393 @@
+import pytest
+from socketsecurity.core.messages import Messages
+from socketsecurity.core.classes import Diff, Issue
+
+
+class TestGitLabFormat:
+    """Test suite for GitLab Security Dashboard format generation"""
+
+    def test_gitlab_report_structure(self):
+        """Test basic GitLab report structure is valid"""
+        diff = Diff()
+        diff.new_alerts = []
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        report = Messages.create_security_comment_gitlab(diff)
+
+        # Verify required top-level fields
+        assert "version" in report
+        assert "scan" in report
+        assert "vulnerabilities" in report
+
+        # Verify scan structure
+        assert report["scan"]["type"] == "dependency_scanning"
+        assert "analyzer" in report["scan"]
+        assert "scanner" in report["scan"]
+        assert report["scan"]["analyzer"]["id"] == "socket-security"
+        assert report["scan"]["scanner"]["id"] == "socket-cli"
+        assert report["scan"]["status"] == "success"
+
+    def test_vulnerability_mapping(self):
+        """Test Socket Issue maps correctly to GitLab vulnerability"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="test-package",
+            pkg_version="1.0.0",
+            severity="high",
+            title="Test Vulnerability",
+            description="Test description",
+            type="malware",
+            url="https://socket.dev/test",
+            manifests="package.json",
+            props={"cve": ["CVE-2024-1234"]},
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/test-package@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+
+        assert len(report["vulnerabilities"]) == 1
+        vuln = report["vulnerabilities"][0]
+
+        assert vuln["category"] == "dependency_scanning"
+        assert vuln["name"] == "Test Vulnerability"
+        assert vuln["severity"] == "High"
+        assert vuln["location"]["file"] == "package.json"
+        assert vuln["location"]["dependency"]["package"]["name"] == "test-package"
+        assert vuln["location"]["dependency"]["version"] == "1.0.0"
+        assert vuln["message"] == "test-package@1.0.0: Test Vulnerability"
+
+    def test_identifier_extraction_with_cve(self):
+        """Test CVE identifiers are correctly extracted"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="vulnerable-pkg",
+            pkg_version="2.0.0",
+            type="vulnerability",
+            severity="critical",
+            title="Known CVE",
+            props={"cve": ["CVE-2024-5678", "CVE-2024-9012"]},
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/vulnerable-pkg@2.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        # Should have socket_alert identifier + 2 CVE identifiers
+        assert len(vuln["identifiers"]) >= 3
+        cve_identifiers = [i for i in vuln["identifiers"] if i["type"] == "cve"]
+        assert len(cve_identifiers) == 2
+        assert any(i["value"] == "CVE-2024-5678" for i in cve_identifiers)
+        assert any(i["value"] == "CVE-2024-9012" for i in cve_identifiers)
+
+    def test_identifier_extraction_with_single_cve_string(self):
+        """Test single CVE identifier as string"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="vulnerable-pkg",
+            pkg_version="2.0.0",
+            type="vulnerability",
+            severity="high",
+            title="Single CVE",
+            props={"cve": "CVE-2024-1111"},
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/vulnerable-pkg@2.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        cve_identifiers = [i for i in vuln["identifiers"] if i["type"] == "cve"]
+        assert len(cve_identifiers) == 1
+        assert cve_identifiers[0]["value"] == "CVE-2024-1111"
+
+    def test_dependency_chain_handling_transitive(self):
+        """Test transitive dependency path is captured"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="transitive-dep",
+            pkg_version="1.5.0",
+            type="supply-chain-risk",
+            severity="medium",
+            title="Supply Chain Risk",
+            introduced_by=[
+                ["top-level > intermediate > transitive-dep", "package.json"]
+            ],
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/transitive-dep@1.5.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert vuln["location"]["file"] == "package.json"
+        assert vuln["location"]["dependency"]["direct"] is False
+
+    def test_dependency_chain_handling_direct(self):
+        """Test direct dependency is correctly identified"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="direct-dep",
+            pkg_version="3.0.0",
+            type="malware",
+            severity="critical",
+            title="Malware Found",
+            introduced_by=[
+                ["direct-dep", "package.json"]
+            ],
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/direct-dep@3.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert vuln["location"]["dependency"]["direct"] is True
+
+    def test_severity_mapping(self):
+        """Test all Socket severities map to GitLab severities"""
+        severity_tests = [
+            ("critical", "Critical"),
+            ("high", "High"),
+            ("medium", "Medium"),
+            ("middle", "Medium"),  # Old format
+            ("low", "Low"),
+            ("unknown", "Unknown")
+        ]
+
+        for socket_sev, gitlab_sev in severity_tests:
+            result = Messages.map_socket_severity_to_gitlab(socket_sev)
+            assert result == gitlab_sev, f"Failed for severity: {socket_sev}"
+
+    def test_empty_alerts(self):
+        """Test report with no vulnerabilities"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+        diff.new_alerts = []
+
+        report = Messages.create_security_comment_gitlab(diff)
+
+        assert len(report["vulnerabilities"]) == 0
+        assert report["scan"]["status"] == "success"
+
+    def test_multiple_manifest_files(self):
+        """Test handling of multiple manifest files (semicolon-separated)"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="multi-manifest-pkg",
+            pkg_version="1.0.0",
+            type="supply-chain-risk",
+            severity="high",
+            title="Multiple Manifests",
+            introduced_by=[
+                ["multi-manifest-pkg", "package.json;package-lock.json"]
+            ],
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/multi-manifest-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        # Should use first manifest file
+        assert vuln["location"]["file"] == "package.json"
+
+    def test_solution_field_included(self):
+        """Test solution field is included when suggestion is present"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="fixable-pkg",
+            pkg_version="1.0.0",
+            type="vulnerability",
+            severity="high",
+            title="Fixable Issue",
+            suggestion="Update to version 2.0.0",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/fixable-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert "solution" in vuln
+        assert vuln["solution"] == "Update to version 2.0.0"
+
+    def test_solution_field_omitted_when_no_suggestion(self):
+        """Test solution field is omitted when no suggestion"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="unfixable-pkg",
+            pkg_version="1.0.0",
+            type="vulnerability",
+            severity="high",
+            title="No Fix Available",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/unfixable-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert "solution" not in vuln
+
+    def test_uuid_generation_is_deterministic(self):
+        """Test UUID generation is deterministic for same vulnerability"""
+        test_issue = Issue(
+            pkg_name="test-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="high",
+            title="Test",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/test-pkg@1.0.0"
+        )
+
+        uuid1 = Messages.generate_uuid_from_alert_gitlab(test_issue)
+        uuid2 = Messages.generate_uuid_from_alert_gitlab(test_issue)
+
+        assert uuid1 == uuid2
+
+    def test_uuid_generation_differs_for_different_vulnerabilities(self):
+        """Test UUID generation differs for different vulnerabilities"""
+        issue1 = Issue(
+            pkg_name="test-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="high",
+            title="Test",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/test-pkg@1.0.0"
+        )
+
+        issue2 = Issue(
+            pkg_name="test-pkg",
+            pkg_version="1.0.0",
+            type="vulnerability",
+            severity="high",
+            title="Test",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/test-pkg@1.0.0"
+        )
+
+        uuid1 = Messages.generate_uuid_from_alert_gitlab(issue1)
+        uuid2 = Messages.generate_uuid_from_alert_gitlab(issue2)
+
+        assert uuid1 != uuid2
+
+    def test_missing_title_falls_back_to_type(self):
+        """Test vulnerability name falls back to type when title missing"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="no-title-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="high",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/no-title-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert "malware" in vuln["name"].lower()
+        assert "no-title-pkg" in vuln["name"]
+
+    def test_links_array_includes_socket_url(self):
+        """Test links array includes Socket.dev URL"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="linked-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="high",
+            title="Test",
+            url="https://socket.dev/npm/package/linked-pkg",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/linked-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert len(vuln["links"]) == 1
+        assert vuln["links"][0]["url"] == "https://socket.dev/npm/package/linked-pkg"
+
+    def test_manifests_attribute_fallback(self):
+        """Test location extraction falls back to manifests attribute"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        test_issue = Issue(
+            pkg_name="manifest-fallback-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="high",
+            title="Test",
+            manifests="requirements.txt",
+            pkg_type="pypi",
+            key="test-key",
+            purl="pkg:pypi/manifest-fallback-pkg@1.0.0"
+        )
+        diff.new_alerts = [test_issue]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        vuln = report["vulnerabilities"][0]
+
+        assert vuln["location"]["file"] == "requirements.txt"

From b8231bb1cc228fdc7ffc05d07b87ba7da5aa6d15 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Mon, 19 Jan 2026 11:57:56 +0100
Subject: [PATCH 17/80] feat: add new reachability flags and change analysis
 splitting default

- Add --reach-enable-analysis-splitting flag (splitting now disabled by default)
- Add --reach-detailed-analysis-log-file flag
- Add --reach-lazy-mode flag
- Keep --reach-disable-analysis-splitting as hidden no-op for backwards compatibility
---
 .gitignore                                |  1 +
 CHANGELOG.md                              |  7 ++++++
 pyproject.toml                            |  2 +-
 socketsecurity/__init__.py                |  2 +-
 socketsecurity/config.py                  | 28 +++++++++++++++++++++--
 socketsecurity/core/tools/reachability.py | 19 +++++++++++----
 socketsecurity/socketcli.py               |  4 +++-
 7 files changed, 54 insertions(+), 9 deletions(-)

diff --git a/.gitignore b/.gitignore
index d6408eb..06780f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 .idea
 venv
 .venv
+.venv-test
 build
 dist
 *.build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 62aaae7..b8ba70e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.2.69
+
+- Added `--reach-enable-analysis-splitting` flag to enable analysis splitting (disabled by default).
+- Added `--reach-detailed-analysis-log-file` flag to print detailed analysis log file path.
+- Added `--reach-lazy-mode` flag to enable lazy mode for reachability analysis.
+- Changed default behavior: analysis splitting is now disabled by default. The old `--reach-disable-analysis-splitting` flag is kept as a hidden no-op for backwards compatibility.
+
 ## 2.2.64
 
 - Included PyPy in the Docker image.
diff --git a/pyproject.toml b/pyproject.toml
index 7d4f6e2..f9eacab 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.68"
+version = "2.2.69"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 766405e..8736004 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.68'
+__version__ = '2.2.69'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index ea78382..3711b3e 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -72,7 +72,10 @@ class CliConfig:
     reach_analysis_memory_limit: Optional[int] = None
     reach_analysis_timeout: Optional[int] = None
     reach_disable_analytics: bool = False
-    reach_disable_analysis_splitting: bool = False
+    reach_disable_analysis_splitting: bool = False  # Deprecated, kept for backwards compatibility
+    reach_enable_analysis_splitting: bool = False
+    reach_detailed_analysis_log_file: bool = False
+    reach_lazy_mode: bool = False
     reach_ecosystems: Optional[List[str]] = None
     reach_exclude_paths: Optional[List[str]] = None
     reach_skip_cache: bool = False
@@ -148,6 +151,9 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_analysis_memory_limit': args.reach_analysis_memory_limit,
             'reach_disable_analytics': args.reach_disable_analytics,
             'reach_disable_analysis_splitting': args.reach_disable_analysis_splitting,
+            'reach_enable_analysis_splitting': args.reach_enable_analysis_splitting,
+            'reach_detailed_analysis_log_file': args.reach_detailed_analysis_log_file,
+            'reach_lazy_mode': args.reach_lazy_mode,
             'reach_ecosystems': args.reach_ecosystems.split(',') if args.reach_ecosystems else None,
             'reach_exclude_paths': args.reach_exclude_paths.split(',') if args.reach_exclude_paths else None,
             'reach_skip_cache': args.reach_skip_cache,
@@ -642,7 +648,25 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--reach-disable-analysis-splitting",
         dest="reach_disable_analysis_splitting",
         action="store_true",
-        help="Disable analysis splitting/bucketing for reachability analysis"
+        help=argparse.SUPPRESS  # Deprecated, kept for backwards compatibility (no-op)
+    )
+    reachability_group.add_argument(
+        "--reach-enable-analysis-splitting",
+        dest="reach_enable_analysis_splitting",
+        action="store_true",
+        help="Enable analysis splitting/bucketing for reachability analysis (disabled by default). This is a legacy feature for improving performance"
+    )
+    reachability_group.add_argument(
+        "--reach-detailed-analysis-log-file",
+        dest="reach_detailed_analysis_log_file",
+        action="store_true",
+            help="Created detailed analysis log file path for reachability analysis. The output path is written to stdout"
+    )
+    reachability_group.add_argument(
+        "--reach-lazy-mode",
+        dest="reach_lazy_mode",
+        action="store_true",
+        help="Enable lazy mode for reachability analysis. This is an experimental feature for improving performance"
     )
     reachability_group.add_argument(
         "--reach-output-file",
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index f757a17..581ea70 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -93,7 +93,9 @@ def run_reachability_analysis(
         min_severity: Optional[str] = None,
         skip_cache: bool = False,
         disable_analytics: bool = False,
-        disable_analysis_splitting: bool = False,
+        enable_analysis_splitting: bool = False,
+        detailed_analysis_log_file: bool = False,
+        lazy_mode: bool = False,
         repo_name: Optional[str] = None,
         branch_name: Optional[str] = None,
         version: Optional[str] = None,
@@ -118,7 +120,9 @@ def run_reachability_analysis(
             min_severity: Minimum severity level (info, low, moderate, high, critical)
             skip_cache: Skip cache usage
             disable_analytics: Disable analytics sharing
-            disable_analysis_splitting: Disable analysis splitting
+            enable_analysis_splitting: Enable analysis splitting (disabled by default)
+            detailed_analysis_log_file: Print detailed analysis log file path
+            lazy_mode: Enable lazy mode for analysis
             repo_name: Repository name
             branch_name: Branch name
             version: Specific version of @coana-tech/cli to use
@@ -156,9 +160,16 @@ def run_reachability_analysis(
         
         if disable_analytics:
             cmd.append("--disable-analytics-sharing")
-        
-        if disable_analysis_splitting:
+
+        # Analysis splitting is disabled by default; only omit the flag if explicitly enabled
+        if not enable_analysis_splitting:
             cmd.append("--disable-analysis-splitting")
+
+        if detailed_analysis_log_file:
+            cmd.append("--print-analysis-log-file")
+
+        if lazy_mode:
+            cmd.append("--lazy-mode")
         
         # KEY POINT: Only add manifest tar hash if we have one
         if tar_hash:
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index a92b34b..86367f4 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -291,7 +291,9 @@ def main_code():
                     min_severity=config.reach_min_severity,
                     skip_cache=config.reach_skip_cache or False,
                     disable_analytics=config.reach_disable_analytics or False,
-                    disable_analysis_splitting=config.reach_disable_analysis_splitting or False,
+                    enable_analysis_splitting=config.reach_enable_analysis_splitting or False,
+                    detailed_analysis_log_file=config.reach_detailed_analysis_log_file or False,
+                    lazy_mode=config.reach_lazy_mode or False,
                     repo_name=config.repo,
                     branch_name=config.branch,
                     version=config.reach_version,

From c4cd89af3cd51597282ed981dc99d55709121344 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Tue, 20 Jan 2026 09:16:33 +0100
Subject: [PATCH 18/80] fix description

---
 socketsecurity/config.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 3711b3e..5105281 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -660,7 +660,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--reach-detailed-analysis-log-file",
         dest="reach_detailed_analysis_log_file",
         action="store_true",
-            help="Created detailed analysis log file path for reachability analysis. The output path is written to stdout"
+        help="Create a detailed analysis log file for reachability analysis. The output path is written to stdout"
     )
     reachability_group.add_argument(
         "--reach-lazy-mode",

From 92ebc970516da02468bd8244a2719ba8df97de51 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Wed, 21 Jan 2026 12:02:12 +0100
Subject: [PATCH 19/80] Set the scan type to socket_tier1 when using the
 reachability flag

---
 CHANGELOG.md                |  4 ++++
 pyproject.toml              |  4 ++--
 socketsecurity/__init__.py  |  2 +-
 socketsecurity/socketcli.py |  3 ++-
 uv.lock                     | 10 +++++-----
 5 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b8ba70e..dffec7c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.70
+
+- Set the scan to `'socket_tier1'` when using the `--reach` flag. This ensures Tier 1 scans are properly integrated into the organization-wide alerts.
+
 ## 2.2.69
 
 - Added `--reach-enable-analysis-splitting` flag to enable analysis splitting (disabled by default).
diff --git a/pyproject.toml b/pyproject.toml
index f9eacab..79cea95 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.69"
+version = "2.2.70"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.28,<4.0.0",
+    "socketdev>=3.0.29,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 8736004..0fa0e5b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.69'
+__version__ = '2.2.70'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 86367f4..194da44 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -463,7 +463,8 @@ def main_code():
         committers=config.committers,
         make_default_branch=is_default_branch,
         set_as_pending_head=is_default_branch,
-        tmp=False
+        tmp=False,
+        scan_type='socket_tier1' if config.reach else 'socket'
     )
 
     params.include_license_details = not config.exclude_license_details
diff --git a/uv.lock b/uv.lock
index 3101764..f8cbcd5 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1250,20 +1250,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.28"
+version = "3.0.29"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/f8/db/3446da069f8f2e0235970fa3e1cbcc2cf9a2da9ab75bd965f00e7ab3c7ab/socketdev-3.0.28.tar.gz", hash = "sha256:60f8635502fa291a9bf4fb0f2a13c8dfeb1d3dc2dc395ec5265a1e2f4147cf52", size = 170539, upload-time = "2026-01-05T22:24:53.637Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/02/f4/a4434843e0f01da684d0d330f1b4b744abfad1ee4d6b6d5fddfa9228b122/socketdev-3.0.29.tar.gz", hash = "sha256:be201a9bd186da6ddae4725294d3cbf11b00ec76c96e46be38d78a569fde4af3", size = 170751, upload-time = "2026-01-21T09:15:57.465Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bc/72/4bbd4a70e5fa317f4e33a134f5871793eeaba45e05b949685f3502e451b4/socketdev-3.0.28-py3-none-any.whl", hash = "sha256:61a9e09ab24180e7b033ad1e141110b90f1f714336b04f21c20035b901311229", size = 66681, upload-time = "2026-01-05T22:24:51.736Z" },
+    { url = "https://files.pythonhosted.org/packages/db/08/f1cea3b342d8b9109f5792257e3f6c31c3ff53a1e42a87726a2acac65440/socketdev-3.0.29-py3-none-any.whl", hash = "sha256:c2f832a703bd61eb88a5e3f9b8079e62f7cd1352ec206a20a946c6dd34fa788e", size = 66783, upload-time = "2026-01-21T09:15:55.909Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.65"
+version = "2.2.69"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.28,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.29,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 628e3861fd891331a3135b897eb3c42f5dd8cf28 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 22 Jan 2026 11:01:33 +0100
Subject: [PATCH 20/80] Add strace to Docker image

Added strace to the base packages in the Docker image for debugging purposes.
---
 CHANGELOG.md               | 4 ++++
 Dockerfile                 | 2 +-
 pyproject.toml             | 2 +-
 socketsecurity/__init__.py | 2 +-
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dffec7c..683e0ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.71
+
+- Added `strace` to the Docker image for debugging purposes.
+
 ## 2.2.70
 
 - Set the scan to `'socket_tier1'` when using the `--reach` flag. This ensures Tier 1 scans are properly integrated into the organization-wide alerts.
diff --git a/Dockerfile b/Dockerfile
index 7f18272..0d9f2cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@ ARG USE_LOCAL_INSTALL=false
 # Install base packages first
 RUN apk update && apk add --no-cache \
         git nodejs npm yarn curl wget \
-        ruby ruby-dev build-base
+        ruby ruby-dev build-base strace
 
 # Install Go with version control
 RUN if [ "$GO_VERSION" = "system" ]; then \
diff --git a/pyproject.toml b/pyproject.toml
index 79cea95..124646f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.70"
+version = "2.2.71"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 0fa0e5b..03e8a4a 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.70'
+__version__ = '2.2.71'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

From b0c00befcee58b5fd591ea4765301dca43c80e54 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 5 Feb 2026 13:47:10 -0800
Subject: [PATCH 21/80] e2e tests for full scans

---
 .github/workflows/e2e-test.yml             | 48 ++++++++++++++++++++++
 pyproject.toml                             |  2 +-
 socketsecurity/__init__.py                 |  2 +-
 tests/e2e/fixtures/simple-npm/index.js     | 13 ++++++
 tests/e2e/fixtures/simple-npm/package.json | 15 +++++++
 5 files changed, 78 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/e2e-test.yml
 create mode 100644 tests/e2e/fixtures/simple-npm/index.js
 create mode 100644 tests/e2e/fixtures/simple-npm/package.json

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
new file mode 100644
index 0000000..b7ced9a
--- /dev/null
+++ b/.github/workflows/e2e-test.yml
@@ -0,0 +1,48 @@
+name: E2E Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  e2e-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: '3.12'
+
+      - name: Install CLI from local repo
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+
+      - name: Run Socket CLI scan
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+        run: |
+          set -o pipefail
+          socketcli \
+            --target-path tests/e2e/fixtures/simple-npm \
+            --disable-blocking \
+            --enable-debug \
+            2>&1 | tee /tmp/scan-output.log
+
+      - name: Verify scan produced a report
+        run: |
+          if grep -q "Full scan report URL: https://socket.dev/" /tmp/scan-output.log; then
+            echo "PASS: Full scan report URL found"
+            grep "Full scan report URL:" /tmp/scan-output.log
+          elif grep -q "Diff Url: https://socket.dev/" /tmp/scan-output.log; then
+            echo "PASS: Diff URL found"
+            grep "Diff Url:" /tmp/scan-output.log
+          else
+            echo "FAIL: No report URL found in scan output"
+            cat /tmp/scan-output.log
+            exit 1
+          fi
diff --git a/pyproject.toml b/pyproject.toml
index 124646f..ce3bb6c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.71"
+version = "2.2.72"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 03e8a4a..7dd23bc 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.71'
+__version__ = '2.2.72'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/tests/e2e/fixtures/simple-npm/index.js b/tests/e2e/fixtures/simple-npm/index.js
new file mode 100644
index 0000000..8057d28
--- /dev/null
+++ b/tests/e2e/fixtures/simple-npm/index.js
@@ -0,0 +1,13 @@
+const express = require('express')
+const lodash = require('lodash')
+
+const app = express()
+
+app.get('/', (req, res) => {
+  const data = lodash.pick(req.query, ['name', 'age'])
+  res.json(data)
+})
+
+app.listen(3000, () => {
+  console.log(`Test fixture ${__filename} running on port 3000`)
+})
diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
new file mode 100644
index 0000000..49c2304
--- /dev/null
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -0,0 +1,15 @@
+{
+  "name": "reach-test-fixture",
+  "version": "1.0.0",
+  "description": "Test fixture for reachability analysis",
+  "main": "index.js",
+  "dependencies": {
+    "lodash": "4.17.21",
+    "express": "4.18.2",
+    "axios": "1.4.0"
+  },
+  "devDependencies": {
+    "typescript": "5.0.4",
+    "jest": "29.5.0"
+  }
+}

From d02113796658c6e80645d641c335aea72dacf1d8 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 5 Feb 2026 13:57:51 -0800
Subject: [PATCH 22/80] e2e test for the reachability analysis

---
 .github/workflows/e2e-test.yml | 61 ++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index b7ced9a..cc986cb 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -46,3 +46,64 @@ jobs:
             cat /tmp/scan-output.log
             exit 1
           fi
+
+  e2e-reachability:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        with:
+          node-version: '20'
+
+      - name: Install CLI from local repo
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+
+      - name: Install uv
+        run: pip install uv
+
+      - name: Run Socket CLI with reachability
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+        run: |
+          set -o pipefail
+          socketcli \
+            --target-path tests/e2e/fixtures/simple-npm \
+            --reach \
+            --disable-blocking \
+            --enable-debug \
+            2>&1 | tee /tmp/reach-output.log
+
+      - name: Verify reachability analysis completed
+        run: |
+          if grep -q "Reachability analysis completed successfully" /tmp/reach-output.log; then
+            echo "PASS: Reachability analysis completed"
+            grep "Reachability analysis completed successfully" /tmp/reach-output.log
+            grep "Results written to:" /tmp/reach-output.log || true
+          else
+            echo "FAIL: Reachability analysis did not complete successfully"
+            cat /tmp/reach-output.log
+            exit 1
+          fi
+
+      - name: Verify scan produced a report
+        run: |
+          if grep -q "Full scan report URL: https://socket.dev/" /tmp/reach-output.log; then
+            echo "PASS: Full scan report URL found"
+            grep "Full scan report URL:" /tmp/reach-output.log
+          elif grep -q "Diff Url: https://socket.dev/" /tmp/reach-output.log; then
+            echo "PASS: Diff URL found"
+            grep "Diff Url:" /tmp/reach-output.log
+          else
+            echo "FAIL: No report URL found in scan output"
+            cat /tmp/reach-output.log
+            exit 1
+          fi

From 4f2be5c9893ec57616b0d5a52de88c4a310ea99d Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 5 Feb 2026 14:15:29 -0800
Subject: [PATCH 23/80] add socket.yml to exclude fixtures

---
 socket.yml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 socket.yml

diff --git a/socket.yml b/socket.yml
new file mode 100644
index 0000000..a8bca7f
--- /dev/null
+++ b/socket.yml
@@ -0,0 +1,4 @@
+version: 2
+
+projectIgnorePaths:
+  - "tests/e2e/fixtures/"

From 9b586ae6c80bb8ea3f48f2e7e58ba68ab24268ee Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 18:55:56 -0800
Subject: [PATCH 24/80] Bump cryptography from 46.0.3 to 46.0.5 (#161)

Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.3 to 46.0.5.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/46.0.3...46.0.5)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 uv.lock | 82 ++++++++++++++++++++++++++++-----------------------------
 1 file changed, 41 insertions(+), 41 deletions(-)

diff --git a/uv.lock b/uv.lock
index f8cbcd5..0ee3327 100644
--- a/uv.lock
+++ b/uv.lock
@@ -451,51 +451,51 @@ toml = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.3"
+version = "46.0.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/33/c00162f49c0e2fe8064a62cb92b93e50c74a72bc370ab92f86112b33ff62/cryptography-46.0.3.tar.gz", hash = "sha256:a8b17438104fed022ce745b362294d9ce35b4c2e45c1d958ad4a4b019285f4a1", size = 749258, upload-time = "2025-10-15T23:18:31.74Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/1c/67/38769ca6b65f07461eb200e85fc1639b438bdc667be02cf7f2cd6a64601c/cryptography-46.0.3-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:09859af8466b69bc3c27bdf4f5d84a665e0f7ab5088412e9e2ec49758eca5cbc", size = 4296667, upload-time = "2025-10-15T23:16:54.369Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/49/498c86566a1d80e978b42f0d702795f69887005548c041636df6ae1ca64c/cryptography-46.0.3-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:01ca9ff2885f3acc98c29f1860552e37f6d7c7d013d7334ff2a9de43a449315d", size = 4450807, upload-time = "2025-10-15T23:16:56.414Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/0a/863a3604112174c8624a2ac3c038662d9e59970c7f926acdcfaed8d61142/cryptography-46.0.3-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:6eae65d4c3d33da080cff9c4ab1f711b15c1d9760809dad6ea763f3812d254cb", size = 4299615, upload-time = "2025-10-15T23:16:58.442Z" },
-    { url = "https://files.pythonhosted.org/packages/64/02/b73a533f6b64a69f3cd3872acb6ebc12aef924d8d103133bb3ea750dc703/cryptography-46.0.3-cp311-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5bf0ed4490068a2e72ac03d786693adeb909981cc596425d09032d372bcc849", size = 4016800, upload-time = "2025-10-15T23:17:00.378Z" },
-    { url = "https://files.pythonhosted.org/packages/25/d5/16e41afbfa450cde85a3b7ec599bebefaef16b5c6ba4ec49a3532336ed72/cryptography-46.0.3-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:5ecfccd2329e37e9b7112a888e76d9feca2347f12f37918facbb893d7bb88ee8", size = 4984707, upload-time = "2025-10-15T23:17:01.98Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/56/e7e69b427c3878352c2fb9b450bd0e19ed552753491d39d7d0a2f5226d41/cryptography-46.0.3-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a2c0cd47381a3229c403062f764160d57d4d175e022c1df84e168c6251a22eec", size = 4482541, upload-time = "2025-10-15T23:17:04.078Z" },
-    { url = "https://files.pythonhosted.org/packages/78/f6/50736d40d97e8483172f1bb6e698895b92a223dba513b0ca6f06b2365339/cryptography-46.0.3-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:549e234ff32571b1f4076ac269fcce7a808d3bf98b76c8dd560e42dbc66d7d91", size = 4299464, upload-time = "2025-10-15T23:17:05.483Z" },
-    { url = "https://files.pythonhosted.org/packages/00/de/d8e26b1a855f19d9994a19c702fa2e93b0456beccbcfe437eda00e0701f2/cryptography-46.0.3-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:c0a7bb1a68a5d3471880e264621346c48665b3bf1c3759d682fc0864c540bd9e", size = 4950838, upload-time = "2025-10-15T23:17:07.425Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/29/798fc4ec461a1c9e9f735f2fc58741b0daae30688f41b2497dcbc9ed1355/cryptography-46.0.3-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:10b01676fc208c3e6feeb25a8b83d81767e8059e1fe86e1dc62d10a3018fa926", size = 4481596, upload-time = "2025-10-15T23:17:09.343Z" },
-    { url = "https://files.pythonhosted.org/packages/15/8d/03cd48b20a573adfff7652b76271078e3045b9f49387920e7f1f631d125e/cryptography-46.0.3-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:0abf1ffd6e57c67e92af68330d05760b7b7efb243aab8377e583284dbab72c71", size = 4426782, upload-time = "2025-10-15T23:17:11.22Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/b1/ebacbfe53317d55cf33165bda24c86523497a6881f339f9aae5c2e13e57b/cryptography-46.0.3-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a04bee9ab6a4da801eb9b51f1b708a1b5b5c9eb48c03f74198464c66f0d344ac", size = 4698381, upload-time = "2025-10-15T23:17:12.829Z" },
-    { url = "https://files.pythonhosted.org/packages/73/dc/9aa866fbdbb95b02e7f9d086f1fccfeebf8953509b87e3f28fff927ff8a0/cryptography-46.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c8daeb2d2174beb4575b77482320303f3d39b8e81153da4f0fb08eb5fe86a6c5", size = 4288728, upload-time = "2025-10-15T23:17:21.527Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/fd/bc1daf8230eaa075184cbbf5f8cd00ba9db4fd32d63fb83da4671b72ed8a/cryptography-46.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:39b6755623145ad5eff1dab323f4eae2a32a77a7abef2c5089a04a3d04366715", size = 4435078, upload-time = "2025-10-15T23:17:23.042Z" },
-    { url = "https://files.pythonhosted.org/packages/82/98/d3bd5407ce4c60017f8ff9e63ffee4200ab3e23fe05b765cab805a7db008/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:db391fa7c66df6762ee3f00c95a89e6d428f4d60e7abc8328f4fe155b5ac6e54", size = 4293460, upload-time = "2025-10-15T23:17:24.885Z" },
-    { url = "https://files.pythonhosted.org/packages/26/e9/e23e7900983c2b8af7a08098db406cf989d7f09caea7897e347598d4cd5b/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:78a97cf6a8839a48c49271cdcbd5cf37ca2c1d6b7fdd86cc864f302b5e9bf459", size = 3995237, upload-time = "2025-10-15T23:17:26.449Z" },
-    { url = "https://files.pythonhosted.org/packages/91/15/af68c509d4a138cfe299d0d7ddb14afba15233223ebd933b4bbdbc7155d3/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:dfb781ff7eaa91a6f7fd41776ec37c5853c795d3b358d4896fdbb5df168af422", size = 4967344, upload-time = "2025-10-15T23:17:28.06Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/e3/8643d077c53868b681af077edf6b3cb58288b5423610f21c62aadcbe99f4/cryptography-46.0.3-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:6f61efb26e76c45c4a227835ddeae96d83624fb0d29eb5df5b96e14ed1a0afb7", size = 4466564, upload-time = "2025-10-15T23:17:29.665Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/43/c1e8726fa59c236ff477ff2b5dc071e54b21e5a1e51aa2cee1676f1c986f/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:23b1a8f26e43f47ceb6d6a43115f33a5a37d57df4ea0ca295b780ae8546e8044", size = 4292415, upload-time = "2025-10-15T23:17:31.686Z" },
-    { url = "https://files.pythonhosted.org/packages/42/f9/2f8fefdb1aee8a8e3256a0568cffc4e6d517b256a2fe97a029b3f1b9fe7e/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b419ae593c86b87014b9be7396b385491ad7f320bde96826d0dd174459e54665", size = 4931457, upload-time = "2025-10-15T23:17:33.478Z" },
-    { url = "https://files.pythonhosted.org/packages/79/30/9b54127a9a778ccd6d27c3da7563e9f2d341826075ceab89ae3b41bf5be2/cryptography-46.0.3-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:50fc3343ac490c6b08c0cf0d704e881d0d660be923fd3076db3e932007e726e3", size = 4466074, upload-time = "2025-10-15T23:17:35.158Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/68/b4f4a10928e26c941b1b6a179143af9f4d27d88fe84a6a3c53592d2e76bf/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:22d7e97932f511d6b0b04f2bfd818d73dcd5928db509460aaf48384778eb6d20", size = 4420569, upload-time = "2025-10-15T23:17:37.188Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/49/3746dab4c0d1979888f125226357d3262a6dd40e114ac29e3d2abdf1ec55/cryptography-46.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d55f3dffadd674514ad19451161118fd010988540cee43d8bc20675e775925de", size = 4681941, upload-time = "2025-10-15T23:17:39.236Z" },
-    { url = "https://files.pythonhosted.org/packages/27/32/b68d27471372737054cbd34c84981f9edbc24fe67ca225d389799614e27f/cryptography-46.0.3-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:4b7387121ac7d15e550f5cb4a43aef2559ed759c35df7336c402bb8275ac9683", size = 4294089, upload-time = "2025-10-15T23:17:48.269Z" },
-    { url = "https://files.pythonhosted.org/packages/26/42/fa8389d4478368743e24e61eea78846a0006caffaf72ea24a15159215a14/cryptography-46.0.3-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:15ab9b093e8f09daab0f2159bb7e47532596075139dd74365da52ecc9cb46c5d", size = 4440029, upload-time = "2025-10-15T23:17:49.837Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/eb/f483db0ec5ac040824f269e93dd2bd8a21ecd1027e77ad7bdf6914f2fd80/cryptography-46.0.3-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:46acf53b40ea38f9c6c229599a4a13f0d46a6c3fa9ef19fc1a124d62e338dfa0", size = 4297222, upload-time = "2025-10-15T23:17:51.357Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/cf/da9502c4e1912cb1da3807ea3618a6829bee8207456fbbeebc361ec38ba3/cryptography-46.0.3-cp38-abi3-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:10ca84c4668d066a9878890047f03546f3ae0a6b8b39b697457b7757aaf18dbc", size = 4012280, upload-time = "2025-10-15T23:17:52.964Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/8f/9adb86b93330e0df8b3dcf03eae67c33ba89958fc2e03862ef1ac2b42465/cryptography-46.0.3-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:36e627112085bb3b81b19fed209c05ce2a52ee8b15d161b7c643a7d5a88491f3", size = 4978958, upload-time = "2025-10-15T23:17:54.965Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/a0/5fa77988289c34bdb9f913f5606ecc9ada1adb5ae870bd0d1054a7021cc4/cryptography-46.0.3-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1000713389b75c449a6e979ffc7dcc8ac90b437048766cef052d4d30b8220971", size = 4473714, upload-time = "2025-10-15T23:17:56.754Z" },
-    { url = "https://files.pythonhosted.org/packages/14/e5/fc82d72a58d41c393697aa18c9abe5ae1214ff6f2a5c18ac470f92777895/cryptography-46.0.3-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:b02cf04496f6576afffef5ddd04a0cb7d49cf6be16a9059d793a30b035f6b6ac", size = 4296970, upload-time = "2025-10-15T23:17:58.588Z" },
-    { url = "https://files.pythonhosted.org/packages/78/06/5663ed35438d0b09056973994f1aec467492b33bd31da36e468b01ec1097/cryptography-46.0.3-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:71e842ec9bc7abf543b47cf86b9a743baa95f4677d22baa4c7d5c69e49e9bc04", size = 4940236, upload-time = "2025-10-15T23:18:00.897Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/59/873633f3f2dcd8a053b8dd1d38f783043b5fce589c0f6988bf55ef57e43e/cryptography-46.0.3-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:402b58fc32614f00980b66d6e56a5b4118e6cb362ae8f3fda141ba4689bd4506", size = 4472642, upload-time = "2025-10-15T23:18:02.749Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/39/8e71f3930e40f6877737d6f69248cf74d4e34b886a3967d32f919cc50d3b/cryptography-46.0.3-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:ef639cb3372f69ec44915fafcd6698b6cc78fbe0c2ea41be867f6ed612811963", size = 4423126, upload-time = "2025-10-15T23:18:04.85Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/c7/f65027c2810e14c3e7268353b1681932b87e5a48e65505d8cc17c99e36ae/cryptography-46.0.3-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:3b51b8ca4f1c6453d8829e1eb7299499ca7f313900dd4d89a24b8b87c0a780d4", size = 4686573, upload-time = "2025-10-15T23:18:06.908Z" },
-    { url = "https://files.pythonhosted.org/packages/da/38/f59940ec4ee91e93d3311f7532671a5cef5570eb04a144bf203b58552d11/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:191bb60a7be5e6f54e30ba16fdfae78ad3a342a0599eb4193ba88e3f3d6e185b", size = 4243992, upload-time = "2025-10-15T23:18:18.695Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/0c/35b3d92ddebfdfda76bb485738306545817253d0a3ded0bfe80ef8e67aa5/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:c70cc23f12726be8f8bc72e41d5065d77e4515efae3690326764ea1b07845cfb", size = 4409944, upload-time = "2025-10-15T23:18:20.597Z" },
-    { url = "https://files.pythonhosted.org/packages/99/55/181022996c4063fc0e7666a47049a1ca705abb9c8a13830f074edb347495/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:9394673a9f4de09e28b5356e7fff97d778f8abad85c9d5ac4a4b7e25a0de7717", size = 4242957, upload-time = "2025-10-15T23:18:22.18Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/af/72cd6ef29f9c5f731251acadaeb821559fe25f10852f44a63374c9ca08c1/cryptography-46.0.3-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:94cd0549accc38d1494e1f8de71eca837d0509d0d44bf11d158524b0e12cebf9", size = 4409447, upload-time = "2025-10-15T23:18:24.209Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/60/04/ee2a9e8542e4fa2773b81771ff8349ff19cdd56b7258a0cc442639052edb/cryptography-46.0.5.tar.gz", hash = "sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d", size = 750064, upload-time = "2026-02-10T19:18:38.255Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ff/9e/6b4397a3e3d15123de3b1806ef342522393d50736c13b20ec4c9ea6693a6/cryptography-46.0.5-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c18ff11e86df2e28854939acde2d003f7984f721eba450b56a200ad90eeb0e6b", size = 4275637, upload-time = "2026-02-10T19:17:10.53Z" },
+    { url = "https://files.pythonhosted.org/packages/63/e7/471ab61099a3920b0c77852ea3f0ea611c9702f651600397ac567848b897/cryptography-46.0.5-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4d7e3d356b8cd4ea5aff04f129d5f66ebdc7b6f8eae802b93739ed520c47c79b", size = 4424742, upload-time = "2026-02-10T19:17:12.388Z" },
+    { url = "https://files.pythonhosted.org/packages/37/53/a18500f270342d66bf7e4d9f091114e31e5ee9e7375a5aba2e85a91e0044/cryptography-46.0.5-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:50bfb6925eff619c9c023b967d5b77a54e04256c4281b0e21336a130cd7fc263", size = 4277528, upload-time = "2026-02-10T19:17:13.853Z" },
+    { url = "https://files.pythonhosted.org/packages/22/29/c2e812ebc38c57b40e7c583895e73c8c5adb4d1e4a0cc4c5a4fdab2b1acc/cryptography-46.0.5-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:803812e111e75d1aa73690d2facc295eaefd4439be1023fefc4995eaea2af90d", size = 4947993, upload-time = "2026-02-10T19:17:15.618Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/e7/237155ae19a9023de7e30ec64e5d99a9431a567407ac21170a046d22a5a3/cryptography-46.0.5-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ee190460e2fbe447175cda91b88b84ae8322a104fc27766ad09428754a618ed", size = 4456855, upload-time = "2026-02-10T19:17:17.221Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/87/fc628a7ad85b81206738abbd213b07702bcbdada1dd43f72236ef3cffbb5/cryptography-46.0.5-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:f145bba11b878005c496e93e257c1e88f154d278d2638e6450d17e0f31e558d2", size = 3984635, upload-time = "2026-02-10T19:17:18.792Z" },
+    { url = "https://files.pythonhosted.org/packages/84/29/65b55622bde135aedf4565dc509d99b560ee4095e56989e815f8fd2aa910/cryptography-46.0.5-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:e9251e3be159d1020c4030bd2e5f84d6a43fe54b6c19c12f51cde9542a2817b2", size = 4277038, upload-time = "2026-02-10T19:17:20.256Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/36/45e76c68d7311432741faf1fbf7fac8a196a0a735ca21f504c75d37e2558/cryptography-46.0.5-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:47fb8a66058b80e509c47118ef8a75d14c455e81ac369050f20ba0d23e77fee0", size = 4912181, upload-time = "2026-02-10T19:17:21.825Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/1a/c1ba8fead184d6e3d5afcf03d569acac5ad063f3ac9fb7258af158f7e378/cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:4c3341037c136030cb46e4b1e17b7418ea4cbd9dd207e4a6f3b2b24e0d4ac731", size = 4456482, upload-time = "2026-02-10T19:17:25.133Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/e5/3fb22e37f66827ced3b902cf895e6a6bc1d095b5b26be26bd13c441fdf19/cryptography-46.0.5-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:890bcb4abd5a2d3f852196437129eb3667d62630333aacc13dfd470fad3aaa82", size = 4405497, upload-time = "2026-02-10T19:17:26.66Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/df/9d58bb32b1121a8a2f27383fabae4d63080c7ca60b9b5c88be742be04ee7/cryptography-46.0.5-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:80a8d7bfdf38f87ca30a5391c0c9ce4ed2926918e017c29ddf643d0ed2778ea1", size = 4667819, upload-time = "2026-02-10T19:17:28.569Z" },
+    { url = "https://files.pythonhosted.org/packages/67/c8/581a6702e14f0898a0848105cbefd20c058099e2c2d22ef4e476dfec75d7/cryptography-46.0.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5be7bf2fb40769e05739dd0046e7b26f9d4670badc7b032d6ce4db64dddc0678", size = 4265728, upload-time = "2026-02-10T19:17:35.569Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/4a/ba1a65ce8fc65435e5a849558379896c957870dd64fecea97b1ad5f46a37/cryptography-46.0.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe346b143ff9685e40192a4960938545c699054ba11d4f9029f94751e3f71d87", size = 4408287, upload-time = "2026-02-10T19:17:36.938Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/67/8ffdbf7b65ed1ac224d1c2df3943553766914a8ca718747ee3871da6107e/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:c69fd885df7d089548a42d5ec05be26050ebcd2283d89b3d30676eb32ff87dee", size = 4270291, upload-time = "2026-02-10T19:17:38.748Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/e5/f52377ee93bc2f2bba55a41a886fd208c15276ffbd2569f2ddc89d50e2c5/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:8293f3dea7fc929ef7240796ba231413afa7b68ce38fd21da2995549f5961981", size = 4927539, upload-time = "2026-02-10T19:17:40.241Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/02/cfe39181b02419bbbbcf3abdd16c1c5c8541f03ca8bda240debc467d5a12/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:1abfdb89b41c3be0365328a410baa9df3ff8a9110fb75e7b52e66803ddabc9a9", size = 4442199, upload-time = "2026-02-10T19:17:41.789Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/96/2fcaeb4873e536cf71421a388a6c11b5bc846e986b2b069c79363dc1648e/cryptography-46.0.5-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:d66e421495fdb797610a08f43b05269e0a5ea7f5e652a89bfd5a7d3c1dee3648", size = 3960131, upload-time = "2026-02-10T19:17:43.379Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/d2/b27631f401ddd644e94c5cf33c9a4069f72011821cf3dc7309546b0642a0/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:4e817a8920bfbcff8940ecfd60f23d01836408242b30f1a708d93198393a80b4", size = 4270072, upload-time = "2026-02-10T19:17:45.481Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/a7/60d32b0370dae0b4ebe55ffa10e8599a2a59935b5ece1b9f06edb73abdeb/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:68f68d13f2e1cb95163fa3b4db4bf9a159a418f5f6e7242564fc75fcae667fd0", size = 4892170, upload-time = "2026-02-10T19:17:46.997Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/b9/cf73ddf8ef1164330eb0b199a589103c363afa0cf794218c24d524a58eab/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a3d1fae9863299076f05cb8a778c467578262fae09f9dc0ee9b12eb4268ce663", size = 4441741, upload-time = "2026-02-10T19:17:48.661Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/eb/eee00b28c84c726fe8fa0158c65afe312d9c3b78d9d01daf700f1f6e37ff/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c4143987a42a2397f2fc3b4d7e3a7d313fbe684f67ff443999e803dd75a76826", size = 4396728, upload-time = "2026-02-10T19:17:50.058Z" },
+    { url = "https://files.pythonhosted.org/packages/65/f4/6bc1a9ed5aef7145045114b75b77c2a8261b4d38717bd8dea111a63c3442/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7d731d4b107030987fd61a7f8ab512b25b53cef8f233a97379ede116f30eb67d", size = 4652001, upload-time = "2026-02-10T19:17:51.54Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/04/c85bdeab78c8bc77b701bf0d9bdcf514c044e18a46dcff330df5448631b0/cryptography-46.0.5-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1f30a86d2757199cb2d56e48cce14deddf1f9c95f1ef1b64ee91ea43fe2e18", size = 4275349, upload-time = "2026-02-10T19:17:58.419Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/32/9b87132a2f91ee7f5223b091dc963055503e9b442c98fc0b8a5ca765fab0/cryptography-46.0.5-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:039917b0dc418bb9f6edce8a906572d69e74bd330b0b3fea4f79dab7f8ddd235", size = 4420667, upload-time = "2026-02-10T19:18:00.619Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/a6/a7cb7010bec4b7c5692ca6f024150371b295ee1c108bdc1c400e4c44562b/cryptography-46.0.5-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ba2a27ff02f48193fc4daeadf8ad2590516fa3d0adeeb34336b96f7fa64c1e3a", size = 4276980, upload-time = "2026-02-10T19:18:02.379Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/7c/c4f45e0eeff9b91e3f12dbd0e165fcf2a38847288fcfd889deea99fb7b6d/cryptography-46.0.5-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:61aa400dce22cb001a98014f647dc21cda08f7915ceb95df0c9eaf84b4b6af76", size = 4939143, upload-time = "2026-02-10T19:18:03.964Z" },
+    { url = "https://files.pythonhosted.org/packages/37/19/e1b8f964a834eddb44fa1b9a9976f4e414cbb7aa62809b6760c8803d22d1/cryptography-46.0.5-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ce58ba46e1bc2aac4f7d9290223cead56743fa6ab94a5d53292ffaac6a91614", size = 4453674, upload-time = "2026-02-10T19:18:05.588Z" },
+    { url = "https://files.pythonhosted.org/packages/db/ed/db15d3956f65264ca204625597c410d420e26530c4e2943e05a0d2f24d51/cryptography-46.0.5-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:420d0e909050490d04359e7fdb5ed7e667ca5c3c402b809ae2563d7e66a92229", size = 3978801, upload-time = "2026-02-10T19:18:07.167Z" },
+    { url = "https://files.pythonhosted.org/packages/41/e2/df40a31d82df0a70a0daf69791f91dbb70e47644c58581d654879b382d11/cryptography-46.0.5-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:582f5fcd2afa31622f317f80426a027f30dc792e9c80ffee87b993200ea115f1", size = 4276755, upload-time = "2026-02-10T19:18:09.813Z" },
+    { url = "https://files.pythonhosted.org/packages/33/45/726809d1176959f4a896b86907b98ff4391a8aa29c0aaaf9450a8a10630e/cryptography-46.0.5-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:bfd56bb4b37ed4f330b82402f6f435845a5f5648edf1ad497da51a8452d5d62d", size = 4901539, upload-time = "2026-02-10T19:18:11.263Z" },
+    { url = "https://files.pythonhosted.org/packages/99/0f/a3076874e9c88ecb2ecc31382f6e7c21b428ede6f55aafa1aa272613e3cd/cryptography-46.0.5-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:a3d507bb6a513ca96ba84443226af944b0f7f47dcc9a399d110cd6146481d24c", size = 4452794, upload-time = "2026-02-10T19:18:12.914Z" },
+    { url = "https://files.pythonhosted.org/packages/02/ef/ffeb542d3683d24194a38f66ca17c0a4b8bf10631feef44a7ef64e631b1a/cryptography-46.0.5-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9f16fbdf4da055efb21c22d81b89f155f02ba420558db21288b3d0035bafd5f4", size = 4404160, upload-time = "2026-02-10T19:18:14.375Z" },
+    { url = "https://files.pythonhosted.org/packages/96/93/682d2b43c1d5f1406ed048f377c0fc9fc8f7b0447a478d5c65ab3d3a66eb/cryptography-46.0.5-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ced80795227d70549a411a4ab66e8ce307899fad2220ce5ab2f296e687eacde9", size = 4667123, upload-time = "2026-02-10T19:18:15.886Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/6f/6cc6cc9955caa6eaf83660b0da2b077c7fe8ff9950a3c5e45d605038d439/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:bc84e875994c3b445871ea7181d424588171efec3e185dced958dad9e001950a", size = 4218321, upload-time = "2026-02-10T19:18:22.349Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/5d/c4da701939eeee699566a6c1367427ab91a8b7088cc2328c09dbee940415/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:2ae6971afd6246710480e3f15824ed3029a60fc16991db250034efd0b9fb4356", size = 4381786, upload-time = "2026-02-10T19:18:24.529Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/97/a538654732974a94ff96c1db621fa464f455c02d4bb7d2652f4edc21d600/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:d861ee9e76ace6cf36a6a89b959ec08e7bc2493ee39d07ffe5acb23ef46d27da", size = 4217990, upload-time = "2026-02-10T19:18:25.957Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/11/7e500d2dd3ba891197b9efd2da5454b74336d64a7cc419aa7327ab74e5f6/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:2b7a67c9cd56372f3249b39699f2ad479f6991e62ea15800973b956f4b73e257", size = 4381252, upload-time = "2026-02-10T19:18:27.496Z" },
 ]
 
 [[package]]
@@ -1263,7 +1263,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.69"
+version = "2.2.72"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 58ccdefa966ddf1559e308d6fd62656bd659cf4a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:04:01 -0800
Subject: [PATCH 25/80] Bump virtualenv from 20.35.4 to 20.36.1 (#150)

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 20.35.4 to 20.36.1.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/20.35.4...20.36.1)

---
updated-dependencies:
- dependency-name: virtualenv
  dependency-version: 20.36.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/uv.lock b/uv.lock
index 0ee3327..7c1bb54 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1488,7 +1488,7 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "20.35.4"
+version = "20.36.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
@@ -1496,9 +1496,9 @@ dependencies = [
     { name = "platformdirs" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/20/28/e6f1a6f655d620846bd9df527390ecc26b3805a0c5989048c210e22c5ca9/virtualenv-20.35.4.tar.gz", hash = "sha256:643d3914d73d3eeb0c552cbb12d7e82adf0e504dbf86a3182f8771a153a1971c", size = 6028799, upload-time = "2025-10-29T06:57:40.511Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz", hash = "sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba", size = 6032239, upload-time = "2026-01-09T18:21:01.296Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/79/0c/c05523fa3181fdf0c9c52a6ba91a23fbf3246cc095f26f6516f9c60e6771/virtualenv-20.35.4-py3-none-any.whl", hash = "sha256:c21c9cede36c9753eeade68ba7d523529f228a403463376cf821eaae2b650f1b", size = 6005095, upload-time = "2025-10-29T06:57:37.598Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/2a/dc2228b2888f51192c7dc766106cd475f1b768c10caaf9727659726f7391/virtualenv-20.36.1-py3-none-any.whl", hash = "sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f", size = 6008258, upload-time = "2026-01-09T18:20:59.425Z" },
 ]
 
 [[package]]

From 51d9b7af50dc98a47dc014019620569092194160 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:08:02 -0800
Subject: [PATCH 26/80] Bump filelock from 3.20.1 to 3.20.3 (#151)

Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.20.1 to 3.20.3.
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/py-filelock/compare/3.20.1...3.20.3)

---
updated-dependencies:
- dependency-name: filelock
  dependency-version: 3.20.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/uv.lock b/uv.lock
index 7c1bb54..1403e59 100644
--- a/uv.lock
+++ b/uv.lock
@@ -536,11 +536,11 @@ wheels = [
 
 [[package]]
 name = "filelock"
-version = "3.20.1"
+version = "3.20.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a7/23/ce7a1126827cedeb958fc043d61745754464eb56c5937c35bbf2b8e26f34/filelock-3.20.1.tar.gz", hash = "sha256:b8360948b351b80f420878d8516519a2204b07aefcdcfd24912a5d33127f188c", size = 19476, upload-time = "2025-12-15T23:54:28.027Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1d/65/ce7f1b70157833bf3cb851b556a37d4547ceafc158aa9b34b36782f23696/filelock-3.20.3.tar.gz", hash = "sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1", size = 19485, upload-time = "2026-01-09T17:55:05.421Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/7f/a1a97644e39e7316d850784c642093c99df1290a460df4ede27659056834/filelock-3.20.1-py3-none-any.whl", hash = "sha256:15d9e9a67306188a44baa72f569d2bfd803076269365fdea0934385da4dc361a", size = 16666, upload-time = "2025-12-15T23:54:26.874Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/36/7fb70f04bf00bc646cd5bb45aa9eddb15e19437a28b8fb2b4a5249fac770/filelock-3.20.3-py3-none-any.whl", hash = "sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1", size = 16701, upload-time = "2026-01-09T17:55:04.334Z" },
 ]
 
 [[package]]

From 4a52594ba316d00ec06c9ba5f31679dc09cb0a6a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:08:59 -0800
Subject: [PATCH 27/80] Bump urllib3 from 2.6.2 to 2.6.3 (#152)

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.2 to 2.6.3.
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](https://github.com/urllib3/urllib3/compare/2.6.2...2.6.3)

---
updated-dependencies:
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/uv.lock b/uv.lock
index 1403e59..1d97674 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1441,11 +1441,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.2"
+version = "2.6.3"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1e/24/a2a2ed9addd907787d7aa0355ba36a6cadf1768b934c652ea78acbd59dcd/urllib3-2.6.2.tar.gz", hash = "sha256:016f9c98bb7e98085cb2b4b17b87d2c702975664e4f060c6532e64d1c1a5e797", size = 432930, upload-time = "2025-12-11T15:56:40.252Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6d/b9/4095b668ea3678bf6a0af005527f39de12fb026516fb3df17495a733b7f8/urllib3-2.6.2-py3-none-any.whl", hash = "sha256:ec21cddfe7724fc7cb4ba4bea7aa8e2ef36f607a4bab81aa6ce42a13dc3f03dd", size = 131182, upload-time = "2025-12-11T15:56:38.584Z" },
+    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
 ]
 
 [[package]]

From 2e5472b0e13c31a149b06cb4054f71168756d3cb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:10:52 -0800
Subject: [PATCH 28/80] Bump lodash from 4.17.21 to 4.17.23 in
 /tests/e2e/fixtures/simple-npm (#157)

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.21...4.17.23)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.17.23
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 tests/e2e/fixtures/simple-npm/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
index 49c2304..5e32f1a 100644
--- a/tests/e2e/fixtures/simple-npm/package.json
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -4,7 +4,7 @@
   "description": "Test fixture for reachability analysis",
   "main": "index.js",
   "dependencies": {
-    "lodash": "4.17.21",
+    "lodash": "4.17.23",
     "express": "4.18.2",
     "axios": "1.4.0"
   },

From 4397493f3be2fc82afd38e43d8954963959acd76 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:14:43 -0800
Subject: [PATCH 29/80] Bump express from 4.18.2 to 4.22.0 in
 /tests/e2e/fixtures/simple-npm (#158)

Bumps [express](https://github.com/expressjs/express) from 4.18.2 to 4.22.0.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/4.22.0/History.md)
- [Commits](https://github.com/expressjs/express/compare/4.18.2...4.22.0)

---
updated-dependencies:
- dependency-name: express
  dependency-version: 4.22.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 tests/e2e/fixtures/simple-npm/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
index 5e32f1a..be36de3 100644
--- a/tests/e2e/fixtures/simple-npm/package.json
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -5,7 +5,7 @@
   "main": "index.js",
   "dependencies": {
     "lodash": "4.17.23",
-    "express": "4.18.2",
+    "express": "4.22.0",
     "axios": "1.4.0"
   },
   "devDependencies": {

From 78d66a48dd5755bd45576c99933cbf945e481eb8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 24 Feb 2026 19:17:44 -0800
Subject: [PATCH 30/80] Bump axios from 1.4.0 to 1.13.5 in
 /tests/e2e/fixtures/simple-npm (#160)

Bumps [axios](https://github.com/axios/axios) from 1.4.0 to 1.13.5.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.4.0...v1.13.5)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.13.5
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 tests/e2e/fixtures/simple-npm/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
index be36de3..cf70416 100644
--- a/tests/e2e/fixtures/simple-npm/package.json
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -6,7 +6,7 @@
   "dependencies": {
     "lodash": "4.17.23",
     "express": "4.22.0",
-    "axios": "1.4.0"
+    "axios": "1.13.5"
   },
   "devDependencies": {
     "typescript": "5.0.4",

From b3fdd33bb4ad3af9932068595aab9864faa8bcfb Mon Sep 17 00:00:00 2001
From: jonathanStrange0 <44637027+jonathanStrange0@users.noreply.github.com>
Date: Thu, 26 Feb 2026 11:56:36 -0500
Subject: [PATCH 31/80] Mucha/gitlab branch protection flag (#163)

* added ability to prevent merges based on failed check run

* updated json format for gitlab api call

* fix: use source branch SHA for commit status, log response body

CI_COMMIT_SHA may be synthetic in merged-results pipelines.
Prefer CI_MERGE_REQUEST_SOURCE_BRANCH_SHA when available.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use context instead of name for commit status

GitLab rejects duplicate name field; context allows updates.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: add ref and pipeline_id to commit status payload

GitLab uses (sha, name, ref) as unique key. Without ref,
re-runs fail with "name has already been taken".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: drop pipeline_id from commit status payload

pipeline_id causes 404 when sha/ref don't match the pipeline.
ref alone is sufficient for uniqueness.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* renaming the commit status

* Add enable_merge_pipeline_check() to enforce pipelines-must-succeed via API

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* chore: update uv.lock version to 2.2.73

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Jonathan Mucha <jonathan@mucha.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Douglas <douglas@socket.dev>
---
 instructions/gitlab-commit-status/uat.md |  54 +++++++
 pyproject.toml                           |   2 +-
 socketsecurity/__init__.py               |   2 +-
 socketsecurity/config.py                 |  14 ++
 socketsecurity/core/scm/gitlab.py        |  68 ++++++++-
 socketsecurity/socketcli.py              |  15 ++
 tests/unit/test_gitlab_commit_status.py  | 184 +++++++++++++++++++++++
 7 files changed, 336 insertions(+), 3 deletions(-)
 create mode 100644 instructions/gitlab-commit-status/uat.md
 create mode 100644 tests/unit/test_gitlab_commit_status.py

diff --git a/instructions/gitlab-commit-status/uat.md b/instructions/gitlab-commit-status/uat.md
new file mode 100644
index 0000000..f3b62a8
--- /dev/null
+++ b/instructions/gitlab-commit-status/uat.md
@@ -0,0 +1,54 @@
+# UAT: GitLab Commit Status Integration
+
+## Feature
+`--enable-commit-status` posts a commit status (`success`/`failed`) to GitLab after scan completes. Repo admins can then require `socket-security` as a status check on protected branches.
+
+## Prerequisites
+- GitLab project with CI/CD configured
+- `GITLAB_TOKEN` with `api` scope (or `CI_JOB_TOKEN` with sufficient permissions)
+- Merge request pipeline (so `CI_MERGE_REQUEST_PROJECT_ID` is set)
+
+## Test Cases
+
+### 1. Pass scenario (no blocking alerts)
+1. Create MR with no dependency changes (or only safe ones)
+2. Run: `socketcli --scm gitlab --enable-commit-status`
+3. **Expected**: Commit status `socket-security` = `success`, description = "No blocking issues"
+4. Verify in GitLab: **Repository > Commits > (sha) > Pipelines** or **MR > Pipeline > External** tab
+
+### 2. Fail scenario (blocking alerts)
+1. Create MR adding a package with known blocking alerts
+2. Run: `socketcli --scm gitlab --enable-commit-status`
+3. **Expected**: Commit status = `failed`, description = "N blocking alert(s) found"
+
+### 3. Flag omitted (default off)
+1. Run: `socketcli --scm gitlab` (no `--enable-commit-status`)
+2. **Expected**: No commit status posted
+
+### 4. Non-MR pipeline (push event without MR)
+1. Trigger pipeline on a push (no MR context)
+2. Run: `socketcli --scm gitlab --enable-commit-status`
+3. **Expected**: Commit status skipped (no `mr_project_id`), no error
+
+### 5. API failure is non-fatal
+1. Use an invalid/revoked `GITLAB_TOKEN`
+2. Run: `socketcli --scm gitlab --enable-commit-status`
+3. **Expected**: Error logged ("Failed to set commit status: ..."), scan still completes with correct exit code
+
+### 6. Non-GitLab SCM
+1. Run: `socketcli --scm github --enable-commit-status`
+2. **Expected**: Flag is accepted but commit status is not posted (GitHub not yet supported)
+
+## Blocking Merges on Failure
+
+### Option A: Pipelines must succeed (all GitLab tiers)
+Since `socketcli` exits with code 1 when blocking alerts are found, the pipeline fails automatically.
+1. Go to **Settings > General > Merge requests**
+2. Under **Merge checks**, enable **"Pipelines must succeed"**
+3. Save — GitLab will now prevent merging when the pipeline fails
+
+### Option B: External status checks (GitLab Ultimate only)
+Use the `socket-security` commit status as a required external check.
+1. Go to **Settings > General > Merge requests > Status checks**
+2. Add an external status check with name `socket-security`
+3. MRs will require Socket's `success` status to merge
diff --git a/pyproject.toml b/pyproject.toml
index ce3bb6c..4b1a3b6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.72"
+version = "2.2.73"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 7dd23bc..5993712 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.72'
+__version__ = '2.2.73'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 5105281..7a94aca 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -86,6 +86,7 @@ class CliConfig:
     only_facts_file: bool = False
     reach_use_only_pregenerated_sboms: bool = False
     max_purl_batch_size: int = 5000
+    enable_commit_status: bool = False
     
     @classmethod
     def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
@@ -164,6 +165,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'only_facts_file': args.only_facts_file,
             'reach_use_only_pregenerated_sboms': args.reach_use_only_pregenerated_sboms,
             'max_purl_batch_size': args.max_purl_batch_size,
+            'enable_commit_status': args.enable_commit_status,
             'version': __version__
         }
         try:
@@ -512,6 +514,18 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=argparse.SUPPRESS
     )
+    output_group.add_argument(
+        "--enable-commit-status",
+        dest="enable_commit_status",
+        action="store_true",
+        help="Report scan result as a commit status on GitLab (requires GitLab SCM)"
+    )
+    output_group.add_argument(
+        "--enable_commit_status",
+        dest="enable_commit_status",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
 
     # Plugin Configuration
     plugin_group = parser.add_argument_group('Plugin Configuration')
diff --git a/socketsecurity/core/scm/gitlab.py b/socketsecurity/core/scm/gitlab.py
index 70abf50..e88e050 100644
--- a/socketsecurity/core/scm/gitlab.py
+++ b/socketsecurity/core/scm/gitlab.py
@@ -47,8 +47,15 @@ def from_env(cls) -> 'GitlabConfig':
         # Determine which authentication pattern to use
         headers = cls._get_auth_headers(token)
 
+        # Prefer source branch SHA (real commit) over CI_COMMIT_SHA which
+        # may be a synthetic merge-result commit in merged-results pipelines.
+        commit_sha = (
+            os.getenv('CI_MERGE_REQUEST_SOURCE_BRANCH_SHA') or
+            os.getenv('CI_COMMIT_SHA', '')
+        )
+
         return cls(
-            commit_sha=os.getenv('CI_COMMIT_SHA', ''),
+            commit_sha=commit_sha,
             api_url=os.getenv('CI_API_V4_URL', ''),
             project_dir=os.getenv('CI_PROJECT_DIR', ''),
             mr_source_branch=mr_source_branch,
@@ -260,6 +267,65 @@ def add_socket_comments(
                 log.debug("No Previous version of Security Issue comment, posting")
                 self.post_comment(security_comment)
 
+    def enable_merge_pipeline_check(self) -> None:
+        """Enable 'only_allow_merge_if_pipeline_succeeds' on the MR target project."""
+        if not self.config.mr_project_id:
+            return
+        url = f"{self.config.api_url}/projects/{self.config.mr_project_id}"
+        try:
+            resp = requests.put(
+                url,
+                json={"only_allow_merge_if_pipeline_succeeds": True},
+                headers=self.config.headers,
+            )
+            if resp.status_code == 401:
+                fallback = self._get_fallback_headers(self.config.headers)
+                if fallback:
+                    resp = requests.put(
+                        url,
+                        json={"only_allow_merge_if_pipeline_succeeds": True},
+                        headers=fallback,
+                    )
+            if resp.status_code >= 400:
+                log.error(f"GitLab enable merge check API {resp.status_code}: {resp.text}")
+            else:
+                log.info("Enabled 'pipelines must succeed' merge check on project")
+        except Exception as e:
+            log.error(f"Failed to enable merge pipeline check: {e}")
+
+    def set_commit_status(self, state: str, description: str, target_url: str = '') -> None:
+        """Post a commit status to GitLab. state should be 'success' or 'failed'.
+
+        Uses requests.post with json= directly because CliClient.request sends
+        data= (form-encoded) which GitLab's commit status endpoint rejects.
+        """
+        if not self.config.mr_project_id:
+            log.debug("No mr_project_id, skipping commit status")
+            return
+        url = f"{self.config.api_url}/projects/{self.config.mr_project_id}/statuses/{self.config.commit_sha}"
+        payload = {
+            "state": state,
+            "context": "socket-security-commit-status",
+            "description": description,
+        }
+        if self.config.mr_source_branch:
+            payload["ref"] = self.config.mr_source_branch
+        if target_url:
+            payload["target_url"] = target_url
+        try:
+            log.debug(f"Posting commit status to {url}")
+            resp = requests.post(url, json=payload, headers=self.config.headers)
+            if resp.status_code == 401:
+                fallback = self._get_fallback_headers(self.config.headers)
+                if fallback:
+                    resp = requests.post(url, json=payload, headers=fallback)
+            if resp.status_code >= 400:
+                log.error(f"GitLab commit status API {resp.status_code}: {resp.text}")
+            resp.raise_for_status()
+            log.info(f"Commit status set to '{state}' on {self.config.commit_sha[:8]}")
+        except Exception as e:
+            log.error(f"Failed to set commit status: {e}")
+
     def remove_comment_alerts(self, comments: dict):
         security_alert = comments.get("security")
         if security_alert is not None:
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 194da44..f4ac6c8 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -641,6 +641,21 @@ def main_code():
             log.debug("Temporarily enabling disable_blocking due to no supported manifest files")
             config.disable_blocking = True
 
+    # Post commit status to GitLab if enabled
+    if config.enable_commit_status and scm is not None:
+        from socketsecurity.core.scm.gitlab import Gitlab
+        if isinstance(scm, Gitlab) and scm.config.mr_project_id:
+            scm.enable_merge_pipeline_check()
+            passed = output_handler.report_pass(diff)
+            state = "success" if passed else "failed"
+            blocking_count = sum(1 for a in diff.new_alerts if a.error)
+            if passed:
+                description = "No blocking issues"
+            else:
+                description = f"{blocking_count} blocking alert(s) found"
+            target_url = diff.report_url or diff.diff_url or ""
+            scm.set_commit_status(state, description, target_url)
+
     sys.exit(output_handler.return_exit_code(diff))
 
 
diff --git a/tests/unit/test_gitlab_commit_status.py b/tests/unit/test_gitlab_commit_status.py
new file mode 100644
index 0000000..fc57ed6
--- /dev/null
+++ b/tests/unit/test_gitlab_commit_status.py
@@ -0,0 +1,184 @@
+"""Tests for GitLab commit status integration"""
+import os
+import pytest
+from unittest.mock import patch, MagicMock, call
+
+from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
+
+
+def _make_gitlab_config(**overrides):
+    defaults = dict(
+        commit_sha="abc123def456",
+        api_url="https://gitlab.example.com/api/v4",
+        project_dir="/builds/test",
+        mr_source_branch="feature",
+        mr_iid="42",
+        mr_project_id="99",
+        commit_message="test commit",
+        default_branch="main",
+        project_name="test-project",
+        pipeline_source="merge_request_event",
+        commit_author="dev@example.com",
+        token="glpat-test",
+        repository="test-project",
+        is_default_branch=False,
+        headers={"Authorization": "Bearer glpat-test", "accept": "application/json"},
+    )
+    defaults.update(overrides)
+    return GitlabConfig(**defaults)
+
+
+class TestSetCommitStatus:
+    """Test Gitlab.set_commit_status()"""
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_calls_correct_url_and_json_payload(self, mock_post):
+        mock_post.return_value = MagicMock(status_code=200)
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.set_commit_status("success", "No blocking issues", "https://app.socket.dev/report/123")
+
+        mock_post.assert_called_once_with(
+            "https://gitlab.example.com/api/v4/projects/99/statuses/abc123def456",
+            json={
+                "state": "success",
+                "context": "socket-security-commit-status",
+                "description": "No blocking issues",
+                "ref": "feature",
+                "target_url": "https://app.socket.dev/report/123",
+            },
+            headers=config.headers,
+        )
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_failed_state_payload(self, mock_post):
+        mock_post.return_value = MagicMock(status_code=200)
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.set_commit_status("failed", "3 blocking alert(s) found")
+
+        payload = mock_post.call_args.kwargs["json"]
+        assert payload["state"] == "failed"
+        assert payload["description"] == "3 blocking alert(s) found"
+        assert "target_url" not in payload
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_skipped_when_no_mr_project_id(self, mock_post):
+        config = _make_gitlab_config(mr_project_id=None)
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.set_commit_status("success", "No blocking issues")
+
+        mock_post.assert_not_called()
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_graceful_error_handling(self, mock_post):
+        mock_post.side_effect = Exception("connection error")
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        # Should not raise
+        gl.set_commit_status("success", "No blocking issues")
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_no_target_url_omitted_from_payload(self, mock_post):
+        mock_post.return_value = MagicMock(status_code=200)
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.set_commit_status("success", "No blocking issues", target_url="")
+
+        payload = mock_post.call_args.kwargs["json"]
+        assert "target_url" not in payload
+
+    @patch("socketsecurity.core.scm.gitlab.requests.post")
+    def test_auth_fallback_on_401(self, mock_post):
+        resp_401 = MagicMock(status_code=401)
+        resp_401.raise_for_status.side_effect = Exception("401")
+        resp_200 = MagicMock(status_code=200)
+        mock_post.side_effect = [resp_401, resp_200]
+
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.set_commit_status("success", "No blocking issues")
+
+        assert mock_post.call_count == 2
+        # Second call should use fallback headers (PRIVATE-TOKEN)
+        fallback_headers = mock_post.call_args_list[1].kwargs["headers"]
+        assert "PRIVATE-TOKEN" in fallback_headers
+
+
+class TestEnableMergePipelineCheck:
+    """Test Gitlab.enable_merge_pipeline_check()"""
+
+    @patch("socketsecurity.core.scm.gitlab.requests.put")
+    def test_calls_correct_url_and_payload(self, mock_put):
+        mock_put.return_value = MagicMock(status_code=200)
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.enable_merge_pipeline_check()
+
+        mock_put.assert_called_once_with(
+            "https://gitlab.example.com/api/v4/projects/99",
+            json={"only_allow_merge_if_pipeline_succeeds": True},
+            headers=config.headers,
+        )
+
+    @patch("socketsecurity.core.scm.gitlab.requests.put")
+    def test_skipped_when_no_mr_project_id(self, mock_put):
+        config = _make_gitlab_config(mr_project_id=None)
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.enable_merge_pipeline_check()
+
+        mock_put.assert_not_called()
+
+    @patch("socketsecurity.core.scm.gitlab.requests.put")
+    def test_auth_fallback_on_401(self, mock_put):
+        resp_401 = MagicMock(status_code=401)
+        resp_200 = MagicMock(status_code=200)
+        mock_put.side_effect = [resp_401, resp_200]
+
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        gl.enable_merge_pipeline_check()
+
+        assert mock_put.call_count == 2
+        fallback_headers = mock_put.call_args_list[1].kwargs["headers"]
+        assert "PRIVATE-TOKEN" in fallback_headers
+
+    @patch("socketsecurity.core.scm.gitlab.requests.put")
+    def test_graceful_error_handling(self, mock_put):
+        mock_put.side_effect = Exception("connection error")
+        config = _make_gitlab_config()
+        gl = Gitlab(client=MagicMock(), config=config)
+
+        # Should not raise
+        gl.enable_merge_pipeline_check()
+
+
+class TestEnableCommitStatusCliArg:
+    """Test --enable-commit-status CLI argument parsing"""
+
+    def test_default_is_false(self):
+        from socketsecurity.config import create_argument_parser
+        parser = create_argument_parser()
+        args = parser.parse_args([])
+        assert args.enable_commit_status is False
+
+    def test_flag_sets_true(self):
+        from socketsecurity.config import create_argument_parser
+        parser = create_argument_parser()
+        args = parser.parse_args(["--enable-commit-status"])
+        assert args.enable_commit_status is True
+
+    def test_underscore_alias(self):
+        from socketsecurity.config import create_argument_parser
+        parser = create_argument_parser()
+        args = parser.parse_args(["--enable_commit_status"])
+        assert args.enable_commit_status is True

From ceb35728eaeb7437df321362128da9c4a20c0745 Mon Sep 17 00:00:00 2001
From: lelia <le1ia@me.com>
Date: Thu, 26 Feb 2026 12:26:05 -0500
Subject: [PATCH 32/80] Add `workspace` flag to CLI args (#164)

* Add support for --workspace flag

Signed-off-by: lelia <lelia@socket.dev>

* Add tests to cover new workspace CLI args

Signed-off-by: lelia <lelia@socket.dev>

* Update README to document new CLI flag, and differentiate it from existing workspace-name flag

Signed-off-by: lelia <lelia@socket.dev>

* Update refs to use generic project names

Signed-off-by: lelia <lelia@socket.dev>

* Bump CLI version

Signed-off-by: lelia <lelia@socket.dev>

* Pin python and virtualenv versions to unblock builds

Signed-off-by: lelia <lelia@socket.dev>

* Bump published SDK version refs

Signed-off-by: lelia <lelia@socket.dev>

* Tweak helper text for CLI flag

Signed-off-by: lelia <lelia@socket.dev>

* Update CODEOWNERS to reflect proper team structure

Signed-off-by: lelia <lelia@socket.dev>

* Increment version again for release

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
---
 .github/CODEOWNERS               |  2 +-
 .github/workflows/pr-preview.yml |  3 ++-
 .github/workflows/release.yml    |  3 ++-
 README.md                        | 27 ++++++++++++++++++---------
 pyproject.toml                   |  4 ++--
 socketsecurity/__init__.py       |  2 +-
 socketsecurity/config.py         |  8 ++++++++
 socketsecurity/socketcli.py      |  3 ++-
 tests/unit/test_cli_config.py    | 23 ++++++++++++++++++++++-
 uv.lock                          | 10 +++++-----
 10 files changed, 63 insertions(+), 22 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 76ed953..edd0e77 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1 @@
-* @SocketDev/eng
\ No newline at end of file
+* @SocketDev/customer-engineering
\ No newline at end of file
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 9386346..2ee9b7e 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -16,12 +16,13 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
-          python-version: '3.x'
+          python-version: '3.13'
 
       # Install all dependencies from pyproject.toml
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
+          pip install "virtualenv<20.36"
           pip install hatchling==1.27.0 hatch==1.14.0
 
       - name: Inject full dynamic version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 20b4bd1..99372b6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,12 +15,13 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
-          python-version: '3.x'
+          python-version: '3.13'
 
       # Install all dependencies from pyproject.toml
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
+          pip install "virtualenv<20.36"
           pip install hatchling==1.27.0 hatch==1.14.0
           
       - name: Get Version
diff --git a/README.md b/README.md
index b2c2d9a..0a13219 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,8 @@ These examples are production-ready and include best practices for each platform
 
 ## Monorepo Workspace Support
 
+> **Note:** If you're looking to associate a scan with a named Socket workspace (e.g. because your repo is identified as `org/repo`), see the [`--workspace` flag](#repository) instead. The `--workspace-name` flag described in this section is an unrelated monorepo feature.
+
 The Socket CLI supports scanning specific workspaces within monorepo structures while preserving git context from the repository root. This is useful for organizations that maintain multiple applications or services in a single repository.
 
 ### Key Features
@@ -114,7 +116,7 @@ This will simultaneously generate:
 ## Usage
 
 ```` shell
-socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
+socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
           [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
@@ -138,14 +140,21 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --api-token | False    |         | Socket Security API token (can also be set via SOCKET_SECURITY_API_TOKEN env var) |
 
 #### Repository
-| Parameter        | Required | Default | Description                                                             |
-|:-----------------|:---------|:--------|:------------------------------------------------------------------------|
-| --repo           | False    | *auto*  | Repository name in owner/repo format (auto-detected from git remote)   |
-| --repo-is-public | False    | False   | If set, flags a new repository creation as public. Defaults to false.   |
-| --integration    | False    | api     | Integration type (api, github, gitlab, azure, bitbucket)                |
-| --owner          | False    |         | Name of the integration owner, defaults to the socket organization slug |
-| --branch         | False    | *auto*  | Branch name (auto-detected from git)                                   |
-| --committers     | False    | *auto*  | Committer(s) to filter by (auto-detected from git commit)              |
+| Parameter        | Required | Default | Description                                                                                                       |
+|:-----------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------|
+| --repo           | False    | *auto*  | Repository name in owner/repo format (auto-detected from git remote)                                             |
+| --workspace      | False    |         | The Socket workspace to associate the scan with (e.g. `my-org` in `my-org/my-repo`). See note below.           |
+| --repo-is-public | False    | False   | If set, flags a new repository creation as public. Defaults to false.                                            |
+| --integration    | False    | api     | Integration type (api, github, gitlab, azure, bitbucket)                                                         |
+| --owner          | False    |         | Name of the integration owner, defaults to the socket organization slug                                          |
+| --branch         | False    | *auto*  | Branch name (auto-detected from git)                                                                             |
+| --committers     | False    | *auto*  | Committer(s) to filter by (auto-detected from git commit)                                                        |
+
+> **`--workspace` vs `--workspace-name`** — these are two distinct flags for different purposes:
+>
+> - **`--workspace <string>`** maps to the Socket API's `workspace` query parameter on `CreateOrgFullScan`. Use it when your repository belongs to a named Socket workspace (e.g. an org with multiple workspace groups). Example: `--repo my-repo --workspace my-org`. Without this flag, scans are created without workspace context and may not appear under the correct workspace in the Socket dashboard.
+>
+> - **`--workspace-name <string>`** is a monorepo feature. It appends a suffix to the repository slug to create a unique name in Socket (e.g. `my-repo-frontend`). It must always be paired with `--sub-path` and has nothing to do with the API `workspace` field. See [Monorepo Workspace Support](#monorepo-workspace-support) below.
 
 #### Pull Request and Commit
 | Parameter        | Required | Default | Description                                    |
diff --git a/pyproject.toml b/pyproject.toml
index 4b1a3b6..1a59754 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.73"
+version = "2.2.74"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.29,<4.0.0",
+    "socketdev>=3.0.31,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 5993712..bee5bcf 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.73'
+__version__ = '2.2.74'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 7a94aca..eb47772 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -66,6 +66,7 @@ class CliConfig:
     save_manifest_tar: Optional[str] = None
     sub_paths: List[str] = field(default_factory=list)
     workspace_name: Optional[str] = None
+    workspace: Optional[str] = None
     # Reachability Flags
     reach: bool = False
     reach_version: Optional[str] = None
@@ -145,6 +146,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'save_manifest_tar': args.save_manifest_tar,
             'sub_paths': args.sub_paths or [],
             'workspace_name': args.workspace_name,
+            'workspace': args.workspace,
             'slack_webhook': args.slack_webhook,
             'reach': args.reach,
             'reach_version': args.reach_version,
@@ -256,6 +258,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Repository name in owner/repo format",
         required=False
     )
+    repo_group.add_argument(
+        "--workspace",
+        metavar="<string>",
+        help="The workspace in the Socket Organization that the repository is in to associate with the full scan.",
+        required=False
+    )
     repo_group.add_argument(
         "--repo-is-public",
         dest="repo_is_public",
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index f4ac6c8..6f17f58 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -464,7 +464,8 @@ def main_code():
         make_default_branch=is_default_branch,
         set_as_pending_head=is_default_branch,
         tmp=False,
-        scan_type='socket_tier1' if config.reach else 'socket'
+        scan_type='socket_tier1' if config.reach else 'socket',
+        workspace=config.workspace or None,
     )
 
     params.include_license_details = not config.exclude_license_details
diff --git a/tests/unit/test_cli_config.py b/tests/unit/test_cli_config.py
index b72ed9b..045f0e4 100644
--- a/tests/unit/test_cli_config.py
+++ b/tests/unit/test_cli_config.py
@@ -60,4 +60,25 @@ def test_strict_blocking_with_disable_blocking(self):
             "--disable-blocking"
         ])
         assert config.strict_blocking is True
-        assert config.disable_blocking is True
\ No newline at end of file
+        assert config.disable_blocking is True
+
+    def test_workspace_flag(self):
+        """Test that --workspace is parsed and stored correctly."""
+        config = CliConfig.from_args(["--api-token", "test", "--workspace", "my-workspace"])
+        assert config.workspace == "my-workspace"
+
+    def test_workspace_default_is_none(self):
+        """Test that workspace defaults to None when not supplied."""
+        config = CliConfig.from_args(["--api-token", "test"])
+        assert config.workspace is None
+
+    def test_workspace_is_independent_of_workspace_name(self):
+        """--workspace and --workspace-name are distinct flags with distinct purposes."""
+        config = CliConfig.from_args([
+            "--api-token", "test",
+            "--workspace", "my-workspace",
+            "--sub-path", ".",
+            "--workspace-name", "monorepo-suffix",
+        ])
+        assert config.workspace == "my-workspace"
+        assert config.workspace_name == "monorepo-suffix"
\ No newline at end of file
diff --git a/uv.lock b/uv.lock
index 1d97674..229b89b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1250,20 +1250,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.29"
+version = "3.0.31"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/02/f4/a4434843e0f01da684d0d330f1b4b744abfad1ee4d6b6d5fddfa9228b122/socketdev-3.0.29.tar.gz", hash = "sha256:be201a9bd186da6ddae4725294d3cbf11b00ec76c96e46be38d78a569fde4af3", size = 170751, upload-time = "2026-01-21T09:15:57.465Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/30/7e/f927ebb11968f22e80d1760a0f57b967ac111bd698a478717aa3049be88a/socketdev-3.0.31.tar.gz", hash = "sha256:946b2d64f7256b2a4a848b1770770aad927fdedb470e129529ac100a87a3eee8", size = 170976, upload-time = "2026-02-26T16:48:35.518Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/db/08/f1cea3b342d8b9109f5792257e3f6c31c3ff53a1e42a87726a2acac65440/socketdev-3.0.29-py3-none-any.whl", hash = "sha256:c2f832a703bd61eb88a5e3f9b8079e62f7cd1352ec206a20a946c6dd34fa788e", size = 66783, upload-time = "2026-01-21T09:15:55.909Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/2e/5c87e1c0c96efbd54da5d10a3d6c89cf674bfa6082f2854a515b853e64c6/socketdev-3.0.31-py3-none-any.whl", hash = "sha256:be87a48c17031a8b7aa2cfe207285f8447f502612bcb2b8ef6fcb5ede4947e9d", size = 66841, upload-time = "2026-02-26T16:48:33.748Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.72"
+version = "2.2.73"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.29,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.31,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From c281d6ddfc4c82bbab6f249c4a00178e6eac168f Mon Sep 17 00:00:00 2001
From: lelia <lelia@socket.dev>
Date: Tue, 3 Mar 2026 12:23:34 -0500
Subject: [PATCH 33/80] Update SDK version to fix `workspace` issue (#167)

* Update python SDK to v3.0.32

Signed-off-by: lelia <lelia@socket.dev>

* Bump CLI version for release

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
---
 pyproject.toml             | 4 ++--
 socketsecurity/__init__.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 1a59754..c11d634 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.74"
+version = "2.2.75"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.31,<4.0.0",
+    "socketdev>=3.0.32,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index bee5bcf..440c08b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.74'
+__version__ = '2.2.75'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

From b8b49f542744e1595f427a391797d3e32fa1460b Mon Sep 17 00:00:00 2001
From: lelia <lelia@socket.dev>
Date: Tue, 3 Mar 2026 19:09:46 -0500
Subject: [PATCH 34/80] SARIF file output and reachability filtering (#165)

* Add support for SARIF file output

Signed-off-by: lelia <lelia@socket.dev>

* Ignore SARIF results

Signed-off-by: lelia <lelia@socket.dev>

* Add test for new SARIF output functionality

Signed-off-by: lelia <lelia@socket.dev>

* Document new CLI output flag and clarify intended usage

Signed-off-by: lelia <lelia@socket.dev>

* Bump version to prep for release

Signed-off-by: lelia <lelia@socket.dev>

* Bump version to account for new release

Signed-off-by: lelia <lelia@socket.dev>

* Add workflow for running unittests

Signed-off-by: lelia <lelia@socket.dev>

* Tweak workflow name

Signed-off-by: lelia <lelia@socket.dev>

* Install dev dependencies for testing

Signed-off-by: lelia <lelia@socket.dev>

* Update lockfile

Signed-off-by: lelia <lelia@socket.dev>

* Add configurable option for reachabilty filtering with SARIF

Signed-off-by: lelia <lelia@socket.dev>

* Implement reachabilty logic for SARIF output

Signed-off-by: lelia <lelia@socket.dev>

* Add unittests to cover new reachability filtering functionality

Signed-off-by: lelia <lelia@socket.dev>

* Update README to document new filtering options and required use of --reach flag

Signed-off-by: lelia <lelia@socket.dev>

* Update e2e tests to include SARIF workflow

Signed-off-by: lelia <lelia@socket.dev>

* Impove Slack bot mode debug logging to surface failures

Signed-off-by: lelia <lelia@socket.dev>

* Skip gitlab tests that pass incorrect mock client to constructor

Signed-off-by: lelia <lelia@socket.dev>

* Update old constructor to use current Mock(spec=CliConfig) pattern, plus other test fixes

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
---
 .github/workflows/e2e-test.yml          |  86 ++++++++++
 .github/workflows/python-tests.yml      |  50 ++++++
 .gitignore                              |   1 +
 README.md                               |  25 ++-
 pyproject.toml                          |   2 +-
 socketsecurity/__init__.py              |   2 +-
 socketsecurity/config.py                |  26 +++
 socketsecurity/output.py                |  32 ++++
 socketsecurity/plugins/slack.py         |  38 +++--
 tests/unit/test_config.py               |  24 +++
 tests/unit/test_gitlab_auth_fallback.py |   2 +
 tests/unit/test_output.py               | 203 ++++++++++++++++++++++--
 uv.lock                                 |  10 +-
 13 files changed, 461 insertions(+), 40 deletions(-)
 create mode 100644 .github/workflows/python-tests.yml

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index cc986cb..d6d9519 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -47,6 +47,54 @@ jobs:
             exit 1
           fi
 
+  e2e-sarif:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: '3.12'
+
+      - name: Install CLI from local repo
+        run: |
+          python -m pip install --upgrade pip
+          pip install .
+
+      - name: Verify --sarif-reachable-only without --reach exits non-zero
+        run: |
+          if socketcli --sarif-reachable-only --api-token dummy 2>&1; then
+            echo "FAIL: Expected non-zero exit"
+            exit 1
+          else
+            echo "PASS: Exited non-zero as expected"
+          fi
+
+      - name: Run Socket CLI scan with --sarif-file
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+        run: |
+          set -o pipefail
+          socketcli \
+            --target-path tests/e2e/fixtures/simple-npm \
+            --sarif-file /tmp/results.sarif \
+            --disable-blocking \
+            2>&1 | tee /tmp/sarif-output.log
+
+      - name: Verify SARIF file is valid
+        run: |
+          python3 -c "
+          import json, sys
+          with open('/tmp/results.sarif') as f:
+              data = json.load(f)
+          assert data['version'] == '2.1.0', f'Invalid version: {data[\"version\"]}'
+          assert '\$schema' in data, 'Missing \$schema'
+          count = len(data['runs'][0]['results'])
+          print(f'PASS: Valid SARIF 2.1.0 with {count} result(s)')
+          "
+
   e2e-reachability:
     runs-on: ubuntu-latest
     steps:
@@ -107,3 +155,41 @@ jobs:
             cat /tmp/reach-output.log
             exit 1
           fi
+
+      - name: Run scan with --sarif-file (all results)
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+        run: |
+          socketcli \
+            --target-path tests/e2e/fixtures/simple-npm \
+            --reach \
+            --sarif-file /tmp/sarif-all.sarif \
+            --disable-blocking \
+            2>/dev/null || true
+
+      - name: Run scan with --sarif-file --sarif-reachable-only (filtered results)
+        env:
+          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
+        run: |
+          socketcli \
+            --target-path tests/e2e/fixtures/simple-npm \
+            --reach \
+            --sarif-file /tmp/sarif-reachable.sarif \
+            --sarif-reachable-only \
+            --disable-blocking \
+            2>/dev/null || true
+
+      - name: Verify reachable-only results are a subset of all results
+        run: |
+          python3 -c "
+          import json
+          with open('/tmp/sarif-all.sarif') as f:
+              all_data = json.load(f)
+          with open('/tmp/sarif-reachable.sarif') as f:
+              reach_data = json.load(f)
+          all_count = len(all_data['runs'][0]['results'])
+          reach_count = len(reach_data['runs'][0]['results'])
+          print(f'All results: {all_count}, Reachable-only results: {reach_count}')
+          assert reach_count <= all_count, f'FAIL: reachable ({reach_count}) > all ({all_count})'
+          print('PASS: Reachable-only results is a subset of all results')
+          "
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
new file mode 100644
index 0000000..4da0e3f
--- /dev/null
+++ b/.github/workflows/python-tests.yml
@@ -0,0 +1,50 @@
+name: Unit Tests
+
+env:
+  PYTHON_VERSION: "3.12"
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "socketsecurity/**/*.py"
+      - "tests/unit/**/*.py"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/python-tests.yml"
+  pull_request:
+    paths:
+      - "socketsecurity/**/*.py"
+      - "tests/unit/**/*.py"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/python-tests.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: python-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  python-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: 🐍 setup python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+      - name: 🛠️ install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install uv
+          uv sync --extra test
+      - name: 🧪 run tests
+        run: uv run pytest -q tests/unit/
diff --git a/.gitignore b/.gitignore
index 06780f9..b742d8b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,7 @@ run_container.sh
 bin
 scripts/*.py
 *.json
+*.sarif
 !tests/**/*.json
 markdown_overview_temp.md
 markdown_security_temp.md
diff --git a/README.md b/README.md
index 0a13219..685a76b 100644
--- a/README.md
+++ b/README.md
@@ -94,18 +94,27 @@ This will:
 - Save to `gl-dependency-scanning-report.json`
 - Include all actionable security alerts (error/warn level)
 
+**Save SARIF report to file (e.g. for GitHub Code Scanning, SonarQube, or VS Code):**
+```bash
+socketcli --sarif-file results.sarif \
+          --repo owner/repo \
+          --target-path .
+```
+
 **Multiple output formats:**
 ```bash
 socketcli --enable-json \
-          --enable-sarif \
+          --sarif-file results.sarif \
           --enable-gitlab-security \
           --repo owner/repo
 ```
 
 This will simultaneously generate:
 - JSON output to console
-- SARIF format to console
-- GitLab Security Dashboard report to file
+- SARIF report to `results.sarif` (and stdout)
+- GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
+
+> **Note:** `--enable-sarif` prints SARIF to stdout only. Use `--sarif-file <path>` to save to a file (this also implies `--enable-sarif`). Add `--sarif-reachable-only` (requires `--reach`) to filter results down to only reachable findings — useful for uploading to GitHub Code Scanning without noisy alerts on unreachable vulns. These flags are independent from `--enable-gitlab-security`, which produces a separate GitLab-specific Dependency Scanning report.
 
 ### Requirements
 
@@ -121,7 +130,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
           [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
-          [--enable-json] [--enable-sarif] [--enable-gitlab-security] [--gitlab-security-file <path>]
+          [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-reachable-only] [--enable-gitlab-security] [--gitlab-security-file <path>]
           [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
           [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
           [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
@@ -189,7 +198,9 @@ If you don't want to provide the Socket API Token every time then you can use th
 | --generate-license        | False    | False   | Generate license information                                                      |
 | --enable-debug            | False    | False   | Enable debug logging                                                              |
 | --enable-json             | False    | False   | Output in JSON format                                                             |
-| --enable-sarif            | False    | False   | Enable SARIF output of results instead of table or JSON format                    |
+| --enable-sarif            | False    | False   | Enable SARIF output of results instead of table or JSON format (prints to stdout) |
+| --sarif-file              | False    |         | Output file path for SARIF report (implies --enable-sarif). Use this to save SARIF output to a file for upload to GitHub Code Scanning, SonarQube, VS Code, or other SARIF-compatible tools |
+| --sarif-reachable-only    | False    | False   | Filter SARIF output to only include reachable findings (requires --reach)         |
 | --enable-gitlab-security  | False    | False   | Enable GitLab Security Dashboard output format (Dependency Scanning report)       |
 | --gitlab-security-file    | False    | gl-dependency-scanning-report.json | Output file path for GitLab Security report                |
 | --disable-overview        | False    | False   | Disable overview output                                                           |
@@ -725,13 +736,13 @@ socketcli --enable-gitlab-security --gitlab-security-file custom-path.json
 GitLab security reports can be generated alongside other output formats:
 
 ```bash
-socketcli --enable-json --enable-gitlab-security --enable-sarif
+socketcli --enable-json --enable-gitlab-security --sarif-file results.sarif
 ```
 
 This command will:
 - Output JSON format to console
 - Save GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
-- Save SARIF report (if configured)
+- Save SARIF report to `results.sarif`
 
 ### Security Dashboard Features
 
diff --git a/pyproject.toml b/pyproject.toml
index c11d634..677e9d6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.75"
+version = "2.2.76"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 440c08b..26b4f4e 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.75'
+__version__ = '2.2.76'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index eb47772..dffd4c0 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -40,6 +40,8 @@ class CliConfig:
     allow_unverified: bool = False
     enable_json: bool = False
     enable_sarif: bool = False
+    sarif_file: Optional[str] = None
+    sarif_reachable_only: bool = False
     enable_gitlab_security: bool = False
     gitlab_security_file: Optional[str] = None
     disable_overview: bool = False
@@ -103,6 +105,10 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             args.api_token
         )
 
+        # --sarif-file implies --enable-sarif
+        if args.sarif_file:
+            args.enable_sarif = True
+
         # Strip quotes from commit message if present
         commit_message = args.commit_message
         if commit_message and commit_message.startswith('"') and commit_message.endswith('"'):
@@ -126,6 +132,8 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'allow_unverified': args.allow_unverified,
             'enable_json': args.enable_json,
             'enable_sarif': args.enable_sarif,
+            'sarif_file': args.sarif_file,
+            'sarif_reachable_only': args.sarif_reachable_only,
             'enable_gitlab_security': args.enable_gitlab_security,
             'gitlab_security_file': args.gitlab_security_file,
             'disable_overview': args.disable_overview,
@@ -204,6 +212,11 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--workspace-name requires --sub-path to be specified")
             exit(1)
 
+        # Validate that sarif_reachable_only requires reach
+        if args.sarif_reachable_only and not args.reach:
+            logging.error("--sarif-reachable-only requires --reach to be specified")
+            exit(1)
+
         # Validate that only_facts_file requires reach
         if args.only_facts_file and not args.reach:
             logging.error("--only-facts-file requires --reach to be specified")
@@ -471,6 +484,19 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Enable SARIF output of results instead of table or JSON format"
     )
+    output_group.add_argument(
+        "--sarif-file",
+        dest="sarif_file",
+        metavar="<path>",
+        default=None,
+        help="Output file path for SARIF report (implies --enable-sarif)"
+    )
+    output_group.add_argument(
+        "--sarif-reachable-only",
+        dest="sarif_reachable_only",
+        action="store_true",
+        help="Filter SARIF output to only include reachable findings (requires --reach)"
+    )
     output_group.add_argument(
         "--enable-gitlab-security",
         dest="enable_gitlab_security",
diff --git a/socketsecurity/output.py b/socketsecurity/output.py
index 478f2b2..b70cad5 100644
--- a/socketsecurity/output.py
+++ b/socketsecurity/output.py
@@ -58,12 +58,20 @@ def handle_output(self, diff_report: Diff) -> None:
             slack_url = "Not configured"
             if self.config.slack_plugin.config and self.config.slack_plugin.config.get("url"):
                 slack_url = self.config.slack_plugin.config.get("url")
+            slack_mode = (self.config.slack_plugin.config or {}).get("mode", "webhook")
+            bot_token = os.getenv("SOCKET_SLACK_BOT_TOKEN")
+            bot_token_status = "Set" if bot_token else "Not set"
             self.logger.debug("=== Slack Webhook Debug Information ===")
             self.logger.debug(f"Slack Plugin Enabled: {self.config.slack_plugin.enabled}")
+            self.logger.debug(f"Slack Mode: {slack_mode}")
             self.logger.debug(f"SOCKET_SLACK_ENABLED environment variable: {slack_enabled_env}")
             self.logger.debug(f"SOCKET_SLACK_CONFIG_JSON environment variable: {slack_config_env}")
             self.logger.debug(f"Slack Webhook URL: {slack_url}")
+            self.logger.debug(f"SOCKET_SLACK_BOT_TOKEN: {bot_token_status}")
             self.logger.debug(f"Slack Alert Levels: {self.config.slack_plugin.levels}")
+            if self.config.reach:
+                facts_path = os.path.join(self.config.target_path or ".", self.config.reach_output_file or ".socket.facts.json")
+                self.logger.debug(f"Reachability facts file: {facts_path} (exists: {os.path.exists(facts_path)})")
             self.logger.debug("=====================================")
 
         if self.config.slack_plugin.enabled:
@@ -139,14 +147,38 @@ def output_console_json(self, diff_report: Diff, sbom_file_name: Optional[str] =
     def output_console_sarif(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """
         Generate SARIF output from the diff report and print to console.
+        If --sarif-file is configured, also save to file.
+        If --sarif-reachable-only is set, filters to blocking (reachable) alerts only.
         """
         if diff_report.id != "NO_DIFF_RAN":
+            # When --sarif-reachable-only is set, filter to error=True alerts only.
+            # This mirrors the Slack plugin's reachability_alerts_only behaviou:
+            # when --reach is used, error=True reflects Socket's reachability-aware policy.
+            if self.config.sarif_reachable_only:
+                filtered_alerts = [a for a in diff_report.new_alerts if getattr(a, "error", False)]
+                diff_report = Diff(
+                    new_alerts=filtered_alerts,
+                    diff_url=getattr(diff_report, "diff_url", ""),
+                    new_packages=getattr(diff_report, "new_packages", []),
+                    removed_packages=getattr(diff_report, "removed_packages", []),
+                    packages=getattr(diff_report, "packages", {}),
+                )
+                diff_report.id = "filtered"
+
             # Generate the SARIF structure using Messages
             console_security_comment = Messages.create_security_comment_sarif(diff_report)
             self.save_sbom_file(diff_report, sbom_file_name)
             # Print the SARIF output to the console in JSON format
             print(json.dumps(console_security_comment, indent=2))
 
+            # Save to file if --sarif-file is specified
+            if self.config.sarif_file:
+                sarif_path = Path(self.config.sarif_file)
+                sarif_path.parent.mkdir(parents=True, exist_ok=True)
+                with open(sarif_path, "w") as f:
+                    json.dump(console_security_comment, f, indent=2)
+                self.logger.info(f"SARIF report saved to {self.config.sarif_file}")
+
     def report_pass(self, diff_report: Diff) -> bool:
         """Determines if the report passes security checks"""
         # Priority 1: --disable-blocking always passes
diff --git a/socketsecurity/plugins/slack.py b/socketsecurity/plugins/slack.py
index ab41cc5..b3f0248 100644
--- a/socketsecurity/plugins/slack.py
+++ b/socketsecurity/plugins/slack.py
@@ -135,18 +135,20 @@ def _send_bot_alerts(self, diff, config: CliConfig):
         if not bot_token:
             logger.error("SOCKET_SLACK_BOT_TOKEN environment variable not set for bot mode.")
             return
-        
+
         if not bot_token.startswith("xoxb-"):
             logger.error("SOCKET_SLACK_BOT_TOKEN must start with 'xoxb-' (Bot User OAuth Token).")
             return
-        
+
+        logger.debug("SOCKET_SLACK_BOT_TOKEN: Set (valid xoxb- format)")
+
         # Get bot_configs from configuration
         bot_configs = self.config.get("bot_configs", [])
-        
+
         if not bot_configs:
             logger.warning("No bot_configs configured for bot mode.")
             return
-        
+
         logger.debug("Slack Plugin Enabled (bot mode)")
         logger.debug("Alert levels: %s", self.config.get("levels"))
         logger.debug(f"Number of bot_configs: {len(bot_configs)}")
@@ -212,29 +214,35 @@ def _send_bot_reachability_alerts(self, bot_configs: list, bot_token: str, repo_
         """Send reachability alerts using bot mode with Slack API."""
         # Construct path to socket facts file
         facts_file_path = os.path.join(config.target_path or ".", f"{config.reach_output_file}")
-        logger.debug(f"Loading reachability data from {facts_file_path}")
-        
+        facts_file_exists = os.path.exists(facts_file_path)
+        logger.debug(f"Loading reachability data from {facts_file_path} (exists: {facts_file_exists})")
+
+        if not facts_file_exists:
+            logger.error(f"Reachability facts file not found: {facts_file_path} — was --reach run successfully?")
+            return
+
         # Load socket facts file
         facts_data = load_socket_facts(facts_file_path)
-        
+
         if not facts_data:
-            logger.debug("No .socket.facts.json file found or failed to load")
+            logger.error(f"Failed to load or parse reachability facts file: {facts_file_path}")
             return
-        
+
         # Get components with vulnerabilities
         components_with_vulns = get_components_with_vulnerabilities(facts_data)
-        
+        logger.debug(f"Components with vulnerabilities in facts file: {len(components_with_vulns) if components_with_vulns else 0}")
+
         if not components_with_vulns:
             logger.debug("No components with vulnerabilities found in .socket.facts.json")
             return
-        
+
         # Convert to alerts format
         components_with_alerts = convert_to_alerts(components_with_vulns)
-        
+
         if not components_with_alerts:
             logger.debug("No alerts generated from .socket.facts.json")
             return
-        
+
         logger.debug(f"Found {len(components_with_alerts)} components with reachability alerts")
         
         # Send to each configured bot_config with filtering
@@ -265,10 +273,12 @@ def _send_bot_reachability_alerts(self, bot_configs: list, bot_token: str, repo_
                     filtered_component['alerts'] = filtered_component_alerts
                     filtered_components.append(filtered_component)
             
+            logger.debug(f"Bot config '{name}': {len(filtered_components)} components after severity filter {bot_config.get('severities', '(all)')}")
+
             if not filtered_components:
                 logger.debug(f"No reachability alerts match filter criteria for bot_config '{name}'. Skipping.")
                 continue
-            
+
             # Format for Slack using the formatter (max 45 blocks for findings + 5 for header/footer)
             slack_notifications = format_socket_facts_for_slack(
                 filtered_components,
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index bdebf36..7e6a9b5 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -1,5 +1,7 @@
 import pytest
+from unittest.mock import patch
 from socketsecurity.core.socket_config import SocketConfig
+from socketsecurity.config import CliConfig
 
 def test_config_default_values():
     """Test that config initializes with correct default values"""
@@ -67,3 +69,25 @@ def test_config_update_org_details():
     assert config.repository_path == "orgs/test-org/repos"
 
 
+class TestCliConfigValidation:
+    """Tests for CliConfig argument validation"""
+
+    BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+    def test_sarif_reachable_only_without_reach_exits(self):
+        """--sarif-reachable-only without --reach should exit with code 1"""
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachable-only"])
+        assert exc_info.value.code == 1
+
+    def test_sarif_reachable_only_with_reach_succeeds(self):
+        """--sarif-reachable-only with --reach should not raise"""
+        config = CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachable-only", "--reach"])
+        assert config.sarif_reachable_only is True
+        assert config.reach is True
+
+    def test_sarif_file_implies_enable_sarif(self):
+        """--sarif-file should automatically set enable_sarif=True"""
+        config = CliConfig.from_args(self.BASE_ARGS + ["--sarif-file", "out.sarif"])
+        assert config.enable_sarif is True
+        assert config.sarif_file == "out.sarif"
diff --git a/tests/unit/test_gitlab_auth_fallback.py b/tests/unit/test_gitlab_auth_fallback.py
index e9e9b0c..d439da2 100644
--- a/tests/unit/test_gitlab_auth_fallback.py
+++ b/tests/unit/test_gitlab_auth_fallback.py
@@ -17,6 +17,7 @@ class TestGitlabAuthFallback:
         'CI_MERGE_REQUEST_IID': '123',
         'CI_MERGE_REQUEST_PROJECT_ID': '456'
     })
+    @pytest.mark.skip(reason="Gitlab constructor does not accept client kwarg; needs rework to match current implementation")
     def test_fallback_from_private_token_to_bearer(self):
         """Test fallback from PRIVATE-TOKEN to Bearer authentication"""
         # Create a mock client that simulates auth failure then success
@@ -58,6 +59,7 @@ def test_fallback_from_private_token_to_bearer(self):
         'CI_MERGE_REQUEST_IID': '123',
         'CI_MERGE_REQUEST_PROJECT_ID': '456'
     })
+    @pytest.mark.skip(reason="Gitlab constructor does not accept client kwarg; needs rework to match current implementation")
     def test_fallback_from_bearer_to_private_token(self):
         """Test fallback from Bearer to PRIVATE-TOKEN authentication"""
         # Create a mock client that simulates auth failure then success
diff --git a/tests/unit/test_output.py b/tests/unit/test_output.py
index 458714c..5fa65d3 100644
--- a/tests/unit/test_output.py
+++ b/tests/unit/test_output.py
@@ -6,7 +6,15 @@
 class TestOutputHandler:
     @pytest.fixture
     def handler(self):
-        return OutputHandler(blocking_disabled=False)
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = False
+        config.sarif_file = None
+        config.sarif_reachable_only = False
+        config.sbom_file = None
+        return OutputHandler(config, Mock())
 
     def test_report_pass_with_blocking_issues(self, handler):
         diff = Diff()
@@ -14,13 +22,21 @@ def test_report_pass_with_blocking_issues(self, handler):
         assert not handler.report_pass(diff)
 
     def test_report_pass_with_blocking_disabled(self):
-        handler = OutputHandler(blocking_disabled=True)
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = True
+        config.strict_blocking = False
+        handler = OutputHandler(config, Mock())
         diff = Diff()
         diff.new_alerts = [Issue(error=True)]
         assert handler.report_pass(diff)
 
-    def test_json_output_format(self, handler, capsys):
+    def test_json_output_format(self, handler, caplog):
+        import logging
         diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
         test_issue = Issue(
             title="Test",
             severity="high",
@@ -35,15 +51,14 @@ def test_json_output_format(self, handler, capsys):
         )
         diff.new_alerts = [test_issue]
 
-        handler.output_console_json(diff)
-        captured = capsys.readouterr()
+        with caplog.at_level(logging.INFO, logger="socketcli"):
+            handler.output_console_json(diff)
 
-        # Parse the JSON output and verify structure
-        output = json.loads(captured.out)
-        assert output["issues"][0]["title"] == "Test"
-        assert output["issues"][0]["severity"] == "high"
-        assert output["issues"][0]["blocking"] is True
-        assert output["issues"][0]["description"] == "Test description"
+        output = json.loads(caplog.messages[-1])
+        assert output["new_alerts"][0]["title"] == "Test"
+        assert output["new_alerts"][0]["severity"] == "high"
+        assert output["new_alerts"][0]["error"] is True
+        assert output["new_alerts"][0]["description"] == "Test description"
 
     def test_sbom_file_saving(self, handler, tmp_path):
         # Test SBOM file is created correctly
@@ -156,4 +171,168 @@ def test_disable_blocking_overrides_strict_blocking(self):
         diff.unchanged_alerts = [Issue(error=True, warn=False)]
 
         # Should pass because disable_blocking takes precedence
-        assert handler.report_pass(diff)
\ No newline at end of file
+        assert handler.report_pass(diff)
+
+    def test_sarif_file_output(self, tmp_path):
+        """Test that --sarif-file writes SARIF report to a file"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path = tmp_path / "report.sarif"
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(sarif_path)
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = [Issue(
+            pkg_name="test-package",
+            pkg_version="1.0.0",
+            severity="high",
+            title="Test Vulnerability",
+            description="Test description",
+            type="malware",
+            url="https://socket.dev/test",
+            manifests="package.json",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/test-package@1.0.0",
+            error=True,
+        )]
+
+        handler.output_console_sarif(diff)
+
+        assert sarif_path.exists()
+        with open(sarif_path) as f:
+            sarif_data = json.load(f)
+        assert sarif_data["version"] == "2.1.0"
+
+    def test_sarif_reachable_only_filters_non_blocking(self, tmp_path):
+        """Test that --sarif-reachable-only excludes non-blocking (unreachable) alerts"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path = tmp_path / "report.sarif"
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(sarif_path)
+        config.sarif_reachable_only = True
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        def make_issue(name, error):
+            return Issue(
+                pkg_name=name,
+                pkg_version="1.0.0",
+                severity="high",
+                title=f"Vuln in {name}",
+                description="test",
+                type="vulnerability",
+                manifests="package.json",
+                pkg_type="npm",
+                key=f"key-{name}",
+                purl=f"pkg:npm/{name}@1.0.0",
+                error=error,
+            )
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = [
+            make_issue("reachable-pkg", error=True),
+            make_issue("unreachable-pkg", error=False),
+        ]
+
+        handler.output_console_sarif(diff)
+
+        with open(sarif_path) as f:
+            sarif_data = json.load(f)
+
+        rule_ids = [r["ruleId"] for r in sarif_data["runs"][0]["results"]]
+        assert any("reachable-pkg" in r for r in rule_ids)
+        assert not any("unreachable-pkg" in r for r in rule_ids)
+
+    def test_sarif_reachable_only_false_includes_all(self, tmp_path):
+        """Test that without --sarif-reachable-only all alerts are included"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path = tmp_path / "report.sarif"
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(sarif_path)
+        config.sarif_reachable_only = False
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = [
+            Issue(pkg_name="blocking-pkg", pkg_version="1.0.0", severity="high",
+                  title="Vuln", description="test", type="vulnerability",
+                  manifests="package.json", pkg_type="npm", key="k1",
+                  purl="pkg:npm/blocking-pkg@1.0.0", error=True),
+            Issue(pkg_name="non-blocking-pkg", pkg_version="1.0.0", severity="low",
+                  title="Vuln", description="test", type="vulnerability",
+                  manifests="package.json", pkg_type="npm", key="k2",
+                  purl="pkg:npm/non-blocking-pkg@1.0.0", error=False),
+        ]
+
+        handler.output_console_sarif(diff)
+
+        with open(sarif_path) as f:
+            sarif_data = json.load(f)
+
+        rule_ids = [r["ruleId"] for r in sarif_data["runs"][0]["results"]]
+        assert any("blocking-pkg" in r for r in rule_ids)
+        assert any("non-blocking-pkg" in r for r in rule_ids)
+        assert "$schema" in sarif_data
+        assert len(sarif_data["runs"]) == 1
+
+    def test_sarif_no_file_when_not_configured(self, tmp_path):
+        """Test that no file is written when --sarif-file is not set"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = None
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = []
+
+        handler.output_console_sarif(diff)
+
+        # No files should be created in tmp_path
+        assert list(tmp_path.iterdir()) == []
+
+    def test_sarif_file_nested_directory(self, tmp_path):
+        """Test that --sarif-file creates parent directories if needed"""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path = tmp_path / "nested" / "dir" / "report.sarif"
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(sarif_path)
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = []
+
+        handler.output_console_sarif(diff)
+
+        assert sarif_path.exists()
+        with open(sarif_path) as f:
+            sarif_data = json.load(f)
+        assert sarif_data["version"] == "2.1.0"
\ No newline at end of file
diff --git a/uv.lock b/uv.lock
index 229b89b..6ef77ff 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1250,20 +1250,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.31"
+version = "3.0.32"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/30/7e/f927ebb11968f22e80d1760a0f57b967ac111bd698a478717aa3049be88a/socketdev-3.0.31.tar.gz", hash = "sha256:946b2d64f7256b2a4a848b1770770aad927fdedb470e129529ac100a87a3eee8", size = 170976, upload-time = "2026-02-26T16:48:35.518Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/06/03/95800661041781428cc753aea65d8e1bc44d108f4be29c6a0815d18fcdd3/socketdev-3.0.32.tar.gz", hash = "sha256:89167632834dcf222877d599e68ed87a3a08e7abe171759f54490712ea8aa89a", size = 170997, upload-time = "2026-02-27T17:59:58.554Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a9/2e/5c87e1c0c96efbd54da5d10a3d6c89cf674bfa6082f2854a515b853e64c6/socketdev-3.0.31-py3-none-any.whl", hash = "sha256:be87a48c17031a8b7aa2cfe207285f8447f502612bcb2b8ef6fcb5ede4947e9d", size = 66841, upload-time = "2026-02-26T16:48:33.748Z" },
+    { url = "https://files.pythonhosted.org/packages/81/5c/58fa24c442d2bb8b8cab926c89cd4fb2613f73a35556e385d9bdb00abb72/socketdev-3.0.32-py3-none-any.whl", hash = "sha256:6a22356dadf4741eb731593b1d5ed4d708769f945998723bbfd1b613b8c968cc", size = 66868, upload-time = "2026-02-27T17:59:56.896Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.73"
+version = "2.2.76"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.31,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.32,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 4903ae33d6752c69a0fad64916d0bd573fc2036f Mon Sep 17 00:00:00 2001
From: David Larsen <Dc2larsen@gmail.com>
Date: Thu, 5 Mar 2026 19:50:52 -0500
Subject: [PATCH 35/80] Fix has_manifest_files failing to match root-level
 manifest files (#168)

* Fix has_manifest_files failing to match root-level manifest files

PurePath.match("**/package.json") returns False for root-level files
in Python 3.12+ because ** requires at least one directory component.
The function was unconditionally prepending **/ to all patterns,
causing root-level manifests like package.json and package-lock.json
to never match. This forced every scan into full scan mode instead of
diff scan mode, which meant MR/PR comments were never posted.

Fix by trying the direct pattern match first, then falling back to
the **/ prefixed pattern for subdirectory matching.

Fixes Zendesk #2447

* Bump version to 2.2.77

* Add tests/core to CI trigger paths and test command

* Fixing compatibility drift between CLI <> SDK surfaced by test failures

Signed-off-by: lelia <lelia@socket.dev>

* Fixing core test failures caused by updated stale fixtures, outdated test construction

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
Co-authored-by: lelia <lelia@socket.dev>
---
 .github/workflows/python-tests.yml      |  4 +-
 pyproject.toml                          |  2 +-
 socketsecurity/__init__.py              |  2 +-
 socketsecurity/core/__init__.py         | 23 ++++-----
 socketsecurity/core/classes.py          | 53 +++++++++++++++----
 tests/core/conftest.py                  | 15 ++++--
 tests/core/test_diff_generation.py      | 32 +++---------
 tests/core/test_has_manifest_files.py   | 68 +++++++++++++++++++++++++
 tests/core/test_package_and_alerts.py   | 58 ++++++++++++++++-----
 tests/core/test_sdk_methods.py          | 44 +++++++++-------
 tests/core/test_supporting_methods.py   | 50 ++++++++++--------
 tests/data/repos/repo_info_no_head.json |  3 +-
 tests/data/repos/repo_info_success.json |  3 +-
 13 files changed, 249 insertions(+), 108 deletions(-)
 create mode 100644 tests/core/test_has_manifest_files.py

diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 4da0e3f..3403b73 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -9,6 +9,7 @@ on:
     paths:
       - "socketsecurity/**/*.py"
       - "tests/unit/**/*.py"
+      - "tests/core/**/*.py"
       - "pyproject.toml"
       - "uv.lock"
       - ".github/workflows/python-tests.yml"
@@ -16,6 +17,7 @@ on:
     paths:
       - "socketsecurity/**/*.py"
       - "tests/unit/**/*.py"
+      - "tests/core/**/*.py"
       - "pyproject.toml"
       - "uv.lock"
       - ".github/workflows/python-tests.yml"
@@ -47,4 +49,4 @@ jobs:
           pip install uv
           uv sync --extra test
       - name: 🧪 run tests
-        run: uv run pytest -q tests/unit/
+        run: uv run pytest -q tests/unit/ tests/core/
diff --git a/pyproject.toml b/pyproject.toml
index 677e9d6..51621eb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.76"
+version = "2.2.77"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 26b4f4e..46bfbd7 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.76'
+__version__ = '2.2.77'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 9bf6ac0..edd2814 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -88,19 +88,16 @@ def get_org_id_slug(self) -> Tuple[str, str]:
             return org_id, organizations[org_id]['slug']
         return None, None
 
-    def get_sbom_data(self, full_scan_id: str) -> List[SocketArtifact]:
-        """Returns the list of SBOM artifacts for a full scan."""
+    def get_sbom_data(self, full_scan_id: str) -> Dict[str, SocketArtifact]:
+        """Returns SBOM artifacts for a full scan keyed by artifact ID."""
         response = self.sdk.fullscans.stream(self.config.org_slug, full_scan_id, use_types=True)
-        artifacts: List[SocketArtifact] = []
         if not response.success:
             log.debug(f"Failed to get SBOM data for full-scan {full_scan_id}")
             log.debug(response.message)
             return {}
         if not hasattr(response, "artifacts") or not response.artifacts:
-            return artifacts
-        for artifact_id in response.artifacts:
-            artifacts.append(response.artifacts[artifact_id])
-        return artifacts
+            return {}
+        return response.artifacts
 
     def get_sbom_data_list(self, artifacts_dict: Dict[str, SocketArtifact]) -> list[SocketArtifact]:
         """Converts artifacts dictionary to a list."""
@@ -414,15 +411,15 @@ def has_manifest_files(self, files: list) -> bool:
                 # Expand brace patterns for each manifest pattern
                 expanded_patterns = Core.expand_brace_pattern(pattern_str)
                 for exp_pat in expanded_patterns:
-                    # If pattern doesn't contain '/', prepend '**/' to match files in any subdirectory
-                    # This ensures patterns like '*requirements.txt' match '.test/requirements.txt'
-                    if '/' not in exp_pat:
-                        exp_pat = f"**/{exp_pat}"
-                    
                     for file in norm_files:
-                        # Use PurePath.match for glob-like matching
+                        # Match the pattern as-is first (handles root-level files
+                        # like "package.json" matching pattern "package.json")
                         if PurePath(file).match(exp_pat):
                             return True
+                        # Also try with **/ prefix to match files in subdirectories
+                        # (e.g. "src/requirements.txt" matching "*requirements.txt")
+                        if '/' not in exp_pat and PurePath(file).match(f"**/{exp_pat}"):
+                            return True
         return False
 
     def check_file_count_limit(self, file_count: int) -> dict:
diff --git a/socketsecurity/core/classes.py b/socketsecurity/core/classes.py
index 506c107..d211079 100644
--- a/socketsecurity/core/classes.py
+++ b/socketsecurity/core/classes.py
@@ -1,8 +1,15 @@
 import json
 from dataclasses import dataclass, field
-from typing import Dict, List, TypedDict, Any, Optional
+from typing import Dict, List, Optional, TypedDict
 
-from socketdev.fullscans import FullScanMetadata, SocketArtifact, SocketArtifactLink, DiffType, SocketManifestReference, SocketScore, SocketAlert
+from socketdev.fullscans import (
+    FullScanMetadata,
+    SocketAlert,
+    SocketArtifact,
+    SocketArtifactLink,
+    SocketManifestReference,
+    SocketScore,
+)
 
 __all__ = [
     "Report",
@@ -109,8 +116,8 @@ class Package():
     type: str
     name: str
     version: str
-    release: str
-    diffType: str
+    release: Optional[str] = None
+    diffType: Optional[str] = None
     id: str
     author: List[str] = field(default_factory=list)
     score: SocketScore
@@ -158,6 +165,8 @@ def from_socket_artifact(cls, data: dict) -> "Package":
             name=data["name"],
             version=data["version"],
             type=data["type"],
+            release=data.get("release"),
+            diffType=data.get("diffType"),
             score=data["score"],
             alerts=data["alerts"],
             author=data.get("author", []),
@@ -187,10 +196,36 @@ def from_diff_artifact(cls, data: dict) -> "Package":
         Raises:
             ValueError: If reference data cannot be found in DiffArtifact
         """
+        diff_type = data.get("diffType")
+        if hasattr(diff_type, "value"):
+            diff_type = diff_type.value
+
+        # Newer API responses may provide flattened diff artifacts without refs.
+        if "topLevelAncestors" in data or (not data.get("head") and not data.get("base")):
+            return cls(
+                id=data["id"],
+                name=data["name"],
+                version=data["version"],
+                type=data["type"],
+                score=data.get("score", data.get("scores", {})),
+                alerts=data.get("alerts", []),
+                author=data.get("author", []),
+                size=data.get("size"),
+                license=data.get("license"),
+                topLevelAncestors=data.get("topLevelAncestors", []),
+                direct=data.get("direct", True),
+                manifestFiles=data.get("manifestFiles", []),
+                dependencies=data.get("dependencies"),
+                artifact=data.get("artifact"),
+                namespace=data.get("namespace"),
+                release=data.get("release"),
+                diffType=diff_type,
+            )
+
         ref = None
-        if data["diffType"] in ["added", "updated", "unchanged"] and data.get("head"):
+        if diff_type in ["added", "updated", "unchanged"] and data.get("head"):
             ref = data["head"][0]
-        elif data["diffType"] in ["removed", "replaced"] and data.get("base"):
+        elif diff_type in ["removed", "replaced"] and data.get("base"):
             ref = data["base"][0]
 
         if not ref:
@@ -201,8 +236,8 @@ def from_diff_artifact(cls, data: dict) -> "Package":
             name=data["name"],
             version=data["version"],
             type=data["type"],
-            score=data["score"],
-            alerts=data["alerts"],
+            score=data.get("score", data.get("scores", {})),
+            alerts=data.get("alerts", []),
             author=data.get("author", []),
             size=data.get("size"),
             license=data.get("license"),
@@ -213,7 +248,7 @@ def from_diff_artifact(cls, data: dict) -> "Package":
             artifact=ref.get("artifact"),
             namespace=data.get('namespace', None),
             release=ref.get("release", None),
-            diffType=ref.get("diffType", None),
+            diffType=ref.get("diffType", diff_type),
         )
 
 class Issue:
diff --git a/tests/core/conftest.py b/tests/core/conftest.py
index 2fdefd5..381c2c3 100644
--- a/tests/core/conftest.py
+++ b/tests/core/conftest.py
@@ -142,28 +142,35 @@ def mock_sdk_with_responses(
 ):
     sdk = mock_socket_sdk.return_value
 
+    sdk.org.get.return_value = {
+        "organizations": {
+            "test-org-id": {"slug": "test-org"}
+        }
+    }
+    sdk.licensemetadata.post.return_value = [{"text": ""}]
+
     # Simple returns
     sdk.fullscans.post.return_value = create_full_scan_response
 
     # Argument-based returns
-    sdk.repos.repo.side_effect = lambda org_slug, repo_slug: {
+    sdk.repos.repo.side_effect = lambda org_slug, repo_slug, **kwargs: {
         "test": repo_info_response,
         "error": repo_info_error,
         "no-head": repo_info_no_head,
     }[repo_slug]
 
-    sdk.fullscans.metadata.side_effect = lambda org_slug, scan_id: {
+    sdk.fullscans.metadata.side_effect = lambda org_slug, scan_id, **kwargs: {
         "head": head_scan_metadata,
         "new": new_scan_metadata,
     }[scan_id]
 
-    sdk.fullscans.stream.side_effect = lambda org_slug, scan_id: {
+    sdk.fullscans.stream.side_effect = lambda org_slug, scan_id, **kwargs: {
         "head": head_scan_stream,
         "new": new_scan_stream,
     }[scan_id]
 
     sdk.fullscans.stream_diff.side_effect = (
-        lambda org_slug, head_id, new_id: stream_diff_response
+        lambda org_slug, head_id, new_id, **kwargs: stream_diff_response
     )
 
     return sdk
diff --git a/tests/core/test_diff_generation.py b/tests/core/test_diff_generation.py
index 472c901..477fd6b 100644
--- a/tests/core/test_diff_generation.py
+++ b/tests/core/test_diff_generation.py
@@ -1,4 +1,5 @@
 import json
+from dataclasses import fields
 from pathlib import Path
 
 import pytest
@@ -27,9 +28,10 @@ def diff_input() -> tuple[dict[str, Package], dict[str, Package]]:
     with open(input_file) as f:
         data = json.load(f)
     
-    # Convert the dictionaries back to Package objects
-    added = {k: Package(**v) for k, v in data["added"].items()}
-    removed = {k: Package(**v) for k, v in data["removed"].items()}
+    # Convert the dictionaries back to Package objects, ignoring legacy keys
+    package_fields = {field.name for field in fields(Package)}
+    added = {k: Package(**{pk: pv for pk, pv in v.items() if pk in package_fields}) for k, v in data["added"].items()}
+    removed = {k: Package(**{pk: pv for pk, pv in v.items() if pk in package_fields}) for k, v in data["removed"].items()}
     
     return added, removed
 
@@ -81,26 +83,8 @@ def test_create_diff_report(core, diff_input):
     assert "dp2" in removed_pkg_ids  # Direct package
     assert "dp2_t1" not in removed_pkg_ids  # Transitive dependency
 
-    # Verify new alerts
-    assert len(diff.new_alerts) == 8
-    
-    alert_details = {
-        (alert.type, alert.severity, alert.pkg_id)
-        for alert in diff.new_alerts
-    }
-    
-    expected_alerts = {
-        ("envVars", "low", "dp3"),
-        ("copyleftLicense", "low", "dp3"),
-        ("filesystemAccess", "low", "dp3_t1"),
-        ("envVars", "low", "dp3_t1"),
-        ("envVars", "low", "dp3_t2"),
-        ("networkAccess", "middle", "dp3_t2"),
-        ("usesEval", "middle", "dp3_t2"),
-        ("usesEval", "middle", "dp4"),
-    }
-    
-    assert alert_details == expected_alerts
+    # Alerts require explicit action mapping (warn/error) and may be empty in fixtures
+    assert len(diff.new_alerts) == 0
     
     # Verify new capabilities
     assert "dp3" in diff.new_capabilities
@@ -280,4 +264,4 @@ def print_added_and_removed(added, removed):
     #     # Verify capabilities are added to purls
     #     pkg1_purl = next(p for p in diff.new_packages if p.id == "pkg1")
     #     assert hasattr(pkg1_purl, "capabilities")
-    #     assert set(pkg1_purl.capabilities) == {"File System Access", "Network Access"}
\ No newline at end of file
+    #     assert set(pkg1_purl.capabilities) == {"File System Access", "Network Access"}
diff --git a/tests/core/test_has_manifest_files.py b/tests/core/test_has_manifest_files.py
new file mode 100644
index 0000000..150ffbd
--- /dev/null
+++ b/tests/core/test_has_manifest_files.py
@@ -0,0 +1,68 @@
+from unittest.mock import patch
+
+from socketsecurity.core import Core
+
+# Minimal patterns matching what the Socket API returns
+MOCK_PATTERNS = {
+    "npm": {
+        "packagejson": {"pattern": "package.json"},
+        "packagelockjson": {"pattern": "package-lock.json"},
+        "yarnlock": {"pattern": "yarn.lock"},
+    },
+    "pypi": {
+        "requirements": {"pattern": "*requirements.txt"},
+        "requirementsin": {"pattern": "*requirements*.txt"},
+        "setuppy": {"pattern": "setup.py"},
+    },
+    "maven": {
+        "pomxml": {"pattern": "pom.xml"},
+    },
+}
+
+
+@patch.object(Core, "get_supported_patterns", return_value=MOCK_PATTERNS)
+@patch.object(Core, "__init__", lambda self, *a, **kw: None)
+class TestHasManifestFiles:
+    def test_root_level_package_json(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["package.json"]) is True
+
+    def test_root_level_package_lock_json(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["package-lock.json"]) is True
+
+    def test_subdirectory_package_json(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["libs/ui/package.json"]) is True
+
+    def test_root_level_requirements_txt(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["requirements.txt"]) is True
+
+    def test_subdirectory_requirements_txt(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["src/requirements.txt"]) is True
+
+    def test_prefixed_requirements_txt(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["dev-requirements.txt"]) is True
+
+    def test_no_manifest_files(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["README.md", "src/app.py"]) is False
+
+    def test_mixed_files_with_manifest(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files([".gitlab-ci.yml", "package.json", "src/app.tsx"]) is True
+
+    def test_empty_list(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files([]) is False
+
+    def test_dot_slash_prefix_normalized(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["./package.json"]) is True
+
+    def test_pom_xml_root(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["pom.xml"]) is True
diff --git a/tests/core/test_package_and_alerts.py b/tests/core/test_package_and_alerts.py
index 1eabc85..09a8455 100644
--- a/tests/core/test_package_and_alerts.py
+++ b/tests/core/test_package_and_alerts.py
@@ -1,11 +1,12 @@
-import pytest
-from unittest.mock import Mock, patch
 from dataclasses import dataclass
+from unittest.mock import Mock
+
+import pytest
+from socketdev import socketdev
 
 from socketsecurity.core import Core
-from socketsecurity.core.classes import Package, Issue, Alert
+from socketsecurity.core.classes import Issue, Package
 from socketsecurity.core.socket_config import SocketConfig
-from socketdev import socketdev
 
 
 @dataclass
@@ -14,12 +15,32 @@ class MockArtifact:
     name: str
     version: str
     type: str
+    release: str
+    diffType: str
     license: str
+    score: dict
+    alerts: list
     direct: bool
     topLevelAncestors: list
 
 
 class TestPackageAndAlerts:
+    @staticmethod
+    def make_package(**overrides):
+        base = dict(
+            id="pkg:npm/test@1.0.0",
+            name="test",
+            version="1.0.0",
+            type="npm",
+            release="tar-gz",
+            diffType="added",
+            score={},
+            alerts=[],
+            topLevelAncestors=[],
+        )
+        base.update(overrides)
+        return Package(**base)
+
     @pytest.fixture
     def mock_sdk(self):
         mock = Mock(spec=socketdev)
@@ -38,6 +59,10 @@ def mock_sdk(self):
         settings_response = Mock()
         settings_response.success = True
         mock.settings.get = Mock(return_value=settings_response)
+
+        # Set up licensemetadata.post() used by create_packages_dict()
+        mock.licensemetadata = Mock()
+        mock.licensemetadata.post = Mock(return_value=[{"text": ""}])
         
         return mock
     
@@ -61,7 +86,11 @@ def test_create_packages_dict_basic(self, core):
                 name="test",
                 version="1.0.0",
                 type="npm",
+                release="tar-gz",
+                diffType="added",
                 license="MIT",
+                score={},
+                alerts=[],
                 direct=True,
                 topLevelAncestors=[]
             )
@@ -83,7 +112,11 @@ def test_create_packages_dict_with_transitives(self, core):
                 name="parent",
                 version="1.0.0",
                 type="npm",
+                release="tar-gz",
+                diffType="added",
                 license="MIT",
+                score={},
+                alerts=[],
                 direct=True,
                 topLevelAncestors=[]
             ),
@@ -92,7 +125,11 @@ def test_create_packages_dict_with_transitives(self, core):
                 name="child",
                 version="1.0.0",
                 type="npm",
+                release="tar-gz",
+                diffType="added",
                 license="MIT",
+                score={},
+                alerts=[],
                 direct=False,
                 topLevelAncestors=["pkg:npm/parent@1.0.0"]
             )
@@ -109,11 +146,7 @@ def test_create_packages_dict_with_transitives(self, core):
 
     def test_add_package_alerts_basic(self, core):
         """Test adding basic alerts to collection"""
-        package = Package(
-            id="pkg:npm/test@1.0.0",
-            name="test",
-            version="1.0.0",
-            type="npm",
+        package = self.make_package(
             alerts=[{
                 "type": "networkAccess",
                 "key": "test-alert",
@@ -138,14 +171,11 @@ def test_add_package_alerts_basic(self, core):
     def test_get_capabilities_for_added_packages(self, core):
         """Test capability extraction from package alerts"""
         added_packages = {
-            "pkg:npm/test@1.0.0": Package(
-                id="pkg:npm/test@1.0.0",
-                type="npm",
+            "pkg:npm/test@1.0.0": self.make_package(
                 alerts=[{
                     "type": "networkAccess",
                     "key": "test-alert"
                 }],
-                topLevelAncestors=[]
             )
         }
         
@@ -198,4 +228,4 @@ def test_get_new_alerts_with_readded(self):
         
         # With ignore_readded=False
         new_alerts = Core.get_new_alerts(added_alerts, removed_alerts, ignore_readded=False)
-        assert len(new_alerts) == 1 
\ No newline at end of file
+        assert len(new_alerts) == 1 
diff --git a/tests/core/test_sdk_methods.py b/tests/core/test_sdk_methods.py
index e07ec31..bb096eb 100644
--- a/tests/core/test_sdk_methods.py
+++ b/tests/core/test_sdk_methods.py
@@ -16,8 +16,9 @@ def test_get_repo_info(core, mock_sdk_with_responses):
     
     # Assert SDK called correctly
     mock_sdk_with_responses.repos.repo.assert_called_once_with(
-        core.config.org_slug, 
-        "test"
+        core.config.org_slug,
+        "test",
+        use_types=True,
     )
     
     # Assert response processed correctly
@@ -30,8 +31,9 @@ def test_get_head_scan_for_repo(core, mock_sdk_with_responses):
     
     # Assert SDK method called correctly
     mock_sdk_with_responses.repos.repo.assert_called_once_with(
-        core.config.org_slug, 
-        "test"
+        core.config.org_slug,
+        "test",
+        use_types=True,
     )
     
     # Assert we got the expected head scan ID
@@ -48,12 +50,14 @@ def test_get_full_scan(core, mock_sdk_with_responses, head_scan_metadata, head_s
     
     # Assert SDK methods called correctly
     mock_sdk_with_responses.fullscans.metadata.assert_called_once_with(
-        core.config.org_slug, 
-        "head"
+        core.config.org_slug,
+        "head",
+        use_types=True,
     )
     mock_sdk_with_responses.fullscans.stream.assert_called_once_with(
-        core.config.org_slug, 
-        "head"
+        core.config.org_slug,
+        "head",
+        use_types=True,
     )
     
     # Assert response processed correctly
@@ -62,7 +66,7 @@ def test_get_full_scan(core, mock_sdk_with_responses, head_scan_metadata, head_s
     assert len(full_scan.packages) == len(head_scan_stream.artifacts)
     assert full_scan.packages["dp1"].transitives == 2
 
-def test_create_full_scan(core, new_scan_metadata, new_scan_stream):
+def test_create_full_scan(core, mock_sdk_with_responses, new_scan_metadata):
     """Test creating a new full scan"""
     # Setup test data
     files = ["requirements.txt"]
@@ -77,25 +81,26 @@ def test_create_full_scan(core, new_scan_metadata, new_scan_stream):
     
     # Verify the response
     assert full_scan.id == new_scan_metadata["data"]["id"]
-    assert len(full_scan.sbom_artifacts) == len(new_scan_stream.artifacts)
-    assert len(full_scan.packages) == len(new_scan_stream.artifacts)
-    assert full_scan.packages["dp4"].transitives == 1
-    assert full_scan.packages["dp3"].transitives == 3
+    mock_sdk_with_responses.fullscans.post.assert_called_once_with(
+        files,
+        params,
+        use_types=True,
+        use_lazy_loading=True,
+        max_open_files=50,
+        base_paths=None,
+    )
 
 def test_get_added_and_removed_packages(core):
     """Test getting added and removed packages between two scans"""
     # Get two different scans to compare
-    head_scan = core.get_full_scan("head")
-    new_scan = core.get_full_scan("new")
-    
-    # Get the differences
-    added, removed = core.get_added_and_removed_packages(head_scan, new_scan)
+    added, removed, all_packages = core.get_added_and_removed_packages("head", "new")
     
     # Verify SDK was called correctly
     core.sdk.fullscans.stream_diff.assert_called_once_with(
         core.config.org_slug,
         "head",
-        "new"
+        "new",
+        use_types=True,
     )
     
     # Verify the results
@@ -108,6 +113,7 @@ def test_get_added_and_removed_packages(core):
     assert len(removed) > 0  # We should have some removed packages
     assert "dp2" in removed  # Verify specific package we know was removed
     assert "dp2_t1" in removed  # Verify transitive dependencies are also tracked
+    assert "pypi/direct_package_1@1.6.0" in all_packages  # Unchanged package is in full package map
 
 def test_empty_alerts_preserved(core):
     """Test that empty alerts arrays stay as empty arrays and don't become None"""
diff --git a/tests/core/test_supporting_methods.py b/tests/core/test_supporting_methods.py
index 89c40be..1e1fb91 100644
--- a/tests/core/test_supporting_methods.py
+++ b/tests/core/test_supporting_methods.py
@@ -2,6 +2,29 @@
 from socketsecurity.core.classes import Diff, Issue, Package, Purl
 
 
+def make_package(**overrides):
+    base = dict(
+        id="pkg:npm/test-package@1.0.0",
+        name="test-package",
+        version="1.0.0",
+        type="npm",
+        release="tar-gz",
+        diffType="added",
+        score={},
+        alerts=[],
+        direct=True,
+        manifestFiles=[{"file": "package.json"}],
+        topLevelAncestors=[],
+        author=["test-author"],
+        size=1000,
+        transitives=0,
+        purl="pkg:npm/test-package@1.0.0",
+        url="https://socket.dev/npm/package/test-package/overview/1.0.0",
+    )
+    base.update(overrides)
+    return Package(**base)
+
+
 def test_create_purl():
     """Test creating a PURL from package data"""
     # Setup test package data
@@ -10,23 +33,18 @@ def test_create_purl():
     pkg_version = "1.0.0"
     
     packages = {
-        "test_pkg": Package(
+        "test_pkg": make_package(
             id="test_pkg",
             name=pkg_name,
             version=pkg_version,
             type=pkg_type,
-            direct=True,
-            manifestFiles=[{"file": "package.json"}],
-            topLevelAncestors=[],
-            author=["test-author"],
-            size=1000,
-            transitives=0,
             purl=f"pkg:{pkg_type}/{pkg_name}@{pkg_version}"
         )
     }
     
     # Create PURL
-    purl = Core.create_purl("test_pkg", packages)
+    core = Core.__new__(Core)
+    purl = core.create_purl("test_pkg", packages)
     
     # Verify PURL properties
     assert purl.id == "test_pkg"
@@ -45,7 +63,7 @@ def test_create_purl():
 def test_get_source_data():
     """Test getting source data for direct and transitive dependencies"""
     # Setup test package data
-    direct_pkg = Package(
+    direct_pkg = make_package(
         id="direct_pkg",
         name="direct-package",
         version="1.0.0",
@@ -55,12 +73,10 @@ def test_get_source_data():
             {"file": "package.json", "start": 10, "end": 20}
         ],
         topLevelAncestors=[],
-        author=["test-author"],
-        size=1000,
         transitives=1
     )
     
-    transitive_pkg = Package(
+    transitive_pkg = make_package(
         id="t_pkg",
         name="transitive-package",
         version="2.0.0",
@@ -91,14 +107,11 @@ def test_get_capabilities_for_added_packages():
     """Test mapping package alerts to capabilities"""
     # Setup test packages with various alert types
     packages = {
-        "pkg1": Package(
+        "pkg1": make_package(
             id="pkg1",
             name="package-1",
             version="1.0.0",
             type="npm",
-            direct=True,
-            manifestFiles=[{"file": "package.json"}],
-            topLevelAncestors=[],
             alerts=[
                 {
                     "key": "alert1",
@@ -116,14 +129,11 @@ def test_get_capabilities_for_added_packages():
                 }
             ]
         ),
-        "pkg2": Package(
+        "pkg2": make_package(
             id="pkg2",
             name="package-2",
             version="2.0.0",
             type="npm",
-            direct=True,
-            manifestFiles=[{"file": "package.json"}],
-            topLevelAncestors=[],
             alerts=[
                 {
                     "key": "alert3",
diff --git a/tests/data/repos/repo_info_no_head.json b/tests/data/repos/repo_info_no_head.json
index b8ea91f..7c3c41e 100644
--- a/tests/data/repos/repo_info_no_head.json
+++ b/tests/data/repos/repo_info_no_head.json
@@ -5,6 +5,7 @@
         "updated_at": "2024-12-10T23:20:51.206Z",
         "head_full_scan_id": "",
         "name": "basic-python",
+        "slug": "no-head",
         "description": "",
         "homepage": "https://github.com/test_org/basic-python",
         "visibility": "public",
@@ -13,4 +14,4 @@
     },
     "success": true,
     "status": 200
-}
\ No newline at end of file
+}
diff --git a/tests/data/repos/repo_info_success.json b/tests/data/repos/repo_info_success.json
index d6d4964..9674aaa 100644
--- a/tests/data/repos/repo_info_success.json
+++ b/tests/data/repos/repo_info_success.json
@@ -5,6 +5,7 @@
         "updated_at": "2024-12-10T23:20:51.206Z",
         "head_full_scan_id": "head",
         "name": "basic-python",
+        "slug": "test",
         "description": "",
         "homepage": "https://github.com/test_org/basic-python",
         "visibility": "public",
@@ -13,4 +14,4 @@
     },
     "success": true,
     "status": 200
-}
\ No newline at end of file
+}

From 637eda7a0a72ca1f9642dc854ac4a7cece21b787 Mon Sep 17 00:00:00 2001
From: lelia <lelia@socket.dev>
Date: Thu, 12 Mar 2026 11:10:46 -0400
Subject: [PATCH 36/80] Fix reachability filtering, add config file support
 (#169)

* Add SARIF scoping/reachability controls, config file support

Signed-off-by: lelia <lelia@socket.dev>

* Add coverage for new SARIF scoping, config file behavior

Signed-off-by: lelia <lelia@socket.dev>

* Add config examples for different use cases

Signed-off-by: lelia <lelia@socket.dev>

* Refactor docs to reduce README complexity, create dedicated CLI and CI/CD guides

Signed-off-by: lelia <lelia@socket.dev>

* Bump version for release

Signed-off-by: lelia <lelia@socket.dev>

* Add shared selector/filter module

Signed-off-by: lelia <lelia@socket.dev>

* Refactor output handling to use shared alert selection

Signed-off-by: lelia <lelia@socket.dev>

* Refactor Slack diff filtering to use shared selection semantics, facts-aware reachable filtering

Signed-off-by: lelia <lelia@socket.dev>

* Add unit tests for shared selection logic

Signed-off-by: lelia <lelia@socket.dev>

* Add unit tests for new Slack behavior

Signed-off-by: lelia <lelia@socket.dev>

* Update output tests for strict-blocking and SARIF

Signed-off-by: lelia <lelia@socket.dev>

* Add JSON config examples for reference

Signed-off-by: lelia <lelia@socket.dev>

* Remove unnecessary backwards compat logic

Signed-off-by: lelia <lelia@socket.dev>

* Docs refactor for better readability, dedicated guides for CLI + CI/CD usage

Signed-off-by: lelia <lelia@socket.dev>

* Bump version for release

Signed-off-by: lelia <lelia@socket.dev>

* Fix missing version check expected in PR preview

Signed-off-by: lelia <lelia@socket.dev>

* Fix PR preview worklfow to use updated version check

Signed-off-by: lelia <lelia@socket.dev>

* Fix e2e regression tests to use correct SARIF flags and remove legacy assertions

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
---
 .github/workflows/e2e-test.yml              |  22 +-
 .github/workflows/pr-preview.yml            |  13 +-
 .github/workflows/version-check.yml         |   8 +-
 .gitignore                                  |   1 +
 README.md                                   | 928 +++-----------------
 docs/README.md                              |  10 -
 docs/ci-cd.md                               | 119 +++
 docs/cli-reference.md                       | 734 ++++++++++++++++
 docs/development.md                         |  95 ++
 docs/troubleshooting.md                     |  81 ++
 examples/config/sarif-dashboard-parity.json |  11 +
 examples/config/sarif-dashboard-parity.toml |  18 +
 examples/config/sarif-diff-ci-cd.json       |  11 +
 examples/config/sarif-diff-ci-cd.toml       |  16 +
 examples/config/sarif-instance-detail.json  |  11 +
 examples/config/sarif-instance-detail.toml  |  16 +
 pyproject.toml                              |   2 +-
 socketsecurity/__init__.py                  |   2 +-
 socketsecurity/config.py                    | 125 ++-
 socketsecurity/core/alert_selection.py      | 239 +++++
 socketsecurity/core/messages.py             | 204 +++++
 socketsecurity/output.py                    |  80 +-
 socketsecurity/plugins/slack.py             |  53 +-
 tests/unit/test_alert_selection.py          | 101 +++
 tests/unit/test_config.py                   |  91 +-
 tests/unit/test_output.py                   | 500 ++++++++++-
 tests/unit/test_slack_plugin.py             | 122 +++
 uv.lock                                     |   2 +-
 workflows/buildkite.yml                     |  13 +
 29 files changed, 2701 insertions(+), 927 deletions(-)
 delete mode 100644 docs/README.md
 create mode 100644 docs/ci-cd.md
 create mode 100644 docs/cli-reference.md
 create mode 100644 docs/development.md
 create mode 100644 docs/troubleshooting.md
 create mode 100644 examples/config/sarif-dashboard-parity.json
 create mode 100644 examples/config/sarif-dashboard-parity.toml
 create mode 100644 examples/config/sarif-diff-ci-cd.json
 create mode 100644 examples/config/sarif-diff-ci-cd.toml
 create mode 100644 examples/config/sarif-instance-detail.json
 create mode 100644 examples/config/sarif-instance-detail.toml
 create mode 100644 socketsecurity/core/alert_selection.py
 create mode 100644 tests/unit/test_alert_selection.py
 create mode 100644 tests/unit/test_slack_plugin.py
 create mode 100644 workflows/buildkite.yml

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index d6d9519..6e0e66f 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -63,15 +63,6 @@ jobs:
           python -m pip install --upgrade pip
           pip install .
 
-      - name: Verify --sarif-reachable-only without --reach exits non-zero
-        run: |
-          if socketcli --sarif-reachable-only --api-token dummy 2>&1; then
-            echo "FAIL: Expected non-zero exit"
-            exit 1
-          else
-            echo "PASS: Exited non-zero as expected"
-          fi
-
       - name: Run Socket CLI scan with --sarif-file
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
@@ -164,10 +155,12 @@ jobs:
             --target-path tests/e2e/fixtures/simple-npm \
             --reach \
             --sarif-file /tmp/sarif-all.sarif \
+            --sarif-scope full \
+            --sarif-reachability all \
             --disable-blocking \
-            2>/dev/null || true
+            2>/dev/null
 
-      - name: Run scan with --sarif-file --sarif-reachable-only (filtered results)
+      - name: Run scan with --sarif-file --sarif-reachability reachable (filtered results)
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
         run: |
@@ -175,12 +168,15 @@ jobs:
             --target-path tests/e2e/fixtures/simple-npm \
             --reach \
             --sarif-file /tmp/sarif-reachable.sarif \
-            --sarif-reachable-only \
+            --sarif-scope full \
+            --sarif-reachability reachable \
             --disable-blocking \
-            2>/dev/null || true
+            2>/dev/null
 
       - name: Verify reachable-only results are a subset of all results
         run: |
+          test -f /tmp/sarif-all.sarif
+          test -f /tmp/sarif-reachable.sarif
           python3 -c "
           import json
           with open('/tmp/sarif-all.sarif') as f:
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 2ee9b7e..28c7870 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -37,6 +37,17 @@ jobs:
           VERSION=$(hatch version | cut -d+ -f1)
           echo "VERSION=$VERSION" >> $GITHUB_ENV
 
+      - name: Check if version already exists on Test PyPI
+        id: version_check
+        env:
+          VERSION: ${{ env.VERSION }}
+        run: |
+          if curl -s -f https://test.pypi.org/pypi/socketsecurity/${VERSION}/json > /dev/null; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Build package
         if: steps.version_check.outputs.exists != 'true'
         run: |
@@ -146,4 +157,4 @@ jobs:
           build-args: |
             CLI_VERSION=${{ env.VERSION }}
             PIP_INDEX_URL=https://test.pypi.org/simple
-            PIP_EXTRA_INDEX_URL=https://pypi.org/simple
\ No newline at end of file
+            PIP_EXTRA_INDEX_URL=https://pypi.org/simple
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 5e4335c..f2d63e4 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -18,13 +18,15 @@ jobs:
       - name: Check version increment
         id: version_check
         run: |
+          python -m pip install --upgrade pip
+          pip install packaging
+
           # Get version from current PR
           PR_VERSION=$(grep -o "__version__.*" socketsecurity/__init__.py | awk '{print $3}' | tr -d "'")
           echo "PR_VERSION=$PR_VERSION" >> $GITHUB_ENV
 
           # Get version from main branch
-          git checkout origin/main
-          MAIN_VERSION=$(grep -o "__version__.*" socketsecurity/__init__.py | awk '{print $3}' | tr -d "'")
+          MAIN_VERSION=$(git show origin/main:socketsecurity/__init__.py | grep -o "__version__.*" | awk '{print $3}' | tr -d "'")
           echo "MAIN_VERSION=$MAIN_VERSION" >> $GITHUB_ENV
 
           # Compare versions using Python
@@ -87,4 +89,4 @@ jobs:
                 issue_number: prNumber,
                 body: `❌ **Version Check Failed**\n\nPlease increment...`
               });
-            }
\ No newline at end of file
+            }
diff --git a/.gitignore b/.gitignore
index b742d8b..e01bafe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ scripts/*.py
 *.json
 *.sarif
 !tests/**/*.json
+!examples/config/*.json
 markdown_overview_temp.md
 markdown_security_temp.md
 .DS_Store
diff --git a/README.md b/README.md
index 685a76b..ef84057 100644
--- a/README.md
+++ b/README.md
@@ -1,899 +1,193 @@
 # Socket Security CLI
 
-The Socket Security CLI was created to enable integrations with other tools like GitHub Actions, GitLab, BitBucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts with blocking actions it'll exit with a non-Zero exit code.
+Socket Python CLI for Socket scans, diff reporting, reachability analysis, and SARIF/GitLab exports.
 
-## Quick Start
+Comprehensive docs are available in [`docs/`](docs/) for full flag reference, CI/CD-specific guidance, and contributor setup.
 
-The CLI now features automatic detection of git repository information, making it much simpler to use in CI/CD environments. Most parameters are now optional and will be detected automatically from your git repository.
+## Quick start
 
-### Minimal Usage Examples
+### 1) Install
 
-**GitHub Actions:**
 ```bash
-socketcli --target-path $GITHUB_WORKSPACE --scm github --pr-number $PR_NUMBER
+pip install socketsecurity
 ```
 
-**GitLab CI:**
-```bash
-socketcli --target-path $CI_PROJECT_DIR --scm gitlab --pr-number ${CI_MERGE_REQUEST_IID:-0}
-```
-
-**Local Development:**
-```bash
-socketcli --target-path ./my-project
-```
-
-The CLI will automatically detect:
-- Repository name from git remote
-- Branch name from git
-- Commit SHA and message from git
-- Committer information from git
-- Default branch status from git and CI environment
-- Changed files from git commit history
-
-## CI/CD Workflow Examples
-
-Pre-configured workflow examples are available in the [`workflows/`](workflows/) directory:
-
-- **[GitHub Actions](workflows/github-actions.yml)** - Complete workflow with concurrency control and automatic PR detection
-- **[GitLab CI](workflows/gitlab-ci.yml)** - Pipeline configuration with caching and environment variable handling  
-- **[Bitbucket Pipelines](workflows/bitbucket-pipelines.yml)** - Basic pipeline setup with optional path filtering
-
-These examples are production-ready and include best practices for each platform.
-
-## Monorepo Workspace Support
-
-> **Note:** If you're looking to associate a scan with a named Socket workspace (e.g. because your repo is identified as `org/repo`), see the [`--workspace` flag](#repository) instead. The `--workspace-name` flag described in this section is an unrelated monorepo feature.
-
-The Socket CLI supports scanning specific workspaces within monorepo structures while preserving git context from the repository root. This is useful for organizations that maintain multiple applications or services in a single repository.
-
-### Key Features
-
-- **Multiple Sub-paths**: Specify multiple `--sub-path` options to scan different directories within your monorepo
-- **Combined Workspace**: All sub-paths are scanned together as a single workspace in Socket
-- **Git Context Preserved**: Repository metadata (commits, branches, etc.) comes from the main target-path
-- **Workspace Naming**: Use `--workspace-name` to differentiate scans from different parts of your monorepo
-
-### Usage Examples
-
-**Scan multiple frontend and backend workspaces:**
-```bash
-socketcli --target-path /path/to/monorepo \
-          --sub-path frontend \
-          --sub-path backend \
-          --sub-path services/api \
-          --workspace-name main-app
-```
-
-**GitHub Actions for monorepo workspace:**
-```bash
-socketcli --target-path $GITHUB_WORKSPACE \
-          --sub-path packages/web \
-          --sub-path packages/mobile \
-          --workspace-name mobile-web \
-          --scm github \
-          --pr-number $PR_NUMBER
-```
-
-This will:
-- Scan manifest files in `./packages/web/` and `./packages/mobile/`
-- Combine them into a single workspace scan
-- Create a repository in Socket named like `my-repo-mobile-web`
-- Preserve git context (commits, branch info) from the repository root
+### 2) Authenticate
 
-**Generate GitLab Security Dashboard report:**
 ```bash
-socketcli --enable-gitlab-security \
-          --repo owner/repo \
-          --target-path .
+export SOCKET_SECURITY_API_TOKEN="<token>"
 ```
 
-This will:
-- Scan all manifest files in the current directory
-- Generate a GitLab-compatible Dependency Scanning report
-- Save to `gl-dependency-scanning-report.json`
-- Include all actionable security alerts (error/warn level)
+### 3) Run a basic scan
 
-**Save SARIF report to file (e.g. for GitHub Code Scanning, SonarQube, or VS Code):**
 ```bash
-socketcli --sarif-file results.sarif \
-          --repo owner/repo \
-          --target-path .
+socketcli --target-path .
 ```
 
-**Multiple output formats:**
-```bash
-socketcli --enable-json \
-          --sarif-file results.sarif \
-          --enable-gitlab-security \
-          --repo owner/repo
-```
-
-This will simultaneously generate:
-- JSON output to console
-- SARIF report to `results.sarif` (and stdout)
-- GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
-
-> **Note:** `--enable-sarif` prints SARIF to stdout only. Use `--sarif-file <path>` to save to a file (this also implies `--enable-sarif`). Add `--sarif-reachable-only` (requires `--reach`) to filter results down to only reachable findings — useful for uploading to GitHub Code Scanning without noisy alerts on unreachable vulns. These flags are independent from `--enable-gitlab-security`, which produces a separate GitLab-specific Dependency Scanning report.
-
-### Requirements
-
-- Both `--sub-path` and `--workspace-name` must be specified together
-- `--sub-path` can be used multiple times to include multiple directories
-- All specified sub-paths must exist within the target-path
-
-## Usage
-
-```` shell
-socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
-          [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
-          [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
-          [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
-          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
-          [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-reachable-only] [--enable-gitlab-security] [--gitlab-security-file <path>]
-          [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
-          [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
-          [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
-          [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-exclude-paths REACH_EXCLUDE_PATHS]
-          [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-output-file REACH_OUTPUT_FILE]
-          [--only-facts-file] [--version]
-````
-
-If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_TOKEN`
-
-### Parameters
-
-#### Authentication
-| Parameter   | Required | Default | Description                                                                       |
-|:------------|:---------|:--------|:----------------------------------------------------------------------------------|
-| --api-token | False    |         | Socket Security API token (can also be set via SOCKET_SECURITY_API_TOKEN env var) |
-
-#### Repository
-| Parameter        | Required | Default | Description                                                                                                       |
-|:-----------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------|
-| --repo           | False    | *auto*  | Repository name in owner/repo format (auto-detected from git remote)                                             |
-| --workspace      | False    |         | The Socket workspace to associate the scan with (e.g. `my-org` in `my-org/my-repo`). See note below.           |
-| --repo-is-public | False    | False   | If set, flags a new repository creation as public. Defaults to false.                                            |
-| --integration    | False    | api     | Integration type (api, github, gitlab, azure, bitbucket)                                                         |
-| --owner          | False    |         | Name of the integration owner, defaults to the socket organization slug                                          |
-| --branch         | False    | *auto*  | Branch name (auto-detected from git)                                                                             |
-| --committers     | False    | *auto*  | Committer(s) to filter by (auto-detected from git commit)                                                        |
-
-> **`--workspace` vs `--workspace-name`** — these are two distinct flags for different purposes:
->
-> - **`--workspace <string>`** maps to the Socket API's `workspace` query parameter on `CreateOrgFullScan`. Use it when your repository belongs to a named Socket workspace (e.g. an org with multiple workspace groups). Example: `--repo my-repo --workspace my-org`. Without this flag, scans are created without workspace context and may not appear under the correct workspace in the Socket dashboard.
->
-> - **`--workspace-name <string>`** is a monorepo feature. It appends a suffix to the repository slug to create a unique name in Socket (e.g. `my-repo-frontend`). It must always be paired with `--sub-path` and has nothing to do with the API `workspace` field. See [Monorepo Workspace Support](#monorepo-workspace-support) below.
-
-#### Pull Request and Commit
-| Parameter        | Required | Default | Description                                    |
-|:-----------------|:---------|:--------|:-----------------------------------------------|
-| --pr-number      | False    | "0"     | Pull request number                            |
-| --commit-message | False    | *auto*  | Commit message (auto-detected from git)       |
-| --commit-sha     | False    | *auto*  | Commit SHA (auto-detected from git)           |
-
-#### Path and File
-| Parameter                   | Required | Default               | Description                                                                                                                                                                      |
-|:----------------------------|:---------|:----------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| --target-path               | False    | ./                    | Target path for analysis                                                                                                                                                         |
-| --sbom-file                 | False    |                       | SBOM file path                                                                                                                                                                   |
-| --license-file-name         | False    | `license_output.json` | Name of the file to save the license details to if enabled                                                                                                                       |
-| --save-submitted-files-list | False    |                       | Save list of submitted file names to JSON file for debugging purposes                                                                                                            |
-| --save-manifest-tar         | False    |                       | Save all manifest files to a compressed tar.gz archive with original directory structure                                                                                         |
-| --files                     | False    | *auto*                | Files to analyze (JSON array string). Auto-detected from git commit changes when not specified                                                                                   |
-| --sub-path                  | False    |                       | Sub-path within target-path for manifest file scanning (can be specified multiple times). All sub-paths are combined into a single workspace scan while preserving git context from target-path. Must be used with --workspace-name |
-| --workspace-name            | False    |                       | Workspace name suffix to append to repository name (repo-name-workspace_name). Must be used with --sub-path                                                                     |
-| --excluded-ecosystems       | False    | []                    | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
-
-#### Branch and Scan Configuration
-| Parameter                | Required | Default | Description                                                                                           |
-|:-------------------------|:---------|:--------|:------------------------------------------------------------------------------------------------------|
-| --default-branch         | False    | *auto*  | Make this branch the default branch (auto-detected from git and CI environment when not specified)   |
-| --pending-head           | False    | *auto*  | If true, the new scan will be set as the branch's head scan (automatically synced with default-branch) |
-| --include-module-folders | False    | False   | If enabled will include manifest files from folders like node_modules                                |
-
-#### Output Configuration
-| Parameter                 | Required | Default | Description                                                                       |
-|:--------------------------|:---------|:--------|:----------------------------------------------------------------------------------|
-| --generate-license        | False    | False   | Generate license information                                                      |
-| --enable-debug            | False    | False   | Enable debug logging                                                              |
-| --enable-json             | False    | False   | Output in JSON format                                                             |
-| --enable-sarif            | False    | False   | Enable SARIF output of results instead of table or JSON format (prints to stdout) |
-| --sarif-file              | False    |         | Output file path for SARIF report (implies --enable-sarif). Use this to save SARIF output to a file for upload to GitHub Code Scanning, SonarQube, VS Code, or other SARIF-compatible tools |
-| --sarif-reachable-only    | False    | False   | Filter SARIF output to only include reachable findings (requires --reach)         |
-| --enable-gitlab-security  | False    | False   | Enable GitLab Security Dashboard output format (Dependency Scanning report)       |
-| --gitlab-security-file    | False    | gl-dependency-scanning-report.json | Output file path for GitLab Security report                |
-| --disable-overview        | False    | False   | Disable overview output                                                           |
-| --exclude-license-details | False    | False   | Exclude license details from the diff report (boosts performance for large repos) |
-| --version                 | False    | False   | Show program's version number and exit                                            |
-
-#### Security Configuration
-| Parameter                | Required | Default | Description                   |
-|:-------------------------|:---------|:--------|:------------------------------|
-| --allow-unverified       | False    | False   | Allow unverified packages     |
-| --disable-security-issue | False    | False   | Disable security issue checks |
-
-#### Reachability Analysis
-| Parameter                        | Required | Default | Description                                                                                                                |
-|:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
-| --reach                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code                       |
-| --reach-version                  | False    | latest  | Version of @coana-tech/cli to use for analysis                                                                             |
-| --reach-analysis-timeout         | False    | 1200    | Timeout in seconds for the reachability analysis (default: 1200 seconds / 20 minutes)                                      |
-| --reach-analysis-memory-limit    | False    | 4096    | Memory limit in MB for the reachability analysis (default: 4096 MB / 4 GB)                                                 |
-| --reach-concurrency              | False    |         | Control parallel analysis execution (must be >= 1)                                                                         |
-| --reach-additional-params        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
-| --reach-ecosystems               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
-| --reach-exclude-paths            | False    |         | Comma-separated list of file paths or patterns to exclude from reachability analysis                                       |
-| --reach-min-severity             | False    |         | Minimum severity level for reporting reachability results (low, medium, high, critical)                                    |
-| --reach-skip-cache               | False    | False   | Skip cache and force fresh reachability analysis                                                                           |
-| --reach-disable-analytics        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
-| --reach-output-file              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
-| --only-facts-file                | False    | False   | Submit only the .socket.facts.json file to an existing scan (requires --reach and a prior scan)                            |
-
-**Reachability Analysis Requirements:**
-- `npm` - Required to install and run @coana-tech/cli
-- `npx` - Required to execute @coana-tech/cli
-- `uv` - Required for Python environment management
-
-The CLI will automatically install @coana-tech/cli if not present. Use `--reach` to enable reachability analysis during a full scan, or use `--only-facts-file` with `--reach` to submit reachability results to an existing scan.
-
-#### Advanced Configuration
-| Parameter                | Required | Default | Description                                                           |
-|:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
-| --ignore-commit-files    | False    | False   | Ignore commit files                                                   |
-| --disable-blocking       | False    | False   | Disable blocking mode                                                 |
-| --strict-blocking        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
-| --enable-diff            | False    | False   | Enable diff mode even when using --integration api (forces diff mode without SCM integration) |
-| --scm                    | False    | api     | Source control management type                                        |
-| --timeout                | False    |         | Timeout in seconds for API requests                                   |
-
-#### Plugins
-
-The Python CLI currently Supports the following plugins:
-
-- Jira
-- Slack
-
-##### Jira
-
-| Environment Variable    | Required | Default | Description                        |
-|:------------------------|:---------|:--------|:-----------------------------------|
-| SOCKET_JIRA_ENABLED     | False    | false   | Enables/Disables the Jira Plugin   |
-| SOCKET_JIRA_CONFIG_JSON | True     | None    | Required if the Plugin is enabled. |
-
-Example `SOCKET_JIRA_CONFIG_JSON` value
-
-````json
-{"url": "https://REPLACE_ME.atlassian.net", "email": "example@example.com", "api_token": "REPLACE_ME", "project": "REPLACE_ME" }
-````
-
-##### Slack
-
-| Environment Variable     | Required | Default | Description                        |
-|:-------------------------|:---------|:--------|:-----------------------------------|
-| SOCKET_SLACK_CONFIG_JSON | False    | None    | Slack configuration (enables plugin when set). Supports webhook or bot mode. Alternatively, use --slack-webhook CLI flag for simple webhook mode. |
-| SOCKET_SLACK_BOT_TOKEN   | False    | None    | Slack Bot User OAuth Token (starts with `xoxb-`). Required when using bot mode. |
-
-**Slack supports two modes:**
-
-1. **Webhook Mode** (default): Posts to incoming webhooks
-2. **Bot Mode**: Posts via Slack API with bot token authentication
-
-###### Webhook Mode Examples
-
-Simple webhook:
-
-````json
-{"url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"}
-````
-
-Multiple webhooks with advanced filtering:
-
-````json
-{
-  "mode": "webhook",
-  "url": [
-    {
-      "name": "prod_alerts",
-      "url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
-    },
-    {
-      "name": "critical_only",
-      "url": "https://hooks.slack.com/services/YOUR/OTHER/WEBHOOK/URL"
-    }
-  ],
-  "url_configs": {
-    "prod_alerts": {
-      "reachability_alerts_only": true,
-      "severities": ["high", "critical"]
-    },
-    "critical_only": {
-      "severities": ["critical"]
-    }
-  }
-}
-````
-
-###### Bot Mode Examples
-
-**Setting up a Slack Bot:**
-1. Go to https://api.slack.com/apps and create a new app
-2. Under "OAuth & Permissions", add the `chat:write` bot scope
-3. Install the app to your workspace and copy the "Bot User OAuth Token"
-4. Invite the bot to your channels: `/invite @YourBotName`
-
-Basic bot configuration:
-
-````json
-{
-  "mode": "bot",
-  "bot_configs": [
-    {
-      "name": "security_alerts",
-      "channels": ["security-alerts", "dev-team"]
-    }
-  ]
-}
-````
-
-Bot with filtering (reachability-only alerts):
-
-````json
-{
-  "mode": "bot",
-  "bot_configs": [
-    {
-      "name": "critical_reachable",
-      "channels": ["security-critical"],
-      "severities": ["critical", "high"],
-      "reachability_alerts_only": true
-    },
-    {
-      "name": "all_alerts",
-      "channels": ["security-all"],
-      "repos": ["myorg/backend", "myorg/frontend"]
-    }
-  ]
-}
-````
-
-Set the bot token:
-```bash
-export SOCKET_SLACK_BOT_TOKEN="xoxb-your-bot-token-here"
-```
-
-**Configuration Options:**
-
-Webhook mode (`url_configs`):
-- `reachability_alerts_only` (boolean, default: false): When `--reach` is enabled, only send blocking alerts (error=true) from diff scans
-- `repos` (array): Only send alerts for specific repositories (e.g., `["owner/repo1", "owner/repo2"]`)
-- `alert_types` (array): Only send specific alert types (e.g., `["malware", "typosquat"]`)
-- `severities` (array): Only send alerts with specific severities (e.g., `["high", "critical"]`)
-
-Bot mode (`bot_configs` array items):
-- `name` (string, required): Friendly name for this configuration
-- `channels` (array, required): Channel names (without #) where alerts will be posted
-- `severities` (array, optional): Only send alerts with specific severities (e.g., `["high", "critical"]`)
-- `repos` (array, optional): Only send alerts for specific repositories
-- `alert_types` (array, optional): Only send specific alert types
-- `reachability_alerts_only` (boolean, default: false): Only send reachable vulnerabilities when using `--reach`
+## Common use cases
 
-## Strict Blocking Mode
+This section covers the paved path/common workflows.
+For advanced options and exhaustive details, see [`docs/cli-reference.md`](docs/cli-reference.md).
+For CI/CD-specific guidance, see [`docs/ci-cd.md`](docs/ci-cd.md).
 
-The `--strict-blocking` flag enforces a zero-tolerance security policy by failing builds when **ANY** security violations with blocking severity exist, not just new ones introduced in the current changes.
+### Basic policy scan (no SARIF)
 
-### Standard vs Strict Blocking Behavior
-
-**Standard Behavior (Default)**:
-- ✅ Passes if no NEW violations are introduced
-- ❌ Fails only on NEW violations from your changes
-- 🟡 Existing violations are ignored
-
-**Strict Blocking Behavior (`--strict-blocking`)**:
-- ✅ Passes only if NO violations exist (new or existing)
-- ❌ Fails on ANY violation (new OR existing)
-- 🔴 Enforces zero-tolerance policy
-
-### Usage Examples
-
-**Basic strict blocking:**
 ```bash
-socketcli --target-path ./my-project --strict-blocking
+socketcli --target-path .
 ```
 
-**In GitLab CI:**
-```bash
-socketcli --target-path $CI_PROJECT_DIR --scm gitlab --pr-number ${CI_MERGE_REQUEST_IID:-0} --strict-blocking
-```
+### GitLab dependency-scanning report
 
-**In GitHub Actions:**
 ```bash
-socketcli --target-path $GITHUB_WORKSPACE --scm github --pr-number $PR_NUMBER --strict-blocking
+socketcli --enable-gitlab-security --gitlab-security-file gl-dependency-scanning-report.json
 ```
 
-### Output Differences
-
-**Standard scan output:**
-```
-Security issues detected by Socket Security:
-  - NEW blocking issues: 2
-  - NEW warning issues: 1
-```
-
-**Strict blocking scan output:**
-```
-Security issues detected by Socket Security:
-  - NEW blocking issues: 2
-  - NEW warning issues: 1
-  - EXISTING blocking issues: 5 (causing failure due to --strict-blocking)
-  - EXISTING warning issues: 3
-```
+## SARIF use cases
 
-### Use Cases
+### Full-scope reachable SARIF (grouped alerts)
 
-1. **Zero-Tolerance Security Policy**: Enforce that no security violations exist in your codebase at any time
-2. **Gradual Security Improvement**: Use alongside standard scans to monitor existing violations while blocking new ones
-3. **Protected Branch Enforcement**: Require all violations to be resolved before merging to main/production
-4. **Security Audits**: Scheduled scans that fail if any violations accumulate
-
-### Important Notes
-
-- **Diff Mode Only**: The flag only works in diff mode (with SCM integration). In API mode, a warning is logged.
-- **Error-Level Only**: Only fails on `error=True` alerts (blocking severity), not warnings.
-- **Priority**: `--disable-blocking` takes precedence - if both flags are set, the build will always pass.
-- **First Scan**: On the very first scan of a repository, there are no "existing" violations, so behavior is identical to standard mode.
-
-### Flag Combinations
-
-**Strict blocking with debugging:**
 ```bash
-socketcli --strict-blocking --enable-debug
+socketcli \
+  --reach \
+  --sarif-file results.sarif \
+  --sarif-scope full \
+  --sarif-grouping alert \
+  --sarif-reachability reachable \
+  --disable-blocking
 ```
 
-**Strict blocking with JSON output:**
-```bash
-socketcli --strict-blocking --enable-json > security-report.json
-```
+### Diff-scope reachable SARIF (PR/CI gating)
 
-**Override for testing** (passes even with violations):
 ```bash
-socketcli --strict-blocking --disable-blocking
-```
-
-### Migration Strategy
-
-**Phase 1: Assessment** - Add strict scan with `allow_failure: true` in CI
-**Phase 2: Remediation** - Fix or triage all violations
-**Phase 3: Enforcement** - Set `allow_failure: false` to block merges
-
-For complete GitLab CI/CD examples, see:
-- [`.gitlab-ci-strict-blocking-demo.yml`](.gitlab-ci-strict-blocking-demo.yml) - Comprehensive demo
-- [`.gitlab-ci-strict-blocking-production.yml`](.gitlab-ci-strict-blocking-production.yml) - Production-ready template
-- [`STRICT-BLOCKING-GITLAB-CI.md`](STRICT-BLOCKING-GITLAB-CI.md) - Full documentation
-
-## Automatic Git Detection
-
-The CLI now automatically detects repository information from your git environment, significantly simplifying usage in CI/CD pipelines:
-
-### Auto-Detected Information
-
-- **Repository name**: Extracted from git remote origin URL
-- **Branch name**: Current git branch or CI environment variables
-- **Commit SHA**: Latest commit hash or CI-provided commit SHA
-- **Commit message**: Latest commit message
-- **Committer information**: Git commit author details
-- **Default branch status**: Determined from git repository and CI environment
-- **Changed files**: Files modified in the current commit (for differential scanning)
-> **Note on merge commits**:  
-> Standard merges (two parents) are supported.  
-> For *octopus merges* (three or more parents), Git only reports changes relative to the first parent. This can lead to incomplete or empty file lists if changes only exist relative to other parents. In these cases, differential scanning may be skipped. To ensure coverage, use `--ignore-commit-files` to force a full scan or specify files explicitly with `--files`.
-### Default Branch Detection
-
-The CLI uses intelligent default branch detection with the following priority:
-
-1. **Explicit `--default-branch` flag**: Takes highest priority when specified
-2. **CI environment detection**: Uses CI platform variables (GitHub Actions, GitLab CI)
-3. **Git repository analysis**: Compares current branch with repository's default branch
-4. **Fallback**: Defaults to `false` if none of the above methods succeed
-
-Both `--default-branch` and `--pending-head` parameters are automatically synchronized to ensure consistent behavior.
-
-## GitLab Token Configuration
-
-The CLI supports GitLab integration with automatic authentication pattern detection for different token types.
-
-### Supported Token Types
-
-GitLab API supports two authentication methods, and the CLI automatically detects which one to use:
-
-1. **Bearer Token Authentication** (`Authorization: Bearer <token>`)
-   - GitLab CI Job Tokens (`$CI_JOB_TOKEN`)
-   - Personal Access Tokens with `glpat-` prefix
-   - OAuth 2.0 tokens (long alphanumeric tokens)
-
-2. **Private Token Authentication** (`PRIVATE-TOKEN: <token>`)
-   - Legacy personal access tokens
-   - Custom tokens that don't match Bearer patterns
-
-### Token Detection Logic
-
-The CLI automatically determines the authentication method using this logic:
-
-```
-if token == $CI_JOB_TOKEN:
-    use Bearer authentication
-elif token starts with "glpat-":
-    use Bearer authentication  
-elif token is long (>40 chars) and alphanumeric:
-    use Bearer authentication
-else:
-    use PRIVATE-TOKEN authentication
-```
-
-### Automatic Fallback
-
-If the initial authentication method fails with a 401 error, the CLI automatically retries with the alternative method:
-
-- **Bearer → PRIVATE-TOKEN**: If Bearer authentication fails, retry with PRIVATE-TOKEN
-- **PRIVATE-TOKEN → Bearer**: If PRIVATE-TOKEN fails, retry with Bearer authentication
-
-This ensures maximum compatibility across different GitLab configurations and token types.
-
-### Environment Variables
-
-| Variable | Description | Example |
-|:---------|:------------|:--------|
-| `GITLAB_TOKEN` | GitLab API token (required for GitLab integration) | `glpat-xxxxxxxxxxxxxxxxxxxx` |
-| `CI_JOB_TOKEN` | GitLab CI job token (automatically used in GitLab CI) | Automatically provided by GitLab CI |
-
-### Usage Examples
-
-**GitLab CI with job token (recommended):**
-```yaml
-variables:
-  GITLAB_TOKEN: $CI_JOB_TOKEN
+socketcli \
+  --reach \
+  --sarif-file results.sarif \
+  --sarif-scope diff \
+  --sarif-reachability reachable \
+  --strict-blocking
 ```
 
-**GitLab CI with personal access token:**
-```yaml
-variables:
-  GITLAB_TOKEN: $GITLAB_PERSONAL_ACCESS_TOKEN  # Set in GitLab project/group variables
-```
+### Full-scope SARIF (instance-level detail)
 
-**Local development:**
 ```bash
-export GITLAB_TOKEN="glpat-your-personal-access-token"
-socketcli --integration gitlab --repo owner/repo --pr-number 123
+socketcli \
+  --reach \
+  --sarif-file results.sarif \
+  --sarif-scope full \
+  --sarif-grouping instance \
+  --sarif-reachability all \
+  --disable-blocking
 ```
 
-### Scan Behavior
-
-The CLI determines scanning behavior intelligently:
-
-- **Manifest files changed**: Performs differential scan with PR/MR comments when supported
-- **No manifest files changed**: Creates full repository scan report without waiting for diff results
-- **Force API mode**: When no supported manifest files are detected, automatically enables non-blocking mode
-
-## File Selection Behavior
-
-The CLI determines which files to scan based on the following logic:
-
-1. **Git Commit Files (Default)**: The CLI automatically checks files changed in the current git commit. If any of these files match supported manifest patterns (like package.json, requirements.txt, etc.), a scan is triggered.
-
-2. **`--files` Parameter Override**: When specified, this parameter takes precedence over git commit detection. It accepts a JSON array of file paths to check for manifest files.
+## Choose your mode
 
-3. **`--ignore-commit-files` Flag**: When set, git commit files are ignored completely, and the CLI will scan all manifest files in the target directory regardless of what changed.
+| Use case | Recommended mode | Key flags |
+|:--|:--|:--|
+| Basic policy enforcement in CI | Diff-based policy check | `--strict-blocking` |
+| Reachable-focused SARIF for reporting | Full-scope grouped SARIF | `--reach --sarif-scope full --sarif-grouping alert --sarif-reachability reachable --sarif-file <path>` |
+| Detailed reachability export for investigations | Full-scope instance SARIF | `--reach --sarif-scope full --sarif-grouping instance --sarif-reachability all --sarif-file <path>` |
+| Net-new PR findings only | Diff-scope SARIF | `--reach --sarif-scope diff --sarif-reachability reachable --sarif-file <path>` |
 
-4. **Automatic Fallback**: If no manifest files are found in git commit changes and no `--files` are specified, the CLI automatically switches to "API mode" and performs a full repository scan.
+Dashboard parity note:
+- Full-scope SARIF is the closest match for dashboard-style filtering.
+- Exact result counts can still differ from the dashboard due to backend/API consolidation differences and grouping semantics.
+- See [`docs/troubleshooting.md#dashboard-vs-cli-result-counts`](docs/troubleshooting.md#dashboard-vs-cli-result-counts).
 
-> **Important**: The CLI doesn't scan only the specified files - it uses them to determine whether a scan should be performed and what type of scan to run. When triggered, it searches the entire `--target-path` for all supported manifest files.
+## Config files (`--config`)
 
-### Scanning Modes
+Use `--config <path>` with `.toml` or `.json` to avoid long command lines.
 
-- **Differential Mode**: When manifest files are detected in changes, performs a diff scan with PR/MR comment integration
-- **API Mode**: When no manifest files are in changes, creates a full scan report without PR comments but still scans the entire repository
-- **Force Mode**: With `--ignore-commit-files`, always performs a full scan regardless of changes
-- **Forced Diff Mode**: With `--enable-diff`, forces differential mode even when using `--integration api` (without SCM integration)
+Precedence order:
 
-### Examples
+`CLI flags` > `environment variables` > `config file` > `built-in defaults`
 
-- **Commit with manifest file**: If your commit includes changes to `package.json`, a differential scan will be triggered automatically with PR comment integration.
-- **Commit without manifest files**: If your commit only changes non-manifest files (like `.github/workflows/socket.yaml`), the CLI automatically switches to API mode and performs a full repository scan.
-- **Using `--files`**: If you specify `--files '["package.json"]'`, the CLI will check if this file exists and is a manifest file before determining scan type.
-- **Using `--ignore-commit-files`**: This forces a full scan of all manifest files in the target path, regardless of what's in your commit.
-- **Using `--enable-diff`**: Forces diff mode without SCM integration - useful when you want differential scanning but are using `--integration api`. For example: `socketcli --integration api --enable-diff --target-path /path/to/repo`
-- **Auto-detection**: Most CI/CD scenarios now work with just `socketcli --target-path /path/to/repo --scm github --pr-number $PR_NUM`
+Example:
 
-## Debugging and Troubleshooting
-
-### Saving Submitted Files List
-
-The CLI provides a debugging option to save the list of files that were submitted for scanning:
-
-```bash
-socketcli --save-submitted-files-list submitted_files.json
+```toml
+[socketcli]
+repo = "example-repo"
+reach = true
+sarif_scope = "full"
+sarif_grouping = "alert"
+sarif_reachability = "reachable"
+sarif_file = "reachable.sarif"
 ```
 
-This will create a JSON file containing:
-- Timestamp of when the scan was performed
-- Total number of files submitted
-- Total size of all files (in bytes and human-readable format)
-- Complete list of file paths that were found and submitted for scanning
+Equivalent JSON:
 
-Example output file:
 ```json
 {
-  "timestamp": "2025-01-22 10:30:45 UTC",
-  "total_files": 3,
-  "total_size_bytes": 2048,
-  "total_size_human": "2.00 KB",
-  "files": [
-    "./package.json",
-    "./requirements.txt",
-    "./Pipfile"
-  ]
+  "socketcli": {
+    "repo": "example-repo",
+    "reach": true,
+    "sarif_scope": "full",
+    "sarif_grouping": "alert",
+    "sarif_reachability": "reachable",
+    "sarif_file": "reachable.sarif"
+  }
 }
 ```
 
-This feature is useful for:
-- **Debugging**: Understanding which files the CLI found and submitted
-- **Verification**: Confirming that expected manifest files are being detected
-- **Size Analysis**: Understanding the total size of manifest files being uploaded
-- **Troubleshooting**: Identifying why certain files might not be included in scans or if size limits are being hit
-
-> **Note**: This option works with both differential scans (when git commits are detected) and full scans (API mode).
-
-### Saving Manifest Files Archive
-
-For backup, sharing, or analysis purposes, you can save all manifest files to a compressed tar.gz archive:
+Run:
 
 ```bash
-socketcli --save-manifest-tar manifest_files.tar.gz
+socketcli --config .socketcli.toml --target-path .
 ```
 
-This will create a compressed archive containing all the manifest files that were found and submitted for scanning, preserving their original directory structure relative to the scanned directory.
+Reference sample configs:
 
-Example usage with other options:
-```bash
-# Save both files list and archive
-socketcli --save-submitted-files-list files.json --save-manifest-tar backup.tar.gz
-
-# Use with specific target path
-socketcli --target-path ./my-project --save-manifest-tar my-project-manifests.tar.gz
-```
+TOML:
+- [`examples/config/sarif-dashboard-parity.toml`](examples/config/sarif-dashboard-parity.toml)
+- [`examples/config/sarif-instance-detail.toml`](examples/config/sarif-instance-detail.toml)
+- [`examples/config/sarif-diff-ci-cd.toml`](examples/config/sarif-diff-ci-cd.toml)
 
-The manifest archive feature is useful for:
-- **Backup**: Creating portable backups of all dependency manifest files
-- **Sharing**: Sending the exact files being analyzed to colleagues or support
-- **Analysis**: Examining the dependency files offline or with other tools
-- **Debugging**: Verifying file discovery and content issues
-- **Compliance**: Maintaining records of scanned dependency files
+JSON:
+- [`examples/config/sarif-dashboard-parity.json`](examples/config/sarif-dashboard-parity.json)
+- [`examples/config/sarif-instance-detail.json`](examples/config/sarif-instance-detail.json)
+- [`examples/config/sarif-diff-ci-cd.json`](examples/config/sarif-diff-ci-cd.json)
 
-> **Note**: The tar.gz archive preserves the original directory structure, making it easy to extract and examine the files in their proper context.
+## CI/CD examples
 
-### Differential scan skipped on octopus merge
+Prebuilt workflow examples:
 
-When your repo uses an **octopus merge** (3+ parents), the CLI may not detect all changed files.
-This is expected Git behavior: the default diff only compares the merge result to the first parent.
+- [GitHub Actions](workflows/github-actions.yml)
+- [Buildkite](workflows/buildkite.yml)
+- [GitLab CI](workflows/gitlab-ci.yml)
+- [Bitbucket Pipelines](workflows/bitbucket-pipelines.yml)
 
-## GitLab Security Dashboard Integration
-
-Socket CLI can generate reports compatible with GitLab's Security Dashboard, allowing vulnerability information to be displayed directly in merge requests and security dashboards. This feature complements the existing [Socket GitLab integration](https://docs.socket.dev/docs/gitlab) by providing standardized dependency scanning reports.
-
-### Generating GitLab Security Reports
-
-To generate a GitLab-compatible security report:
-
-```bash
-socketcli --enable-gitlab-security --repo owner/repo
-```
-
-This creates a `gl-dependency-scanning-report.json` file following GitLab's Dependency Scanning report schema.
-
-### GitLab CI/CD Integration
-
-Add Socket Security scanning to your GitLab CI pipeline to generate Security Dashboard reports:
+Minimal pattern:
 
 ```yaml
-# .gitlab-ci.yml
-socket_security_scan:
-  stage: security
-  image: python:3.11
-  before_script:
-    - pip install socketsecurity
-  script:
-    - socketcli
-        --api-token $SOCKET_API_TOKEN
-        --repo $CI_PROJECT_PATH
-        --branch $CI_COMMIT_REF_NAME
-        --commit-sha $CI_COMMIT_SHA
-        --enable-gitlab-security
-  artifacts:
-    reports:
-      dependency_scanning: gl-dependency-scanning-report.json
-    paths:
-      - gl-dependency-scanning-report.json
-    expire_in: 1 week
-  only:
-    - merge_requests
-    - main
-```
-
-**Note**: This Security Dashboard integration can be used alongside the [Socket GitLab App](https://docs.socket.dev/docs/gitlab) for comprehensive protection:
-- **Socket GitLab App**: Real-time PR comments, policy enforcement, and blocking
-- **Security Dashboard**: Centralized vulnerability tracking and reporting in GitLab's native interface
-
-### Custom Output Path
-
-Specify a custom output path for the GitLab security report:
-
-```bash
-socketcli --enable-gitlab-security --gitlab-security-file custom-path.json
-```
-
-### Multiple Output Formats
-
-GitLab security reports can be generated alongside other output formats:
-
-```bash
-socketcli --enable-json --enable-gitlab-security --sarif-file results.sarif
-```
-
-This command will:
-- Output JSON format to console
-- Save GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
-- Save SARIF report to `results.sarif`
-
-### Security Dashboard Features
-
-The GitLab Security Dashboard will display:
-- **Vulnerability Severity**: Critical, High, Medium, Low levels
-- **Affected Packages**: Package name, version, and ecosystem
-- **CVE Identifiers**: Direct links to CVE databases when available
-- **Dependency Chains**: Distinction between direct and transitive dependencies
-- **Remediation Suggestions**: Fix recommendations from Socket Security
-- **Alert Categories**: Supply chain risks, malware, vulnerabilities, and more
-
-### Alert Filtering
-
-The GitLab report includes **actionable security alerts** based on your Socket policy configuration:
-
-**Included Alerts** ✅:
-- **Error-level alerts** (`error: true`) - Security policy violations that block merges
-- **Warning-level alerts** (`warn: true`) - Important security concerns requiring attention
-
-**Excluded Alerts** ❌:
-- **Ignored alerts** (`ignore: true`) - Alerts explicitly ignored in your policy
-- **Monitor-only alerts** (`monitor: true` without error/warn) - Tracked but not actionable
-
-**Socket Alert Types Detected**:
-- Supply chain risks (malware, typosquatting, suspicious behavior)
-- Security vulnerabilities (CVEs, unsafe code patterns)
-- Risky permissions (network access, filesystem access, shell access)
-- License policy violations
-
-All alert types are included in the GitLab report if they're marked as `error` or `warn` by your Socket Security policy, ensuring the Security Dashboard shows only actionable findings.
-
-### Report Schema
-
-Socket CLI generates reports compliant with [GitLab Dependency Scanning schema version 15.0.0](https://docs.gitlab.com/ee/development/integrations/secure.html). The reports include:
-
-- **Scan metadata**: Analyzer and scanner information
-- **Vulnerabilities**: Detailed vulnerability data with:
-  - Unique deterministic UUIDs for tracking
-  - Package location and dependency information
-  - Severity levels mapped from Socket's analysis
-  - Socket-specific alert types and CVE identifiers
-  - Links to Socket.dev for detailed analysis
-
-### Requirements
-
-- **GitLab Version**: GitLab 12.0 or later (for Security Dashboard support)
-- **Socket API Token**: Set via `$SOCKET_API_TOKEN` environment variable or `--api-token` parameter
-- **CI/CD Artifacts**: Reports must be uploaded as `dependency_scanning` artifacts
-
-### Troubleshooting
-
-**Report not appearing in Security Dashboard:**
-- Verify the artifact is correctly configured in `.gitlab-ci.yml`
-- Check that the job succeeded and artifacts were uploaded
-- Ensure the report file follows the correct schema format
-
-**Empty vulnerabilities array:**
-- This is normal if no new security issues were detected
-- Check Socket.dev dashboard for full analysis details
-
-## Development
-
-This project uses `pyproject.toml` as the primary dependency specification.
-
-### Development Workflows
-
-The following Make targets provide streamlined workflows for common development tasks:
-
-#### Initial Setup (Choose One)
-
-1. Standard Setup (using PyPI packages):
-```bash
-pyenv local 3.11  # Ensure correct Python version
-make first-time-setup
+- name: Run Socket CLI
+  run: socketcli --config .socketcli.toml --target-path .
+  env:
+    SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
 ```
 
-2. Local Development Setup (for SDK development):
-```bash
-pyenv local 3.11  # Ensure correct Python version
-SOCKET_SDK_PATH=~/path/to/socketdev make first-time-local-setup
-```
-The default SDK path is `../socketdev` if not specified.
-
-#### Ongoing Development Tasks
-
-After changing dependencies in pyproject.toml:
-```bash
-make update-deps
-```
-
-After pulling changes:
-```bash
-make sync-all
-```
-
-### Available Make targets:
-
-High-level workflows:
-- `make first-time-setup`: Complete setup using PyPI packages
-- `make first-time-local-setup`: Complete setup for local SDK development
-- `make update-lock`: Update uv.lock file after changing pyproject.toml
-- `make sync-all`: Sync dependencies after pulling changes
-- `make dev-setup`: Setup for local development (included in first-time-local-setup)
+## Common gotchas
 
-Implementation targets:
-- `make local-dev`: Installs dependencies needed for local development
-- `make setup`: Creates virtual environment and installs dependencies from uv.lock
-- `make sync`: Installs exact versions from uv.lock
-- `make clean`: Removes virtual environment and cache files
-- `make test`: Runs pytest suite using uv run
-- `make lint`: Runs ruff for code formatting and linting using uv run
+See [`docs/troubleshooting.md`](docs/troubleshooting.md#common-gotchas).
 
-### Environment Variables
+## Quick verification checks
 
-#### Core Configuration
-- `SOCKET_SECURITY_API_TOKEN`: Socket Security API token (alternative to --api-token parameter)
-  - For backwards compatibility, also accepts: `SOCKET_SECURITY_API_KEY`, `SOCKET_API_KEY`, `SOCKET_API_TOKEN`
-- `SOCKET_SDK_PATH`: Path to local socketdev repository (default: ../socketdev)
+After generating SARIF files, validate shape/count quickly:
 
-#### GitLab Integration
-- `GITLAB_TOKEN`: GitLab API token for GitLab integration (supports both Bearer and PRIVATE-TOKEN authentication)
-- `CI_JOB_TOKEN`: GitLab CI job token (automatically provided in GitLab CI environments)
-
-### Manual Development Environment Setup
-
-For manual setup without using the Make targets, follow these steps:
-
-1. **Create a virtual environment:**
-```bash
-python -m venv .venv
-```
-
-2. **Activate the virtual environment:**
 ```bash
-source .venv/bin/activate
+jq '.runs[0].results | length' results.sarif
+jq -r '.runs[0].results[]?.properties.reachability' results.sarif | sort -u
 ```
 
-3. **Sync dependencies with uv:**
-```bash
-uv sync
-```
-
-4. **Install pre-commit:**
-```bash
-uv add --dev pre-commit
-```
+For side-by-side comparisons:
 
-5. **Register the pre-commit hook:**
 ```bash
-pre-commit install
+jq '.runs[0].results | length' sarif-dashboard-parity-reachable.sarif
+jq '.runs[0].results | length' sarif-full-instance-all.sarif
+jq '.runs[0].results | length' sarif-diff-reachable.sarif
 ```
 
-> **Note**: This manual setup is an alternative to the streamlined Make targets described above. For most development workflows, using `make first-time-setup` or `make first-time-local-setup` is recommended.
+## Documentation reference
 
+- Full CLI reference: [`docs/cli-reference.md`](docs/cli-reference.md)
+- CI/CD guide: [`docs/ci-cd.md`](docs/ci-cd.md)
+- Troubleshooting guide: [`docs/troubleshooting.md`](docs/troubleshooting.md)
+- Development guide: [`docs/development.md`](docs/development.md)
diff --git a/docs/README.md b/docs/README.md
deleted file mode 100644
index e6826fa..0000000
--- a/docs/README.md
+++ /dev/null
@@ -1,10 +0,0 @@
-# 1. Clone the repo and create a virtualenv (Python 3.12+)
-python3.12 -m venv .venv
-source .venv/bin/activate
-
-# 2. Install dependencies
-pip install --upgrade pip
-pip install .[dev]
-
-# 3. Set up pre-commit hooks
-pre-commit install
diff --git a/docs/ci-cd.md b/docs/ci-cd.md
new file mode 100644
index 0000000..edf3a4e
--- /dev/null
+++ b/docs/ci-cd.md
@@ -0,0 +1,119 @@
+# CI/CD guide
+
+Use this guide for pipeline-focused CLI usage across platforms.
+
+## Recommended patterns
+
+### Dashboard-style reachable SARIF
+
+```bash
+socketcli \
+  --reach \
+  --sarif-file results.sarif \
+  --sarif-scope full \
+  --sarif-grouping alert \
+  --sarif-reachability reachable \
+  --disable-blocking
+```
+
+### Diff-based gating on new reachable findings
+
+```bash
+socketcli \
+  --reach \
+  --sarif-file results.sarif \
+  --sarif-scope diff \
+  --sarif-reachability reachable \
+  --strict-blocking
+```
+
+## Config file usage in CI
+
+Use `--config .socketcli.toml` or `--config .socketcli.json` to keep pipeline commands small.
+
+Precedence order:
+
+`CLI flags` > `environment variables` > `config file` > `built-in defaults`
+
+Example:
+
+```toml
+[socketcli]
+reach = true
+sarif_scope = "full"
+sarif_grouping = "alert"
+sarif_reachability = "reachable"
+sarif_file = "results.sarif"
+```
+
+Equivalent JSON:
+
+```json
+{
+  "socketcli": {
+    "reach": true,
+    "sarif_scope": "full",
+    "sarif_grouping": "alert",
+    "sarif_reachability": "reachable",
+    "sarif_file": "results.sarif"
+  }
+}
+```
+
+## Platform examples
+
+### GitHub Actions
+
+```yaml
+- name: Run Socket CLI
+  run: socketcli --config .socketcli.toml --target-path .
+  env:
+    SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
+```
+
+### Buildkite
+
+```yaml
+steps:
+  - label: "Socket scan"
+    command: "socketcli --config .socketcli.toml --target-path ."
+    env:
+      SOCKET_SECURITY_API_TOKEN: "${SOCKET_SECURITY_API_TOKEN}"
+```
+
+### GitLab CI
+
+```yaml
+socket_scan:
+  script:
+    - socketcli --config .socketcli.toml --target-path .
+  variables:
+    SOCKET_SECURITY_API_TOKEN: $SOCKET_SECURITY_API_TOKEN
+```
+
+### Bitbucket Pipelines
+
+```yaml
+pipelines:
+  default:
+    - step:
+        script:
+          - socketcli --config .socketcli.toml --target-path .
+```
+
+## Workflow templates
+
+Prebuilt examples in this repo:
+
+- [`../workflows/github-actions.yml`](../workflows/github-actions.yml)
+- [`../workflows/buildkite.yml`](../workflows/buildkite.yml)
+- [`../workflows/gitlab-ci.yml`](../workflows/gitlab-ci.yml)
+- [`../workflows/bitbucket-pipelines.yml`](../workflows/bitbucket-pipelines.yml)
+
+## CI gotchas
+
+- `--strict-blocking` enables strict diff behavior (`new + unchanged`) for blocking evaluation and diff-based output selection.
+- `--sarif-scope full` requires `--reach`.
+- `--sarif-grouping alert` currently applies to `--sarif-scope full`.
+- Diff-based SARIF can validly be empty when there are no matching net-new alerts.
+- Keep API tokens in secret stores (`SOCKET_SECURITY_API_TOKEN`), not in config files.
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
new file mode 100644
index 0000000..0c807f7
--- /dev/null
+++ b/docs/cli-reference.md
@@ -0,0 +1,734 @@
+# Socket Security CLI: Full Reference
+
+> This is the comprehensive reference document.  
+> For first-time setup and common workflows, start with [`../README.md`](../README.md).
+
+The Socket Security CLI was created to enable integrations with other tools like GitHub Actions, Buildkite, GitLab, Bitbucket, local use cases and more. The tool will get the head scan for the provided repo from Socket, create a new one, and then report any new alerts detected. If there are new alerts with blocking actions it'll exit with a non-Zero exit code.
+
+## Quick Start
+
+The CLI now features automatic detection of git repository information, making it much simpler to use in CI/CD environments. Most parameters are now optional and will be detected automatically from your git repository.
+
+### Minimal Usage Examples
+
+**GitHub Actions:**
+```bash
+socketcli --target-path $GITHUB_WORKSPACE --scm github --pr-number $PR_NUMBER
+```
+
+**Buildkite:**
+```bash
+socketcli --target-path ${BUILDKITE_BUILD_CHECKOUT_PATH:-.} --scm api --pr-number ${BUILDKITE_PULL_REQUEST:-0}
+```
+
+**GitLab CI:**
+```bash
+socketcli --target-path $CI_PROJECT_DIR --scm gitlab --pr-number ${CI_MERGE_REQUEST_IID:-0}
+```
+
+**Bitbucket Pipelines:**
+```bash
+socketcli --target-path $BITBUCKET_CLONE_DIR --scm api --pr-number ${BITBUCKET_PR_ID:-0}
+```
+
+**Local Development:**
+```bash
+socketcli --target-path ./my-project
+```
+
+The CLI will automatically detect:
+- Repository name from git remote
+- Branch name from git
+- Commit SHA and message from git
+- Committer information from git
+- Default branch status from git and CI environment
+- Changed files from git commit history
+
+## CI/CD Workflow Examples
+
+CI/CD-focused usage and platform examples are documented in [`ci-cd.md`](ci-cd.md).
+Pre-configured workflow files are in [`../workflows/`](../workflows/).
+
+## Monorepo Workspace Support
+
+> **Note:** If you're looking to associate a scan with a named Socket workspace (e.g. because your repo is identified as `org/repo`), see the [`--workspace` flag](#repository) instead. The `--workspace-name` flag described in this section is an unrelated monorepo feature.
+
+The Socket CLI supports scanning specific workspaces within monorepo structures while preserving git context from the repository root. This is useful for organizations that maintain multiple applications or services in a single repository.
+
+### Key Features
+
+- **Multiple Sub-paths**: Specify multiple `--sub-path` options to scan different directories within your monorepo
+- **Combined Workspace**: All sub-paths are scanned together as a single workspace in Socket
+- **Git Context Preserved**: Repository metadata (commits, branches, etc.) comes from the main target-path
+- **Workspace Naming**: Use `--workspace-name` to differentiate scans from different parts of your monorepo
+
+### Usage Examples
+
+**Scan multiple frontend and backend workspaces:**
+```bash
+socketcli --target-path /path/to/monorepo \
+          --sub-path frontend \
+          --sub-path backend \
+          --sub-path services/api \
+          --workspace-name main-app
+```
+
+**GitHub Actions for monorepo workspace:**
+```bash
+socketcli --target-path $GITHUB_WORKSPACE \
+          --sub-path packages/web \
+          --sub-path packages/mobile \
+          --workspace-name mobile-web \
+          --scm github \
+          --pr-number $PR_NUMBER
+```
+
+This will:
+- Scan manifest files in `./packages/web/` and `./packages/mobile/`
+- Combine them into a single workspace scan
+- Create a repository in Socket named like `my-repo-mobile-web`
+- Preserve git context (commits, branch info) from the repository root
+
+**Generate GitLab Security Dashboard report:**
+```bash
+socketcli --enable-gitlab-security \
+          --repo owner/repo \
+          --target-path .
+```
+
+This will:
+- Scan all manifest files in the current directory
+- Generate a GitLab-compatible Dependency Scanning report
+- Save to `gl-dependency-scanning-report.json`
+- Include all actionable security alerts (error/warn level)
+
+**Save SARIF report to file (e.g. for GitHub Code Scanning, SonarQube, or VS Code):**
+```bash
+socketcli --sarif-file results.sarif \
+          --repo owner/repo \
+          --target-path .
+```
+
+**Multiple output formats:**
+```bash
+socketcli --enable-json \
+          --sarif-file results.sarif \
+          --enable-gitlab-security \
+          --repo owner/repo
+```
+
+This will simultaneously generate:
+- JSON output to console
+- SARIF report to `results.sarif` (and stdout)
+- GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
+
+> **Note:** `--enable-sarif` prints SARIF to stdout only. Use `--sarif-file <path>` to save to a file (this also implies `--enable-sarif`). Use `--sarif-reachability` (requires `--reach` when not `all`) to filter by reachability state. Use `--sarif-scope diff|full` to choose between diff alerts (default) and full reachability facts scope. These flags are independent from `--enable-gitlab-security`, which produces a separate GitLab-specific Dependency Scanning report.
+>
+> In diff scope, `--strict-blocking` expands selection to include `new + unchanged` diff alerts for evaluation/output paths.
+>
+> SARIF scope examples:
+> - Diff-only reachable findings: `socketcli --reach --sarif-file out.sarif --sarif-scope diff --sarif-reachability reachable`
+> - Full reachability scope, reachable only: `socketcli --reach --sarif-file out.sarif --sarif-scope full --sarif-reachability reachable`
+> - Full reachability scope, all reachability states: `socketcli --reach --sarif-file out.sarif --sarif-scope full`
+> - Dashboard-style grouping (one result per alert key): `socketcli --reach --sarif-file out.sarif --sarif-scope full --sarif-grouping alert --sarif-reachability reachable`
+>
+> In `--sarif-scope full` mode with `--sarif-file`, SARIF JSON is written to file and stdout JSON is suppressed to avoid oversized CI logs.
+
+### Requirements
+
+- Both `--sub-path` and `--workspace-name` must be specified together
+- `--sub-path` can be used multiple times to include multiple directories
+- All specified sub-paths must exist within the target-path
+
+## Usage
+
+```` shell
+socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
+          [--config <path>]
+          [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
+          [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
+          [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
+          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
+          [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-scope {diff,full}] [--sarif-grouping {instance,alert}] [--sarif-reachability {all,reachable,potentially,reachable-or-potentially}] [--enable-gitlab-security] [--gitlab-security-file <path>]
+          [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
+          [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
+          [--reach] [--reach-version REACH_VERSION] [--reach-timeout REACH_ANALYSIS_TIMEOUT]
+          [--reach-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-exclude-paths REACH_EXCLUDE_PATHS]
+          [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-output-file REACH_OUTPUT_FILE]
+          [--only-facts-file] [--version]
+````
+
+If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_TOKEN`
+
+### Parameters
+
+#### Authentication
+| Parameter   | Required | Default | Description                                                                       |
+|:------------|:---------|:--------|:----------------------------------------------------------------------------------|
+| `--api-token` | False    |         | Socket Security API token (can also be set via SOCKET_SECURITY_API_TOKEN env var) |
+
+#### Repository
+| Parameter        | Required | Default | Description                                                                                                       |
+|:-----------------|:---------|:--------|:------------------------------------------------------------------------------------------------------------------|
+| `--repo`           | False    | *auto*  | Repository name in owner/repo format (auto-detected from git remote)                                             |
+| `--workspace`      | False    |         | The Socket workspace to associate the scan with (e.g. `my-org` in `my-org/my-repo`). See note below.           |
+| `--repo-is-public` | False    | False   | If set, flags a new repository creation as public. Defaults to false.                                            |
+| `--integration`    | False    | api     | Integration type (api, github, gitlab, azure, bitbucket)                                                         |
+| `--owner`          | False    |         | Name of the integration owner, defaults to the socket organization slug                                          |
+| `--branch`         | False    | *auto*  | Branch name (auto-detected from git)                                                                             |
+| `--committers`     | False    | *auto*  | Committer(s) to filter by (auto-detected from git commit)                                                        |
+
+> **`--workspace` vs `--workspace-name`** — these are two distinct flags for different purposes:
+>
+> - **`--workspace <string>`** maps to the Socket API's `workspace` query parameter on `CreateOrgFullScan`. Use it when your repository belongs to a named Socket workspace (e.g. an org with multiple workspace groups). Example: `--repo my-repo --workspace my-org`. Without this flag, scans are created without workspace context and may not appear under the correct workspace in the Socket dashboard.
+>
+> - **`--workspace-name <string>`** is a monorepo feature. It appends a suffix to the repository slug to create a unique name in Socket (e.g. `my-repo-frontend`). It must always be paired with `--sub-path` and has nothing to do with the API `workspace` field. See [Monorepo Workspace Support](#monorepo-workspace-support) below.
+
+#### Pull Request and Commit
+| Parameter        | Required | Default | Description                                    |
+|:-----------------|:---------|:--------|:-----------------------------------------------|
+| `--pr-number`      | False    | "0"     | Pull request number                            |
+| `--commit-message` | False    | *auto*  | Commit message (auto-detected from git)       |
+| `--commit-sha`     | False    | *auto*  | Commit SHA (auto-detected from git)           |
+
+#### Path and File
+| Parameter                   | Required | Default               | Description                                                                                                                                                                      |
+|:----------------------------|:---------|:----------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `--target-path`               | False    | ./                    | Target path for analysis                                                                                                                                                         |
+| `--sbom-file`                 | False    |                       | SBOM file path                                                                                                                                                                   |
+| `--license-file-name`         | False    | `license_output.json` | Name of the file to save the license details to if enabled                                                                                                                       |
+| `--save-submitted-files-list` | False    |                       | Save list of submitted file names to JSON file for debugging purposes                                                                                                            |
+| `--save-manifest-tar`         | False    |                       | Save all manifest files to a compressed tar.gz archive with original directory structure                                                                                         |
+| `--files`                     | False    | *auto*                | Files to analyze (JSON array string). Auto-detected from git commit changes when not specified                                                                                   |
+| `--sub-path`                  | False    |                       | Sub-path within target-path for manifest file scanning (can be specified multiple times). All sub-paths are combined into a single workspace scan while preserving git context from target-path. Must be used with `--workspace-name` |
+| `--workspace-name`            | False    |                       | Workspace name suffix to append to repository name (repo-name-workspace_name). Must be used with `--sub-path`                                                                     |
+| `--excluded-ecosystems`       | False    | []                    | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
+
+#### Branch and Scan Configuration
+| Parameter                | Required | Default | Description                                                                                           |
+|:-------------------------|:---------|:--------|:------------------------------------------------------------------------------------------------------|
+| `--default-branch`         | False    | *auto*  | Make this branch the default branch (auto-detected from git and CI environment when not specified)   |
+| `--pending-head`           | False    | *auto*  | If true, the new scan will be set as the branch's head scan (automatically synced with default-branch) |
+| `--include-module-folders` | False    | False   | If enabled will include manifest files from folders like node_modules                                |
+
+#### Output Configuration
+| Parameter                 | Required | Default | Description                                                                       |
+|:--------------------------|:---------|:--------|:----------------------------------------------------------------------------------|
+| `--generate-license`        | False    | False   | Generate license information                                                      |
+| `--enable-debug`            | False    | False   | Enable debug logging                                                              |
+| `--enable-json`             | False    | False   | Output in JSON format                                                             |
+| `--enable-sarif`            | False    | False   | Enable SARIF output of results instead of table or JSON format (prints to stdout) |
+| `--sarif-file`              | False    |         | Output file path for SARIF report (implies --enable-sarif). Use this to save SARIF output to a file for upload to GitHub Code Scanning, SonarQube, VS Code, or other SARIF-compatible tools |
+| `--sarif-scope`             | False    | diff    | SARIF source scope: `diff` for net-new diff alerts, or `full` for full reachability facts scope (requires --reach for full) |
+| `--sarif-grouping`          | False    | instance| SARIF grouping mode: `instance` (one entry per package/version/advisory instance) or `alert` (grouped alert-style output, full scope only) |
+| `--sarif-reachability`      | False    | all     | SARIF reachability selector: `all`, `reachable`, `potentially`, or `reachable-or-potentially` (requires --reach when not `all`) |
+| `--enable-gitlab-security`  | False    | False   | Enable GitLab Security Dashboard output format (Dependency Scanning report)       |
+| `--gitlab-security-file`    | False    | gl-dependency-scanning-report.json | Output file path for GitLab Security report                |
+| `--disable-overview`        | False    | False   | Disable overview output                                                           |
+| `--exclude-license-details` | False    | False   | Exclude license details from the diff report (boosts performance for large repos) |
+| `--version`                 | False    | False   | Show program's version number and exit                                            |
+
+#### Security Configuration
+| Parameter                | Required | Default | Description                   |
+|:-------------------------|:---------|:--------|:------------------------------|
+| `--allow-unverified`       | False    | False   | Allow unverified packages     |
+| `--disable-security-issue` | False    | False   | Disable security issue checks |
+
+#### Reachability Analysis
+| Parameter                        | Required | Default | Description                                                                                                                |
+|:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
+| `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code                       |
+| `--reach-version`                  | False    | latest  | Version of @coana-tech/cli to use for analysis                                                                             |
+| `--reach-timeout`                  | False    | 1200    | Timeout in seconds for the reachability analysis (default: 1200 seconds / 20 minutes)                                      |
+| `--reach-memory-limit`             | False    | 4096    | Memory limit in MB for the reachability analysis (default: 4096 MB / 4 GB)                                                 |
+| `--reach-concurrency`              | False    |         | Control parallel analysis execution (must be >= 1)                                                                         |
+| `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
+| `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
+| `--reach-exclude-paths`            | False    |         | Comma-separated list of file paths or patterns to exclude from reachability analysis                                       |
+| `--reach-min-severity`             | False    |         | Minimum severity level for reporting reachability results (low, medium, high, critical)                                    |
+| `--reach-skip-cache`               | False    | False   | Skip cache and force fresh reachability analysis                                                                           |
+| `--reach-disable-analytics`        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
+| `--reach-output-file`              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
+| `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file to an existing scan (requires --reach and a prior scan)                            |
+
+**Reachability Analysis Requirements:**
+- `npm` - Required to install and run @coana-tech/cli
+- `npx` - Required to execute @coana-tech/cli
+
+## Config file support
+
+Use `--config <path>` to load defaults from a `.toml` or `.json` file.
+CLI arguments always take precedence over config file values.
+
+Example `socketcli.toml`:
+
+```toml
+[socketcli]
+repo = "example-repo"
+reach = true
+sarif_scope = "full"
+sarif_grouping = "alert"
+sarif_reachability = "reachable"
+sarif_file = "reachable.sarif"
+```
+
+Equivalent `socketcli.json`:
+
+```json
+{
+  "socketcli": {
+    "repo": "example-repo",
+    "reach": true,
+    "sarif_scope": "full",
+    "sarif_grouping": "alert",
+    "sarif_reachability": "reachable",
+    "sarif_file": "reachable.sarif"
+  }
+}
+```
+
+Sample config files:
+- [`../examples/config/sarif-dashboard-parity.toml`](../examples/config/sarif-dashboard-parity.toml)
+- [`../examples/config/sarif-dashboard-parity.json`](../examples/config/sarif-dashboard-parity.json)
+- [`../examples/config/sarif-instance-detail.toml`](../examples/config/sarif-instance-detail.toml)
+- [`../examples/config/sarif-instance-detail.json`](../examples/config/sarif-instance-detail.json)
+- [`../examples/config/sarif-diff-ci-cd.toml`](../examples/config/sarif-diff-ci-cd.toml)
+- [`../examples/config/sarif-diff-ci-cd.json`](../examples/config/sarif-diff-ci-cd.json)
+
+### CI/CD usage tips
+
+For CI-specific examples and guidance, see [`ci-cd.md`](ci-cd.md).
+
+The CLI will automatically install `@coana-tech/cli` if not present. Use `--reach` to enable reachability analysis during a full scan, or use `--only-facts-file` with `--reach` to submit reachability results to an existing scan.
+
+#### Advanced Configuration
+| Parameter                | Required | Default | Description                                                           |
+|:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
+| `--ignore-commit-files`    | False    | False   | Ignore commit files                                                   |
+| `--disable-blocking`       | False    | False   | Disable blocking mode                                                 |
+| `--strict-blocking`        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
+| `--enable-diff`            | False    | False   | Enable diff mode even when using `--integration api` (forces diff mode without SCM integration) |
+| `--scm`                    | False    | api     | Source control management type                                        |
+| `--timeout`                | False    |         | Timeout in seconds for API requests                                   |
+
+#### Plugins
+
+The Python CLI currently supports the following plugins:
+
+- Jira
+- Slack
+
+##### Jira
+
+| Environment Variable    | Required | Default | Description                        |
+|:------------------------|:---------|:--------|:-----------------------------------|
+| `SOCKET_JIRA_ENABLED`     | False    | false   | Enables/Disables the Jira Plugin   |
+| `SOCKET_JIRA_CONFIG_JSON` | True     | None    | Required if the Plugin is enabled. |
+
+Example `SOCKET_JIRA_CONFIG_JSON` value
+
+````json
+{"url": "https://REPLACE_ME.atlassian.net", "email": "example@example.com", "api_token": "REPLACE_ME", "project": "REPLACE_ME" }
+````
+
+##### Slack
+
+| Environment Variable     | Required | Default | Description                        |
+|:-------------------------|:---------|:--------|:-----------------------------------|
+| `SOCKET_SLACK_CONFIG_JSON` | False    | None    | Slack configuration (enables plugin when set). Supports webhook or bot mode. Alternatively, use `--slack-webhook` for simple webhook mode. |
+| `SOCKET_SLACK_BOT_TOKEN`   | False    | None    | Slack Bot User OAuth Token (starts with `xoxb-`). Required when using bot mode. |
+
+**Slack supports two modes:**
+
+1. **Webhook Mode** (default): Posts to incoming webhooks
+2. **Bot Mode**: Posts via Slack API with bot token authentication
+
+###### Webhook Mode Examples
+
+Simple webhook:
+
+````json
+{"url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"}
+````
+
+Multiple webhooks with advanced filtering:
+
+````json
+{
+  "mode": "webhook",
+  "url": [
+    {
+      "name": "prod_alerts",
+      "url": "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
+    },
+    {
+      "name": "critical_only",
+      "url": "https://hooks.slack.com/services/YOUR/OTHER/WEBHOOK/URL"
+    }
+  ],
+  "url_configs": {
+    "prod_alerts": {
+      "reachability_alerts_only": true,
+      "severities": ["high", "critical"]
+    },
+    "critical_only": {
+      "severities": ["critical"]
+    }
+  }
+}
+````
+
+###### Bot Mode Examples
+
+**Setting up a Slack Bot:**
+1. Go to https://api.slack.com/apps and create a new app
+2. Under "OAuth & Permissions", add the `chat:write` bot scope
+3. Install the app to your workspace and copy the "Bot User OAuth Token"
+4. Invite the bot to your channels: `/invite @YourBotName`
+
+Basic bot configuration:
+
+````json
+{
+  "mode": "bot",
+  "bot_configs": [
+    {
+      "name": "security_alerts",
+      "channels": ["security-alerts", "dev-team"]
+    }
+  ]
+}
+````
+
+Bot with filtering (reachability-only alerts):
+
+````json
+{
+  "mode": "bot",
+  "bot_configs": [
+    {
+      "name": "critical_reachable",
+      "channels": ["security-critical"],
+      "severities": ["critical", "high"],
+      "reachability_alerts_only": true
+    },
+    {
+      "name": "all_alerts",
+      "channels": ["security-all"],
+      "repos": ["myorg/backend", "myorg/frontend"]
+    }
+  ]
+}
+````
+
+Set the bot token:
+```bash
+export SOCKET_SLACK_BOT_TOKEN="xoxb-your-bot-token-here"
+```
+
+**Configuration Options:**
+
+Webhook mode (`url_configs`):
+- `reachability_alerts_only` (boolean, default: false): When `--reach` is enabled, only send reachable vulnerabilities from the selected diff alert set (uses reachability facts when available; otherwise falls back to blocking-status behavior)
+- `repos` (array): Only send alerts for specific repositories (e.g., `["owner/repo1", "owner/repo2"]`)
+- `alert_types` (array): Only send specific alert types (e.g., `["malware", "typosquat"]`)
+- `severities` (array): Only send alerts with specific severities (e.g., `["high", "critical"]`)
+
+Bot mode (`bot_configs` array items):
+- `name` (string, required): Friendly name for this configuration
+- `channels` (array, required): Channel names (without #) where alerts will be posted
+- `severities` (array, optional): Only send alerts with specific severities (e.g., `["high", "critical"]`)
+- `repos` (array, optional): Only send alerts for specific repositories
+- `alert_types` (array, optional): Only send specific alert types
+- `reachability_alerts_only` (boolean, default: false): Only send reachable vulnerabilities when using `--reach`
+
+## Strict Blocking Mode
+
+The `--strict-blocking` flag enforces a zero-tolerance security policy by failing builds when **ANY** security violations with blocking severity exist, not just new ones introduced in the current changes.
+
+### Standard vs Strict Blocking Behavior
+
+**Standard Behavior (Default)**:
+- ✅ Passes if no NEW violations are introduced
+- ❌ Fails only on NEW violations from your changes
+- 🟡 Existing violations are ignored
+
+**Strict Blocking Behavior (`--strict-blocking`)**:
+- ✅ Passes only if NO violations exist (new or existing)
+- ❌ Fails on ANY violation (new OR existing)
+- 🔴 Enforces zero-tolerance policy
+
+### Usage Examples
+
+**Basic strict blocking:**
+```bash
+socketcli --target-path ./my-project --strict-blocking
+```
+
+**In GitHub Actions:**
+```bash
+socketcli --target-path $GITHUB_WORKSPACE --scm github --pr-number $PR_NUMBER --strict-blocking
+```
+
+**In Buildkite:**
+```bash
+socketcli --target-path ${BUILDKITE_BUILD_CHECKOUT_PATH:-.} --scm api --pr-number ${BUILDKITE_PULL_REQUEST:-0} --strict-blocking
+```
+
+**In GitLab CI:**
+```bash
+socketcli --target-path $CI_PROJECT_DIR --scm gitlab --pr-number ${CI_MERGE_REQUEST_IID:-0} --strict-blocking
+```
+
+### Output Differences
+
+**Standard scan output:**
+```
+Security issues detected by Socket Security:
+  - NEW blocking issues: 2
+  - NEW warning issues: 1
+```
+
+**Strict blocking scan output:**
+```
+Security issues detected by Socket Security:
+  - NEW blocking issues: 2
+  - NEW warning issues: 1
+  - EXISTING blocking issues: 5 (causing failure due to --strict-blocking)
+  - EXISTING warning issues: 3
+```
+
+### Use Cases
+
+1. **Zero-Tolerance Security Policy**: Enforce that no security violations exist in your codebase at any time
+2. **Gradual Security Improvement**: Use alongside standard scans to monitor existing violations while blocking new ones
+3. **Protected Branch Enforcement**: Require all violations to be resolved before merging to main/production
+4. **Security Audits**: Scheduled scans that fail if any violations accumulate
+
+### Important Notes
+
+- **Diff Mode Only**: The flag only works in diff mode (with SCM integration). In API mode, a warning is logged.
+- **Error-Level Only**: Only fails on `error=True` alerts (blocking severity), not warnings.
+- **Priority**: `--disable-blocking` takes precedence - if both flags are set, the build will always pass.
+- **First Scan**: On the very first scan of a repository, there are no "existing" violations, so behavior is identical to standard mode.
+
+### Flag Combinations
+
+**Strict blocking with debugging:**
+```bash
+socketcli --strict-blocking --enable-debug
+```
+
+**Strict blocking with JSON output:**
+```bash
+socketcli --strict-blocking --enable-json > security-report.json
+```
+
+**Override for testing** (passes even with violations):
+```bash
+socketcli --strict-blocking --disable-blocking
+```
+
+### Migration Strategy
+
+**Phase 1: Assessment** - Add strict scan with `allow_failure: true` in CI
+**Phase 2: Remediation** - Fix or triage all violations
+**Phase 3: Enforcement** - Set `allow_failure: false` to block merges
+
+For CI/CD-oriented strict-blocking examples, see [`ci-cd.md`](ci-cd.md).
+
+## Automatic Git Detection
+
+The CLI now automatically detects repository information from your git environment, significantly simplifying usage in CI/CD pipelines:
+
+### Auto-Detected Information
+
+- **Repository name**: Extracted from git remote origin URL
+- **Branch name**: Current git branch or CI environment variables
+- **Commit SHA**: Latest commit hash or CI-provided commit SHA
+- **Commit message**: Latest commit message
+- **Committer information**: Git commit author details
+- **Default branch status**: Determined from git repository and CI environment
+- **Changed files**: Files modified in the current commit (for differential scanning)
+> **Note on merge commits**:  
+> Standard merges (two parents) are supported.  
+> For *octopus merges* (three or more parents), Git only reports changes relative to the first parent. This can lead to incomplete or empty file lists if changes only exist relative to other parents. In these cases, differential scanning may be skipped. To ensure coverage, use `--ignore-commit-files` to force a full scan or specify files explicitly with `--files`.
+### Default Branch Detection
+
+The CLI uses intelligent default branch detection with the following priority:
+
+1. **Explicit `--default-branch` flag**: Takes highest priority when specified
+2. **CI environment detection**: Uses CI platform variables (GitHub Actions, GitLab CI, and Bitbucket Pipelines)
+3. **Git repository analysis**: Compares current branch with repository's default branch
+4. **Fallback**: Defaults to `false` if none of the above methods succeed
+
+Both `--default-branch` and `--pending-head` parameters are automatically synchronized to ensure consistent behavior.
+
+## GitLab Token Configuration
+
+GitLab token/auth behavior and CI examples are documented in [`ci-cd.md`](ci-cd.md).
+
+## File Selection Behavior
+
+The CLI determines which files to scan based on the following logic:
+
+1. **Git Commit Files (Default)**: The CLI automatically checks files changed in the current git commit. If any of these files match supported manifest patterns (like package.json, requirements.txt, etc.), a scan is triggered.
+
+2. **`--files` Parameter Override**: When specified, this parameter takes precedence over git commit detection. It accepts a JSON array of file paths to check for manifest files.
+
+3. **`--ignore-commit-files` Flag**: When set, git commit files are ignored completely, and the CLI will scan all manifest files in the target directory regardless of what changed.
+
+4. **Automatic Fallback**: If no manifest files are found in git commit changes and no `--files` are specified, the CLI automatically switches to "API mode" and performs a full repository scan.
+
+> **Important**: The CLI doesn't scan only the specified files - it uses them to determine whether a scan should be performed and what type of scan to run. When triggered, it searches the entire `--target-path` for all supported manifest files.
+
+### Scanning Modes
+
+- **Differential Mode**: When manifest files are detected in changes, performs a diff scan with PR/MR comment integration
+- **API Mode**: When no manifest files are in changes, creates a full scan report without PR comments but still scans the entire repository
+- **Force Mode**: With `--ignore-commit-files`, always performs a full scan regardless of changes
+- **Forced Diff Mode**: With `--enable-diff`, forces differential mode even when using `--integration api` (without SCM integration)
+
+### Examples
+
+- **Commit with manifest file**: If your commit includes changes to `package.json`, a differential scan will be triggered automatically with PR comment integration.
+- **Commit without manifest files**: If your commit only changes non-manifest files (like `.github/workflows/socket.yaml`), the CLI automatically switches to API mode and performs a full repository scan.
+- **Using `--files`**: If you specify `--files '["package.json"]'`, the CLI will check if this file exists and is a manifest file before determining scan type.
+- **Using `--ignore-commit-files`**: This forces a full scan of all manifest files in the target path, regardless of what's in your commit.
+- **Using `--enable-diff`**: Forces diff mode without SCM integration - useful when you want differential scanning but are using `--integration api`. For example: `socketcli --integration api --enable-diff --target-path /path/to/repo`
+- **Auto-detection**: Most CI/CD scenarios now work with just `socketcli --target-path /path/to/repo --scm github --pr-number $PR_NUM`
+
+## Troubleshooting
+
+Troubleshooting and debugging workflows are documented in [`troubleshooting.md`](troubleshooting.md).
+
+## GitLab Security Dashboard Integration
+
+Socket CLI can generate reports compatible with GitLab's Security Dashboard, allowing vulnerability information to be displayed directly in merge requests and security dashboards. This feature complements the existing [Socket GitLab integration](https://docs.socket.dev/docs/gitlab) by providing standardized dependency scanning reports.
+
+### Generating GitLab Security Reports
+
+To generate a GitLab-compatible security report:
+
+```bash
+socketcli --enable-gitlab-security --repo owner/repo
+```
+
+This creates a `gl-dependency-scanning-report.json` file following GitLab's Dependency Scanning report schema.
+
+### GitLab CI/CD Integration
+
+Add Socket Security scanning to your GitLab CI pipeline to generate Security Dashboard reports:
+
+```yaml
+# .gitlab-ci.yml
+socket_security_scan:
+  stage: security
+  image: python:3.11
+  before_script:
+    - pip install socketsecurity
+  script:
+    - socketcli
+        --api-token $SOCKET_API_TOKEN
+        --repo $CI_PROJECT_PATH
+        --branch $CI_COMMIT_REF_NAME
+        --commit-sha $CI_COMMIT_SHA
+        --enable-gitlab-security
+  artifacts:
+    reports:
+      dependency_scanning: gl-dependency-scanning-report.json
+    paths:
+      - gl-dependency-scanning-report.json
+    expire_in: 1 week
+  only:
+    - merge_requests
+    - main
+```
+
+**Note**: This Security Dashboard integration can be used alongside the [Socket GitLab App](https://docs.socket.dev/docs/gitlab) for comprehensive protection:
+- **Socket GitLab App**: Real-time PR comments, policy enforcement, and blocking
+- **Security Dashboard**: Centralized vulnerability tracking and reporting in GitLab's native interface
+
+### Custom Output Path
+
+Specify a custom output path for the GitLab security report:
+
+```bash
+socketcli --enable-gitlab-security --gitlab-security-file custom-path.json
+```
+
+### Multiple Output Formats
+
+GitLab security reports can be generated alongside other output formats:
+
+```bash
+socketcli --enable-json --enable-gitlab-security --sarif-file results.sarif
+```
+
+This command will:
+- Output JSON format to console
+- Save GitLab Security Dashboard report to `gl-dependency-scanning-report.json`
+- Save SARIF report to `results.sarif`
+
+### Security Dashboard Features
+
+The GitLab Security Dashboard will display:
+- **Vulnerability Severity**: Critical, High, Medium, Low levels
+- **Affected Packages**: Package name, version, and ecosystem
+- **CVE Identifiers**: Direct links to CVE databases when available
+- **Dependency Chains**: Distinction between direct and transitive dependencies
+- **Remediation Suggestions**: Fix recommendations from Socket Security
+- **Alert Categories**: Supply chain risks, malware, vulnerabilities, and more
+
+### Alert Filtering
+
+The GitLab report includes **actionable security alerts** based on your Socket policy configuration:
+
+**Included Alerts** ✅:
+- **Error-level alerts** (`error: true`) - Security policy violations that block merges
+- **Warning-level alerts** (`warn: true`) - Important security concerns requiring attention
+
+**Excluded Alerts** ❌:
+- **Ignored alerts** (`ignore: true`) - Alerts explicitly ignored in your policy
+- **Monitor-only alerts** (`monitor: true` without error/warn) - Tracked but not actionable
+
+**Socket Alert Types Detected**:
+- Supply chain risks (malware, typosquatting, suspicious behavior)
+- Security vulnerabilities (CVEs, unsafe code patterns)
+- Risky permissions (network access, filesystem access, shell access)
+- License policy violations
+
+All alert types are included in the GitLab report if they're marked as `error` or `warn` by your Socket Security policy, ensuring the Security Dashboard shows only actionable findings.
+
+### Report Schema
+
+Socket CLI generates reports compliant with [GitLab Dependency Scanning schema version 15.0.0](https://docs.gitlab.com/ee/development/integrations/secure.html). The reports include:
+
+- **Scan metadata**: Analyzer and scanner information
+- **Vulnerabilities**: Detailed vulnerability data with:
+  - Unique deterministic UUIDs for tracking
+  - Package location and dependency information
+  - Severity levels mapped from Socket's analysis
+  - Socket-specific alert types and CVE identifiers
+  - Links to Socket.dev for detailed analysis
+
+### Requirements
+
+- **GitLab Version**: GitLab 12.0 or later (for Security Dashboard support)
+- **Socket API Token**: Set via `$SOCKET_API_TOKEN` environment variable or `--api-token` parameter
+- **CI/CD Artifacts**: Reports must be uploaded as `dependency_scanning` artifacts
+
+### Troubleshooting
+
+**Report not appearing in Security Dashboard:**
+- Verify the artifact is correctly configured in `.gitlab-ci.yml`
+- Check that the job succeeded and artifacts were uploaded
+- Ensure the report file follows the correct schema format
+
+**Empty vulnerabilities array:**
+- This is normal if no new security issues were detected
+- Check Socket.dev dashboard for full analysis details
+
+## Development
+
+Developer setup, workflows, and contributor notes are documented in [`development.md`](development.md).
diff --git a/docs/development.md b/docs/development.md
new file mode 100644
index 0000000..9bab1ce
--- /dev/null
+++ b/docs/development.md
@@ -0,0 +1,95 @@
+# Development guide
+
+## Local setup
+
+This project uses `pyproject.toml` and `uv.lock` for dependency management.
+
+### Standard setup (PyPI dependencies)
+
+```bash
+pyenv local 3.11
+make first-time-setup
+```
+
+### Local SDK development setup
+
+```bash
+pyenv local 3.11
+SOCKET_SDK_PATH=~/path/to/socketdev make first-time-local-setup
+```
+
+Default local SDK path is `../socketdev` when `SOCKET_SDK_PATH` is not set.
+
+## Ongoing workflows
+
+After dependency changes:
+
+```bash
+make update-deps
+```
+
+After pulling latest changes:
+
+```bash
+make sync-all
+```
+
+Run tests:
+
+```bash
+make test
+```
+
+Run lint/format checks:
+
+```bash
+make lint
+```
+
+## Make targets
+
+High-level:
+
+- `make first-time-setup`
+- `make first-time-local-setup`
+- `make update-lock`
+- `make sync-all`
+- `make dev-setup`
+
+Implementation:
+
+- `make local-dev`
+- `make setup`
+- `make sync`
+- `make clean`
+- `make test`
+- `make lint`
+
+## Environment variables
+
+Core:
+
+- `SOCKET_SECURITY_API_TOKEN` (also supports `SOCKET_SECURITY_API_KEY`, `SOCKET_API_KEY`, `SOCKET_API_TOKEN`)
+- `SOCKET_SDK_PATH` (default `../socketdev`)
+
+GitLab:
+
+- `GITLAB_TOKEN`
+- `CI_JOB_TOKEN`
+
+## Manual setup (without `make`)
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+uv sync
+uv add --dev pre-commit
+pre-commit install
+```
+
+## Related docs
+
+- CLI quick start: [`../README.md`](../README.md)
+- CI/CD usage: [`ci-cd.md`](ci-cd.md)
+- Full CLI reference: [`cli-reference.md`](cli-reference.md)
+- Troubleshooting: [`troubleshooting.md`](troubleshooting.md)
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
new file mode 100644
index 0000000..80d08f9
--- /dev/null
+++ b/docs/troubleshooting.md
@@ -0,0 +1,81 @@
+# Troubleshooting
+
+## Common gotchas
+
+- In diff scope, `--strict-blocking` uses a stricter alert set (`new + unchanged`) for blocking checks and diff-based output selection.
+- `--sarif-scope full` requires `--reach`.
+- In `--sarif-scope full` with `--sarif-file`, SARIF JSON is written to file and stdout JSON is suppressed.
+- `--sarif-grouping alert` currently applies to `--sarif-scope full`.
+
+## Dashboard vs CLI result counts
+
+Differences in result counts can be valid, even when filtering appears similar.
+
+Common reasons:
+
+- `diff` vs `full` data source:
+  - `--sarif-scope diff` is based on diff alerts (typically net-new in the compared scan context).
+  - `--sarif-scope full` is based on full reachability facts data.
+- Consolidation differences:
+  - Dashboard and API/CLI can apply different consolidation/grouping rules.
+  - `--sarif-grouping alert` and `--sarif-grouping instance` intentionally produce different row counts.
+- Policy vs dataset:
+  - `--strict-blocking` only affects diff-scope behavior and does not make diff output equivalent to full dashboard data.
+- Reachability data availability:
+  - If reachability analysis partially fails and falls back to precomputed tiers, counts can shift.
+
+Recommended comparison path:
+
+1. Use full-scope SARIF for parity-oriented comparisons.
+2. Keep grouping fixed (`alert` for dashboard-style rollups, `instance` for detailed exports).
+3. Compare reachability filters with the same mode and grouping across runs.
+
+## Save submitted file list
+
+Use `--save-submitted-files-list` to inspect exactly what was sent for scanning.
+
+```bash
+socketcli --save-submitted-files-list submitted_files.json
+```
+
+Output includes:
+
+- timestamp
+- total file count
+- total size
+- complete submitted file list
+
+## Save manifest archive
+
+Use `--save-manifest-tar` to export discovered manifest files as `.tar.gz`.
+
+```bash
+socketcli --save-manifest-tar manifest_files.tar.gz
+```
+
+Combined example:
+
+```bash
+socketcli --save-submitted-files-list files.json --save-manifest-tar backup.tar.gz
+```
+
+## Octopus merge note
+
+For octopus merges (3+ parents), Git can report incomplete changed-file sets because default diff compares against the first parent.
+
+If needed, force full scan behavior with:
+
+- `--ignore-commit-files`
+
+## GitLab report troubleshooting
+
+If report is not visible in GitLab Security Dashboard:
+
+- verify `dependency_scanning` artifact is configured in `.gitlab-ci.yml`
+- verify job completed and artifact uploaded
+- verify report file schema is valid
+
+If vulnerabilities array is empty:
+
+- this can be expected when no actionable security issues are present in the result scope
+- confirm expected scope/flags and compare with Socket dashboard data
diff --git a/examples/config/sarif-dashboard-parity.json b/examples/config/sarif-dashboard-parity.json
new file mode 100644
index 0000000..e2fa3c8
--- /dev/null
+++ b/examples/config/sarif-dashboard-parity.json
@@ -0,0 +1,11 @@
+{
+  "socketcli": {
+    "reach": true,
+    "sarif_scope": "full",
+    "sarif_grouping": "alert",
+    "sarif_reachability": "reachable",
+    "sarif_file": "sarif-dashboard-parity-reachable.sarif",
+    "disable_blocking": true,
+    "repo": "example-repo"
+  }
+}
diff --git a/examples/config/sarif-dashboard-parity.toml b/examples/config/sarif-dashboard-parity.toml
new file mode 100644
index 0000000..67b8609
--- /dev/null
+++ b/examples/config/sarif-dashboard-parity.toml
@@ -0,0 +1,18 @@
+[socketcli]
+# Dashboard-parity style output:
+# - Full reachability data
+# - Grouped alert-level SARIF results
+# - Reachable-only filter
+reach = true
+sarif_scope = "full"
+sarif_grouping = "alert"
+sarif_reachability = "reachable"
+sarif_file = "sarif-dashboard-parity-reachable.sarif"
+disable_blocking = true
+
+# Optional repo/workspace hints
+repo = "example-repo"
+# workspace = "example-workspace"
+
+# Run example:
+# socketcli --config examples/config/sarif-dashboard-parity.toml --target-path .
diff --git a/examples/config/sarif-diff-ci-cd.json b/examples/config/sarif-diff-ci-cd.json
new file mode 100644
index 0000000..146a36a
--- /dev/null
+++ b/examples/config/sarif-diff-ci-cd.json
@@ -0,0 +1,11 @@
+{
+  "socketcli": {
+    "reach": true,
+    "sarif_scope": "diff",
+    "sarif_grouping": "instance",
+    "sarif_reachability": "reachable",
+    "sarif_file": "sarif-diff-reachable.sarif",
+    "strict_blocking": true,
+    "repo": "example-repo"
+  }
+}
diff --git a/examples/config/sarif-diff-ci-cd.toml b/examples/config/sarif-diff-ci-cd.toml
new file mode 100644
index 0000000..5137062
--- /dev/null
+++ b/examples/config/sarif-diff-ci-cd.toml
@@ -0,0 +1,16 @@
+[socketcli]
+# Diff-focused CI/CD output:
+# - Diff scope (net-new findings)
+# - Reachable-only filter for SARIF in diff mode
+# - Blocking enabled to enforce policy in CI/CD
+reach = true
+sarif_scope = "diff"
+sarif_grouping = "instance"
+sarif_reachability = "reachable"
+sarif_file = "sarif-diff-reachable.sarif"
+strict_blocking = true
+
+repo = "example-repo"
+
+# Run example:
+# socketcli --config examples/config/sarif-diff-ci-cd.toml --target-path .
diff --git a/examples/config/sarif-instance-detail.json b/examples/config/sarif-instance-detail.json
new file mode 100644
index 0000000..6721a51
--- /dev/null
+++ b/examples/config/sarif-instance-detail.json
@@ -0,0 +1,11 @@
+{
+  "socketcli": {
+    "reach": true,
+    "sarif_scope": "full",
+    "sarif_grouping": "instance",
+    "sarif_reachability": "all",
+    "sarif_file": "sarif-full-instance-all.sarif",
+    "disable_blocking": true,
+    "repo": "example-repo"
+  }
+}
diff --git a/examples/config/sarif-instance-detail.toml b/examples/config/sarif-instance-detail.toml
new file mode 100644
index 0000000..ebfb2e8
--- /dev/null
+++ b/examples/config/sarif-instance-detail.toml
@@ -0,0 +1,16 @@
+[socketcli]
+# Instance-detail output:
+# - Full reachability data
+# - Instance-level SARIF rows (package/version/advisory granularity)
+# - Include all reachability states
+reach = true
+sarif_scope = "full"
+sarif_grouping = "instance"
+sarif_reachability = "all"
+sarif_file = "sarif-full-instance-all.sarif"
+disable_blocking = true
+
+repo = "example-repo"
+
+# Run example:
+# socketcli --config examples/config/sarif-instance-detail.toml --target-path .
diff --git a/pyproject.toml b/pyproject.toml
index 51621eb..d401856 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.77"
+version = "2.2.78"
 requires-python = ">= 3.10"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 46bfbd7..987c20b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.77'
+__version__ = '2.2.78'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index dffd4c0..9c3b40b 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -6,6 +6,7 @@
 from socketsecurity import __version__
 from socketdev import INTEGRATION_TYPES, IntegrationType
 import json
+import tomllib
 
 
 def get_plugin_config_from_env(prefix: str) -> dict:
@@ -15,6 +16,45 @@ def get_plugin_config_from_env(prefix: str) -> dict:
     except json.JSONDecodeError:
         return {}
 
+
+def load_cli_config_file(config_path: str) -> dict:
+    """
+    Load CLI defaults from a JSON or TOML file.
+
+    Supported structures:
+    - Flat keys: {"sarif_scope": "full", "reach": true}
+    - Namespaced keys:
+      - JSON: {"socketcli": {...}}
+      - TOML: [socketcli]
+    """
+    if not config_path:
+        return {}
+
+    try:
+        with open(config_path, "rb") as f:
+            if config_path.lower().endswith(".json"):
+                data = json.loads(f.read().decode("utf-8"))
+            elif config_path.lower().endswith(".toml"):
+                data = tomllib.load(f)
+            else:
+                logging.error("--config must be a .json or .toml file")
+                exit(1)
+    except FileNotFoundError:
+        logging.error(f"Config file not found: {config_path}")
+        exit(1)
+    except (json.JSONDecodeError, tomllib.TOMLDecodeError) as e:
+        logging.error(f"Invalid config file format: {e}")
+        exit(1)
+
+    if not isinstance(data, dict):
+        logging.error("Config file must contain a top-level object/table")
+        exit(1)
+
+    scoped = data.get("socketcli")
+    if isinstance(scoped, dict):
+        return scoped
+    return data
+
 @dataclass
 class PluginConfig:
     enabled: bool = False
@@ -41,7 +81,9 @@ class CliConfig:
     enable_json: bool = False
     enable_sarif: bool = False
     sarif_file: Optional[str] = None
-    sarif_reachable_only: bool = False
+    sarif_scope: str = "diff"
+    sarif_grouping: str = "instance"
+    sarif_reachability: str = "all"
     enable_gitlab_security: bool = False
     gitlab_security_file: Optional[str] = None
     disable_overview: bool = False
@@ -90,10 +132,26 @@ class CliConfig:
     reach_use_only_pregenerated_sboms: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
+    config_file: Optional[str] = None
     
     @classmethod
     def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
         parser = create_argument_parser()
+
+        pre_parser = argparse.ArgumentParser(add_help=False)
+        pre_parser.add_argument("--config", dest="config_file", default=None)
+        pre_args, _ = pre_parser.parse_known_args(args_list)
+
+        if pre_args.config_file:
+            config_defaults = load_cli_config_file(pre_args.config_file)
+            valid_dests = {action.dest for action in parser._actions if action.dest != "help"}
+            normalized_defaults = {}
+            for key, value in config_defaults.items():
+                dest = str(key).replace("-", "_")
+                if dest in valid_dests:
+                    normalized_defaults[dest] = value
+            parser.set_defaults(**normalized_defaults)
+
         args = parser.parse_args(args_list)
 
         # Get API token from env or args (check multiple env var names)
@@ -133,7 +191,9 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'enable_json': args.enable_json,
             'enable_sarif': args.enable_sarif,
             'sarif_file': args.sarif_file,
-            'sarif_reachable_only': args.sarif_reachable_only,
+            'sarif_scope': args.sarif_scope,
+            'sarif_grouping': args.sarif_grouping,
+            'sarif_reachability': args.sarif_reachability,
             'enable_gitlab_security': args.enable_gitlab_security,
             'gitlab_security_file': args.gitlab_security_file,
             'disable_overview': args.disable_overview,
@@ -176,12 +236,20 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_use_only_pregenerated_sboms': args.reach_use_only_pregenerated_sboms,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
+            'config_file': args.config_file,
             'version': __version__
         }
-        try:
-            config_args["excluded_ecosystems"] = json.loads(config_args["excluded_ecosystems"].replace("'", '"'))
-        except json.JSONDecodeError:
-            logging.error(f"Unable to parse excluded_ecosystems: {config_args['excluded_ecosystems']}")
+        excluded_ecosystems = config_args["excluded_ecosystems"]
+        if isinstance(excluded_ecosystems, list):
+            config_args["excluded_ecosystems"] = excluded_ecosystems
+        elif isinstance(excluded_ecosystems, str):
+            try:
+                config_args["excluded_ecosystems"] = json.loads(excluded_ecosystems.replace("'", '"'))
+            except json.JSONDecodeError:
+                logging.error(f"Unable to parse excluded_ecosystems: {excluded_ecosystems}")
+                exit(1)
+        else:
+            logging.error(f"Unable to parse excluded_ecosystems: {excluded_ecosystems}")
             exit(1)
         # Build Slack plugin config, merging CLI arg with env config
         slack_config = get_plugin_config_from_env("SOCKET_SLACK")
@@ -212,9 +280,17 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--workspace-name requires --sub-path to be specified")
             exit(1)
 
-        # Validate that sarif_reachable_only requires reach
-        if args.sarif_reachable_only and not args.reach:
-            logging.error("--sarif-reachable-only requires --reach to be specified")
+        if args.sarif_scope == "full" and not args.reach:
+            logging.error("--sarif-scope full requires --reach to be specified")
+            exit(1)
+        if args.sarif_reachability != "all" and not args.reach:
+            logging.error("--sarif-reachability requires --reach to be specified")
+            exit(1)
+        if args.sarif_grouping == "alert" and args.sarif_scope != "full":
+            logging.error("--sarif-grouping alert currently requires --sarif-scope full")
+            exit(1)
+        if args.sarif_reachability in ("potentially", "reachable-or-potentially") and args.sarif_scope != "full":
+            logging.error("--sarif-reachability potentially/reachable-or-potentially requires --sarif-scope full")
             exit(1)
 
         # Validate that only_facts_file requires reach
@@ -250,6 +326,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
 
     # Authentication
     auth_group = parser.add_argument_group('Authentication')
+    auth_group.add_argument(
+        "--config",
+        dest="config_file",
+        metavar="<path>",
+        help="Path to JSON/TOML file with default CLI options. CLI flags take precedence."
+    )
     auth_group.add_argument(
         "--api-token",
         dest="api_token",
@@ -492,10 +574,25 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Output file path for SARIF report (implies --enable-sarif)"
     )
     output_group.add_argument(
-        "--sarif-reachable-only",
-        dest="sarif_reachable_only",
-        action="store_true",
-        help="Filter SARIF output to only include reachable findings (requires --reach)"
+        "--sarif-scope",
+        dest="sarif_scope",
+        choices=["diff", "full"],
+        default="diff",
+        help="Scope SARIF output to diff alerts (default) or full reachability facts data (requires --reach)"
+    )
+    output_group.add_argument(
+        "--sarif-grouping",
+        dest="sarif_grouping",
+        choices=["instance", "alert"],
+        default="instance",
+        help="SARIF result grouping mode: instance (default) or alert (full scope only)"
+    )
+    output_group.add_argument(
+        "--sarif-reachability",
+        dest="sarif_reachability",
+        choices=["all", "reachable", "potentially", "reachable-or-potentially"],
+        default="all",
+        help="Reachability filter for SARIF output (requires --reach when not 'all')"
     )
     output_group.add_argument(
         "--enable-gitlab-security",
@@ -756,4 +853,4 @@ def create_argument_parser() -> argparse.ArgumentParser:
         version=f'%(prog)s {__version__}'
     )
 
-    return parser
\ No newline at end of file
+    return parser
diff --git a/socketsecurity/core/alert_selection.py b/socketsecurity/core/alert_selection.py
new file mode 100644
index 0000000..ae5b477
--- /dev/null
+++ b/socketsecurity/core/alert_selection.py
@@ -0,0 +1,239 @@
+import logging
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+from socketsecurity.core.classes import Diff, Issue
+from socketsecurity.core.helper.socket_facts_loader import (
+    convert_to_alerts,
+    get_components_with_vulnerabilities,
+    load_socket_facts,
+)
+from socketsecurity.core.messages import Messages
+
+
+def select_diff_alerts(diff: Diff, strict_blocking: bool = False) -> List[Issue]:
+    """Select diff alerts for output rendering.
+
+    In strict blocking mode, include unchanged alerts so rendered output aligns
+    with pass/fail policy evaluation.
+    """
+    selected = list(getattr(diff, "new_alerts", []) or [])
+    if strict_blocking:
+        selected.extend(getattr(diff, "unchanged_alerts", []) or [])
+    return selected
+
+
+def clone_diff_with_selected_alerts(diff: Diff, selected_alerts: List[Issue]) -> Diff:
+    """Clone a diff object while replacing new_alerts with selected alerts."""
+    selected_diff = Diff(
+        new_alerts=selected_alerts,
+        unchanged_alerts=[],
+        removed_alerts=[],
+        diff_url=getattr(diff, "diff_url", ""),
+        new_packages=getattr(diff, "new_packages", []),
+        removed_packages=getattr(diff, "removed_packages", []),
+        packages=getattr(diff, "packages", {}),
+    )
+    selected_diff.id = getattr(diff, "id", "")
+    selected_diff.report_url = getattr(diff, "report_url", "")
+    selected_diff.new_scan_id = getattr(diff, "new_scan_id", "")
+    return selected_diff
+
+
+def load_components_with_alerts(
+    target_path: Optional[str],
+    reach_output_file: Optional[str],
+) -> Optional[List[Dict[str, Any]]]:
+    facts_file = reach_output_file or ".socket.facts.json"
+    facts_file_path = str(Path(target_path or ".") / facts_file)
+    facts_data = load_socket_facts(facts_file_path)
+    if not facts_data:
+        return None
+
+    components = get_components_with_vulnerabilities(facts_data)
+    return convert_to_alerts(components)
+
+
+def _normalize_purl(purl: str) -> str:
+    if not purl:
+        return ""
+    normalized = purl.strip().lower().replace("%40", "@")
+    if normalized.startswith("pkg:"):
+        normalized = normalized[4:]
+    return normalized
+
+
+def _normalize_vuln_id(vuln_id: str) -> str:
+    if not vuln_id:
+        return ""
+    return vuln_id.strip().upper()
+
+
+def _normalize_pkg_key(pkg_type: str, pkg_name: str, pkg_version: str) -> Tuple[str, str, str]:
+    return (
+        (pkg_type or "").strip().lower(),
+        (pkg_name or "").strip().lower(),
+        (pkg_version or "").strip().lower(),
+    )
+
+
+def _extract_issue_vuln_ids(issue: Issue) -> Set[str]:
+    ids: Set[str] = set()
+    props = getattr(issue, "props", None) or {}
+    for key in ("ghsaId", "ghsa_id", "cveId", "cve_id"):
+        value = props.get(key)
+        if isinstance(value, str) and value.strip():
+            ids.add(_normalize_vuln_id(value))
+    return ids
+
+
+def _is_potentially_reachable(reachability: str, undeterminable: bool = False) -> bool:
+    normalized = Messages._normalize_reachability(reachability)
+    potential_states = {"unknown", "error", "maybe_reachable", "potentially_reachable"}
+    return normalized in potential_states or undeterminable
+
+
+def _matches_selector(states: Set[str], selector: str) -> bool:
+    selected = (selector or "all").strip().lower()
+    if selected == "all":
+        return True
+    if not states:
+        return False
+    if selected == "reachable":
+        return "reachable" in states
+    if selected == "potentially":
+        return any(_is_potentially_reachable(state) for state in states)
+    if selected == "reachable-or-potentially":
+        return "reachable" in states or any(_is_potentially_reachable(state) for state in states)
+    return True
+
+
+def _build_reachability_index(
+    components_with_alerts: Optional[List[Dict[str, Any]]],
+) -> Optional[Tuple[Dict[str, Dict[str, Set[str]]], Dict[Tuple[str, str, str], Dict[str, Set[str]]]]]:
+    if not components_with_alerts:
+        return None
+
+    by_purl: Dict[str, Dict[str, Set[str]]] = {}
+    by_pkg: Dict[Tuple[str, str, str], Dict[str, Set[str]]] = {}
+
+    for component in components_with_alerts:
+        component_alerts = component.get("alerts", [])
+        pkg_type = component.get("type", "")
+        pkg_version = component.get("version", "")
+        namespace = (component.get("namespace") or "").strip()
+        name = (component.get("name") or component.get("id") or "").strip()
+
+        pkg_names: Set[str] = {name}
+        if namespace:
+            pkg_names.add(f"{namespace}/{name}")
+
+        for alert in component_alerts:
+            props = alert.get("props", {}) or {}
+            reachability = Messages._normalize_reachability(props.get("reachability", "unknown"))
+            vuln_ids = {
+                _normalize_vuln_id(props.get("ghsaId", "")),
+                _normalize_vuln_id(props.get("cveId", "")),
+            }
+            vuln_ids = {v for v in vuln_ids if v}
+            purl = _normalize_purl(props.get("purl", ""))
+
+            def _add(container: Dict[Any, Dict[str, Set[str]]], key: Any) -> None:
+                if key not in container:
+                    container[key] = {}
+                vuln_key = next(iter(vuln_ids)) if len(vuln_ids) == 1 else "*"
+                if vuln_key not in container[key]:
+                    container[key][vuln_key] = set()
+                container[key][vuln_key].add(reachability)
+                if vuln_ids and vuln_key == "*":
+                    for vuln_id in vuln_ids:
+                        if vuln_id not in container[key]:
+                            container[key][vuln_id] = set()
+                        container[key][vuln_id].add(reachability)
+                if not vuln_ids:
+                    if "*" not in container[key]:
+                        container[key]["*"] = set()
+                    container[key]["*"].add(reachability)
+
+            if purl:
+                _add(by_purl, purl)
+
+            for pkg_name in pkg_names:
+                pkg_key = _normalize_pkg_key(pkg_type, pkg_name, pkg_version)
+                _add(by_pkg, pkg_key)
+
+    return by_purl, by_pkg
+
+
+def _alert_reachability_states(
+    alert: Issue,
+    by_purl: Dict[str, Dict[str, Set[str]]],
+    by_pkg: Dict[Tuple[str, str, str], Dict[str, Set[str]]],
+) -> Set[str]:
+    states: Set[str] = set()
+    alert_ids = _extract_issue_vuln_ids(alert)
+    alert_purl = _normalize_purl(getattr(alert, "purl", ""))
+    pkg_key = _normalize_pkg_key(
+        getattr(alert, "pkg_type", ""),
+        getattr(alert, "pkg_name", ""),
+        getattr(alert, "pkg_version", ""),
+    )
+
+    def _collect(index: Dict[Any, Dict[str, Set[str]]], key: Any) -> Set[str]:
+        found: Set[str] = set()
+        mapping = index.get(key, {})
+        if not mapping:
+            return found
+
+        if "*" in mapping:
+            found.update(mapping["*"])
+
+        if alert_ids:
+            for alert_id in alert_ids:
+                if alert_id in mapping:
+                    found.update(mapping[alert_id])
+        else:
+            for value in mapping.values():
+                found.update(value)
+        return found
+
+    if alert_purl:
+        states.update(_collect(by_purl, alert_purl))
+    states.update(_collect(by_pkg, pkg_key))
+    return states
+
+
+def filter_alerts_by_reachability(
+    alerts: List[Issue],
+    selector: str,
+    target_path: Optional[str],
+    reach_output_file: Optional[str],
+    logger: Optional[logging.Logger] = None,
+    fallback_to_blocking_for_reachable: bool = True,
+) -> List[Issue]:
+    """
+    Filter issue alerts by reachability selector using .socket.facts.json data.
+
+    If facts data is unavailable and selector is `reachable`, optionally falls back
+    to `issue.error == True` for backward compatibility.
+    """
+    normalized_selector = (selector or "all").strip().lower()
+    if normalized_selector == "all":
+        return list(alerts)
+
+    components_with_alerts = load_components_with_alerts(target_path, reach_output_file)
+    reachability_index = _build_reachability_index(components_with_alerts)
+    if not reachability_index:
+        if logger:
+            logger.warning("Unable to load reachability facts for selector '%s'", normalized_selector)
+        if normalized_selector == "reachable" and fallback_to_blocking_for_reachable:
+            return [a for a in alerts if getattr(a, "error", False)]
+        return []
+
+    by_purl, by_pkg = reachability_index
+    filtered: List[Issue] = []
+    for alert in alerts:
+        states = _alert_reachability_states(alert, by_purl, by_pkg)
+        if _matches_selector(states, normalized_selector):
+            filtered.append(alert)
+    return filtered
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index 43033a2..db62a6b 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -369,6 +369,210 @@ def create_security_comment_sarif(diff) -> dict:
 
         return sarif_data
 
+    @staticmethod
+    def _normalize_reachability(reachability: str) -> str:
+        return str(reachability or "unknown").strip().lower().replace("-", "_").replace(" ", "_")
+
+    @staticmethod
+    def _matches_reachability_filter(reachability: str, selector: str, undeterminable: bool = False) -> bool:
+        normalized = Messages._normalize_reachability(reachability)
+        selected = (selector or "all").strip().lower()
+
+        if selected == "all":
+            return True
+        if selected == "reachable":
+            return normalized == "reachable"
+
+        potential_states = {"unknown", "error", "maybe_reachable", "potentially_reachable"}
+        is_potential = normalized in potential_states or undeterminable
+
+        if selected == "potentially":
+            return is_potential
+        if selected == "reachable-or-potentially":
+            return normalized == "reachable" or is_potential
+
+        return True
+
+    @staticmethod
+    def create_security_comment_sarif_from_facts(
+        components_with_alerts: list,
+        reachability_filter: str = "all",
+        grouping: str = "instance",
+    ) -> dict:
+        """
+        Create SARIF output directly from reachability facts-derived alerts.
+
+        Args:
+            components_with_alerts: Components from convert_to_alerts(...)
+            reachability_filter: all|reachable|potentially|reachable-or-potentially
+            grouping: instance|alert
+        """
+        sarif_data = {
+            "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [{
+                "tool": {
+                    "driver": {
+                        "name": "Socket Security",
+                        "informationUri": "https://socket.dev",
+                        "rules": []
+                    }
+                },
+                "results": []
+            }]
+        }
+
+        rules_map = {}
+        results_list = []
+        grouped_results = {}
+
+        for component in components_with_alerts or []:
+            comp_type = component.get("type", "unknown")
+            comp_name = component.get("name") or component.get("id") or "unknown-package"
+            comp_version = component.get("version") or "unknown-version"
+
+            fallback_uri = f"pkg:{comp_type}/{comp_name}@{comp_version}"
+            manifests = component.get("manifestFiles", [])
+            manifest_uris = []
+            if isinstance(manifests, list):
+                for mf in manifests:
+                    if isinstance(mf, dict):
+                        path = mf.get("path") or mf.get("file") or mf.get("name")
+                        if path:
+                            manifest_uris.append(str(path))
+                    elif isinstance(mf, str):
+                        manifest_uris.append(mf)
+
+            if not manifest_uris:
+                manifest_uris = [fallback_uri]
+            else:
+                # Preserve order while removing duplicate manifest entries.
+                manifest_uris = list(dict.fromkeys(manifest_uris))
+
+            for alert in component.get("alerts", []):
+                props = alert.get("props", {}) or {}
+                reachability = Messages._normalize_reachability(props.get("reachability", "unknown"))
+                undeterminable = bool(props.get("undeterminableReachability", False))
+                if not Messages._matches_reachability_filter(
+                    reachability=reachability,
+                    selector=reachability_filter,
+                    undeterminable=undeterminable,
+                ):
+                    continue
+
+                vuln_id = props.get("ghsaId") or props.get("cveId") or alert.get("title") or "unknown-vulnerability"
+                severity = str(alert.get("severity", "low")).lower()
+                if grouping == "alert":
+                    rule_id = f"{comp_name}:{vuln_id}"
+                    rule_name = f"Reachability alert {vuln_id} in {comp_name}"
+                else:
+                    rule_id = f"{comp_name}=={comp_version}:{vuln_id}"
+                    rule_name = f"Reachability alert {vuln_id} in {comp_name}@{comp_version}"
+                socket_url = (
+                    props.get("url")
+                    or Messages.get_manifest_type_url(manifest_uris[0], comp_name, comp_version)
+                )
+
+                if rule_id not in rules_map:
+                    rules_map[rule_id] = {
+                        "id": rule_id,
+                        "name": rule_name,
+                        "shortDescription": {"text": rule_name},
+                        "fullDescription": {"text": alert.get("title", rule_name)},
+                        "helpUri": socket_url,
+                        "defaultConfiguration": {
+                            "level": Messages.map_severity_to_sarif(severity)
+                        },
+                    }
+
+                message = (
+                    f"Reachability: {reachability}. "
+                    f"Suggested Action:<br/>{props.get('range', '')}"
+                    f"<br/><a href=\"{socket_url}\">{socket_url}</a>"
+                )
+
+                if grouping == "alert":
+                    alert_key = props.get("key") or props.get("alertKey") or f"{comp_type}:{comp_name}:{vuln_id}"
+                    existing = grouped_results.get(alert_key)
+                    if not existing:
+                        first_uri = manifest_uris[0]
+                        grouped_results[alert_key] = {
+                            "ruleId": rule_id,
+                            "message": {"text": message},
+                            "locations": [{
+                                "physicalLocation": {
+                                    "artifactLocation": {"uri": first_uri},
+                                    "region": {
+                                        "startLine": 1,
+                                        "snippet": {"text": f"{comp_name}@{comp_version}"}
+                                    },
+                                }
+                            }],
+                            "properties": {
+                                "reachability": reachability,
+                                "reachabilityStates": [reachability],
+                                "versions": [str(comp_version)],
+                                "manifestUris": list(manifest_uris),
+                                "purls": [props.get("purl")] if props.get("purl") else [],
+                                "ghsaId": props.get("ghsaId"),
+                                "cveId": props.get("cveId"),
+                                "source": "socket-facts",
+                                "socketAlertKey": alert_key,
+                            }
+                        }
+                    else:
+                        states = set(existing["properties"].get("reachabilityStates", []))
+                        states.add(reachability)
+                        existing["properties"]["reachabilityStates"] = sorted(states)
+
+                        versions = set(existing["properties"].get("versions", []))
+                        versions.add(str(comp_version))
+                        existing["properties"]["versions"] = sorted(versions)
+
+                        uris = set(existing["properties"].get("manifestUris", []))
+                        uris.update(manifest_uris)
+                        existing["properties"]["manifestUris"] = sorted(uris)
+
+                        purls = set(existing["properties"].get("purls", []))
+                        if props.get("purl"):
+                            purls.add(props.get("purl"))
+                        existing["properties"]["purls"] = sorted(purls)
+                else:
+                    for uri in manifest_uris:
+                        results_list.append({
+                            "ruleId": rule_id,
+                            "message": {"text": message},
+                            "locations": [{
+                                "physicalLocation": {
+                                    "artifactLocation": {"uri": uri},
+                                    "region": {
+                                        "startLine": 1,
+                                        "snippet": {"text": f"{comp_name}@{comp_version}"}
+                                    },
+                                }
+                            }],
+                            "properties": {
+                                "reachability": reachability,
+                                "purl": props.get("purl"),
+                                "ghsaId": props.get("ghsaId"),
+                                "cveId": props.get("cveId"),
+                                "source": "socket-facts"
+                            }
+                        })
+
+        if grouping == "alert":
+            for grouped in grouped_results.values():
+                states = grouped["properties"].get("reachabilityStates", [])
+                if "reachable" in states:
+                    grouped["properties"]["reachability"] = "reachable"
+                elif states:
+                    grouped["properties"]["reachability"] = states[0]
+                results_list.append(grouped)
+
+        sarif_data["runs"][0]["tool"]["driver"]["rules"] = list(rules_map.values())
+        sarif_data["runs"][0]["results"] = results_list
+        return sarif_data
+
     @staticmethod
     def create_security_comment_json(diff: Diff) -> dict:
         scan_failed = False
diff --git a/socketsecurity/output.py b/socketsecurity/output.py
index b70cad5..921ca79 100644
--- a/socketsecurity/output.py
+++ b/socketsecurity/output.py
@@ -6,6 +6,12 @@
 from .core.classes import Diff, Issue
 from .config import CliConfig
 from socketsecurity.plugins.manager import PluginManager
+from socketsecurity.core.alert_selection import (
+    clone_diff_with_selected_alerts,
+    filter_alerts_by_reachability,
+    load_components_with_alerts,
+    select_diff_alerts,
+)
 from socketdev import socketdev
 
 
@@ -101,7 +107,8 @@ def return_exit_code(self, diff_report: Diff) -> int:
 
     def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Outputs formatted console comments"""
-        has_new_alerts = len(diff_report.new_alerts) > 0
+        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
+        has_new_alerts = len(selected_alerts) > 0
         has_unchanged_alerts = (
             self.config.strict_blocking and
             hasattr(diff_report, 'unchanged_alerts') and
@@ -122,7 +129,8 @@ def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[st
             unchanged_blocking = sum(1 for issue in diff_report.unchanged_alerts if issue.error)
             unchanged_warning = sum(1 for issue in diff_report.unchanged_alerts if issue.warn)
 
-        console_security_comment = Messages.create_console_security_alert_table(diff_report)
+        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
+        console_security_comment = Messages.create_console_security_alert_table(selected_diff)
 
         # Build status message
         self.logger.info("Security issues detected by Socket Security:")
@@ -140,7 +148,9 @@ def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[st
 
     def output_console_json(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Outputs JSON formatted results"""
-        console_security_comment = Messages.create_security_comment_json(diff_report)
+        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
+        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
+        console_security_comment = Messages.create_security_comment_json(selected_diff)
         self.save_sbom_file(diff_report, sbom_file_name)
         self.logger.info(json.dumps(console_security_comment))
 
@@ -148,28 +158,56 @@ def output_console_sarif(self, diff_report: Diff, sbom_file_name: Optional[str]
         """
         Generate SARIF output from the diff report and print to console.
         If --sarif-file is configured, also save to file.
-        If --sarif-reachable-only is set, filters to blocking (reachable) alerts only.
+        Scope:
+        - diff (default): SARIF from diff.new_alerts
+        - full: SARIF from .socket.facts.json alerts
         """
-        if diff_report.id != "NO_DIFF_RAN":
-            # When --sarif-reachable-only is set, filter to error=True alerts only.
-            # This mirrors the Slack plugin's reachability_alerts_only behaviou:
-            # when --reach is used, error=True reflects Socket's reachability-aware policy.
-            if self.config.sarif_reachable_only:
-                filtered_alerts = [a for a in diff_report.new_alerts if getattr(a, "error", False)]
-                diff_report = Diff(
-                    new_alerts=filtered_alerts,
-                    diff_url=getattr(diff_report, "diff_url", ""),
-                    new_packages=getattr(diff_report, "new_packages", []),
-                    removed_packages=getattr(diff_report, "removed_packages", []),
-                    packages=getattr(diff_report, "packages", {}),
+        sarif_scope = getattr(self.config, "sarif_scope", "diff")
+        sarif_grouping = getattr(self.config, "sarif_grouping", "instance")
+        sarif_reachability = getattr(self.config, "sarif_reachability", "all")
+        if sarif_grouping not in {"instance", "alert"}:
+            sarif_grouping = "instance"
+        if sarif_reachability not in {"all", "reachable", "potentially", "reachable-or-potentially"}:
+            sarif_reachability = "all"
+        if diff_report.id != "NO_DIFF_RAN" or sarif_scope == "full":
+            if sarif_scope == "full":
+                components_with_alerts = load_components_with_alerts(
+                    self.config.target_path,
+                    self.config.reach_output_file,
+                )
+                if not components_with_alerts:
+                    self.logger.error(
+                        "Unable to generate full-scope SARIF: .socket.facts.json missing or invalid"
+                    )
+                    components_with_alerts = []
+                console_security_comment = Messages.create_security_comment_sarif_from_facts(
+                    components_with_alerts,
+                    reachability_filter=sarif_reachability,
+                    grouping=sarif_grouping,
                 )
-                diff_report.id = "filtered"
+            else:
+                selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
+                filtered_alerts = filter_alerts_by_reachability(
+                    selected_alerts,
+                    sarif_reachability,
+                    self.config.target_path,
+                    self.config.reach_output_file,
+                    logger=self.logger,
+                    fallback_to_blocking_for_reachable=True,
+                )
+                selected_diff = clone_diff_with_selected_alerts(diff_report, filtered_alerts)
 
-            # Generate the SARIF structure using Messages
-            console_security_comment = Messages.create_security_comment_sarif(diff_report)
+                # Generate the SARIF structure using Messages
+                console_security_comment = Messages.create_security_comment_sarif(selected_diff)
             self.save_sbom_file(diff_report, sbom_file_name)
-            # Print the SARIF output to the console in JSON format
-            print(json.dumps(console_security_comment, indent=2))
+            # Avoid flooding logs for full-scope SARIF when writing to file.
+            if not (sarif_scope == "full" and self.config.sarif_file):
+                # Print the SARIF output to the console in JSON format
+                print(json.dumps(console_security_comment, indent=2))
+            else:
+                self.logger.info(
+                    "SARIF stdout output suppressed for full scope; report will be written to --sarif-file"
+                )
 
             # Save to file if --sarif-file is specified
             if self.config.sarif_file:
diff --git a/socketsecurity/plugins/slack.py b/socketsecurity/plugins/slack.py
index b3f0248..d5b4b62 100644
--- a/socketsecurity/plugins/slack.py
+++ b/socketsecurity/plugins/slack.py
@@ -5,6 +5,11 @@
 from .base import Plugin
 from socketsecurity.core.classes import Diff
 from socketsecurity.core.messages import Messages
+from socketsecurity.core.alert_selection import (
+    clone_diff_with_selected_alerts,
+    filter_alerts_by_reachability,
+    select_diff_alerts,
+)
 from socketsecurity.core.helper.socket_facts_loader import (
     load_socket_facts,
     get_components_with_vulnerabilities,
@@ -68,13 +73,14 @@ def _send_webhook_alerts(self, diff, config: CliConfig):
         
         # Get repo name from config
         repo_name = config.repo or ""
+        diff_alert_source = select_diff_alerts(diff, strict_blocking=config.strict_blocking)
         
         # Handle reachability data if --reach is enabled
         if config.reach:
             self._send_reachability_alerts(valid_webhooks, webhook_configs, repo_name, config, diff)
         
         # Handle diff alerts (if any)
-        if not diff.new_alerts:
+        if not diff_alert_source:
             logger.debug("No new diff alerts to notify via Slack.")
         else:
             # Send to each configured webhook with filtering
@@ -86,7 +92,7 @@ def _send_webhook_alerts(self, diff, config: CliConfig):
                 # Filter alerts based on webhook config
                 # When --reach is used, reachability_alerts_only applies to diff alerts
                 filtered_alerts = self._filter_alerts(
-                    diff.new_alerts, 
+                    diff_alert_source,
                     webhook_config, 
                     repo_name, 
                     config,
@@ -99,13 +105,7 @@ def _send_webhook_alerts(self, diff, config: CliConfig):
                     continue
                 
                 # Create a temporary diff object with filtered alerts for message creation
-                filtered_diff = Diff(
-                    new_alerts=filtered_alerts,
-                    diff_url=getattr(diff, "diff_url", ""),
-                    new_packages=getattr(diff, "new_packages", []),
-                    removed_packages=getattr(diff, "removed_packages", []),
-                    packages=getattr(diff, "packages", {})
-                )
+                filtered_diff = clone_diff_with_selected_alerts(diff, filtered_alerts)
                 
                 message = self.create_slack_blocks_from_diff(filtered_diff, config)
                 
@@ -114,7 +114,7 @@ def _send_webhook_alerts(self, diff, config: CliConfig):
                 if config.enable_debug:
                     logger.debug(f"Slack webhook URL: {url}")
                     logger.debug(f"Slack webhook name: {name}")
-                    logger.debug(f"Total diff alerts: {len(diff.new_alerts)}, Filtered alerts: {len(filtered_alerts)}")
+                    logger.debug(f"Total diff alerts: {len(diff_alert_source)}, Filtered alerts: {len(filtered_alerts)}")
                     logger.debug(f"Message blocks count: {len(message)}")
                 
                 response = requests.post(
@@ -153,7 +153,8 @@ def _send_bot_alerts(self, diff, config: CliConfig):
         logger.debug("Alert levels: %s", self.config.get("levels"))
         logger.debug(f"Number of bot_configs: {len(bot_configs)}")
         logger.debug(f"config.reach: {config.reach}")
-        logger.debug(f"len(diff.new_alerts): {len(diff.new_alerts) if diff.new_alerts else 0}")
+        diff_alert_source = select_diff_alerts(diff, strict_blocking=config.strict_blocking)
+        logger.debug(f"len(diff alert source): {len(diff_alert_source) if diff_alert_source else 0}")
         
         # Get repo name from config
         repo_name = config.repo or ""
@@ -163,7 +164,7 @@ def _send_bot_alerts(self, diff, config: CliConfig):
             self._send_bot_reachability_alerts(bot_configs, bot_token, repo_name, config, diff)
         
         # Handle diff alerts (if any)
-        if not diff.new_alerts:
+        if not diff_alert_source:
             logger.debug("No new diff alerts to notify via Slack.")
         else:
             # Send to each configured bot_config with filtering
@@ -178,7 +179,7 @@ def _send_bot_alerts(self, diff, config: CliConfig):
                 # Filter alerts based on bot config
                 # When --reach is used, reachability_alerts_only applies to diff alerts
                 filtered_alerts = self._filter_alerts(
-                    diff.new_alerts, 
+                    diff_alert_source,
                     bot_config, 
                     repo_name, 
                     config,
@@ -191,18 +192,12 @@ def _send_bot_alerts(self, diff, config: CliConfig):
                     continue
                 
                 # Create a temporary diff object with filtered alerts for message creation
-                filtered_diff = Diff(
-                    new_alerts=filtered_alerts,
-                    diff_url=getattr(diff, "diff_url", ""),
-                    new_packages=getattr(diff, "new_packages", []),
-                    removed_packages=getattr(diff, "removed_packages", []),
-                    packages=getattr(diff, "packages", {})
-                )
+                filtered_diff = clone_diff_with_selected_alerts(diff, filtered_alerts)
                 
                 message = self.create_slack_blocks_from_diff(filtered_diff, config)
                 
                 if config.enable_debug:
-                    logger.debug(f"Bot config '{name}': Total diff alerts: {len(diff.new_alerts)}, Filtered alerts: {len(filtered_alerts)}")
+                    logger.debug(f"Bot config '{name}': Total diff alerts: {len(diff_alert_source)}, Filtered alerts: {len(filtered_alerts)}")
                     logger.debug(f"Message blocks count: {len(message)}")
                 
                 # Send to each channel in the bot_config
@@ -387,6 +382,18 @@ def _filter_alerts(
                         f"repos={repos_filter}, alert_types={alert_types}, "
                         f"severities={severities}, reachability_only={reachability_only}, "
                         f"apply_reachability_only={apply_reachability_only_filter}")
+
+        reachable_alert_identity_set = None
+        if apply_reachability_only_filter and reachability_only:
+            reachable_alerts = filter_alerts_by_reachability(
+                alerts,
+                "reachable",
+                config.target_path,
+                config.reach_output_file,
+                logger=logger,
+                fallback_to_blocking_for_reachable=True,
+            )
+            reachable_alert_identity_set = {id(a) for a in reachable_alerts}
         
         for alert in alerts:
             # For reachability data, only apply severities filter
@@ -405,9 +412,7 @@ def _filter_alerts(
                 continue
             
             # Filter by reachability_alerts_only (only when --reach is used)
-            if apply_reachability_only_filter and reachability_only:
-                # Only include alerts that have error=True (blocking issues)
-                if not getattr(alert, "error", False):
+            if reachable_alert_identity_set is not None and id(alert) not in reachable_alert_identity_set:
                     continue
             
             # Filter by alert_types (overrides severity, empty list = no filtering)
diff --git a/tests/unit/test_alert_selection.py b/tests/unit/test_alert_selection.py
new file mode 100644
index 0000000..d7a63c7
--- /dev/null
+++ b/tests/unit/test_alert_selection.py
@@ -0,0 +1,101 @@
+import json
+
+from socketsecurity.core.alert_selection import (
+    filter_alerts_by_reachability,
+    select_diff_alerts,
+)
+from socketsecurity.core.classes import Diff, Issue
+
+
+def _issue(pkg_name: str, ghsa_id: str, error: bool = False) -> Issue:
+    return Issue(
+        pkg_name=pkg_name,
+        pkg_version="1.0.0",
+        severity="high",
+        title=f"Vuln in {pkg_name}",
+        description="test",
+        type="vulnerability",
+        manifests="package.json",
+        pkg_type="npm",
+        key=f"key-{pkg_name}",
+        purl=f"pkg:npm/{pkg_name}@1.0.0",
+        error=error,
+        props={"ghsaId": ghsa_id},
+    )
+
+
+def test_select_diff_alerts_uses_new_only_without_strict():
+    diff = Diff()
+    diff.new_alerts = [Issue(title="new")]
+    diff.unchanged_alerts = [Issue(title="unchanged")]
+
+    selected = select_diff_alerts(diff, strict_blocking=False)
+    assert [a.title for a in selected] == ["new"]
+
+
+def test_select_diff_alerts_includes_unchanged_with_strict():
+    diff = Diff()
+    diff.new_alerts = [Issue(title="new")]
+    diff.unchanged_alerts = [Issue(title="unchanged")]
+
+    selected = select_diff_alerts(diff, strict_blocking=True)
+    assert {a.title for a in selected} == {"new", "unchanged"}
+
+
+def test_filter_alerts_by_reachability_supports_reachability_selectors(tmp_path):
+    facts_path = tmp_path / ".socket.facts.json"
+    facts_path.write_text(json.dumps({
+        "components": [
+            {
+                "type": "npm",
+                "name": "reachable-pkg",
+                "version": "1.0.0",
+                "vulnerabilities": [{"ghsaId": "GHSA-AAAA-BBBB-CCCC", "severity": "HIGH"}],
+                "reachability": [{
+                    "ghsa_id": "GHSA-AAAA-BBBB-CCCC",
+                    "reachability": [{"type": "reachable"}],
+                }],
+            },
+            {
+                "type": "npm",
+                "name": "potential-pkg",
+                "version": "1.0.0",
+                "vulnerabilities": [{"ghsaId": "GHSA-DDDD-EEEE-FFFF", "severity": "HIGH"}],
+                "reachability": [{
+                    "ghsa_id": "GHSA-DDDD-EEEE-FFFF",
+                    "reachability": [{"type": "potentially_reachable"}],
+                }],
+            },
+            {
+                "type": "npm",
+                "name": "unreachable-pkg",
+                "version": "1.0.0",
+                "vulnerabilities": [{"ghsaId": "GHSA-GGGG-HHHH-IIII", "severity": "HIGH"}],
+                "reachability": [{
+                    "ghsa_id": "GHSA-GGGG-HHHH-IIII",
+                    "reachability": [{"type": "unreachable"}],
+                }],
+            },
+        ],
+    }), encoding="utf-8")
+
+    alerts = [
+        _issue("reachable-pkg", "GHSA-AAAA-BBBB-CCCC"),
+        _issue("potential-pkg", "GHSA-DDDD-EEEE-FFFF"),
+        _issue("unreachable-pkg", "GHSA-GGGG-HHHH-IIII"),
+    ]
+
+    reachable = filter_alerts_by_reachability(
+        alerts, "reachable", str(tmp_path), ".socket.facts.json"
+    )
+    assert [a.pkg_name for a in reachable] == ["reachable-pkg"]
+
+    potentially = filter_alerts_by_reachability(
+        alerts, "potentially", str(tmp_path), ".socket.facts.json"
+    )
+    assert [a.pkg_name for a in potentially] == ["potential-pkg"]
+
+    reachable_or_potentially = filter_alerts_by_reachability(
+        alerts, "reachable-or-potentially", str(tmp_path), ".socket.facts.json"
+    )
+    assert {a.pkg_name for a in reachable_or_potentially} == {"reachable-pkg", "potential-pkg"}
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 7e6a9b5..2c46628 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -74,20 +74,91 @@ class TestCliConfigValidation:
 
     BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
 
-    def test_sarif_reachable_only_without_reach_exits(self):
-        """--sarif-reachable-only without --reach should exit with code 1"""
+    def test_sarif_reachable_only_is_not_supported(self):
+        """Legacy --sarif-reachable-only is removed; argparse should reject it."""
         with pytest.raises(SystemExit) as exc_info:
-            CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachable-only"])
-        assert exc_info.value.code == 1
-
-    def test_sarif_reachable_only_with_reach_succeeds(self):
-        """--sarif-reachable-only with --reach should not raise"""
-        config = CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachable-only", "--reach"])
-        assert config.sarif_reachable_only is True
-        assert config.reach is True
+            CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachable-only", "--reach"])
+        assert exc_info.value.code == 2
 
     def test_sarif_file_implies_enable_sarif(self):
         """--sarif-file should automatically set enable_sarif=True"""
         config = CliConfig.from_args(self.BASE_ARGS + ["--sarif-file", "out.sarif"])
         assert config.enable_sarif is True
         assert config.sarif_file == "out.sarif"
+
+    def test_sarif_scope_full_without_reach_exits(self):
+        """--sarif-scope full without --reach should exit with code 1"""
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(self.BASE_ARGS + ["--sarif-scope", "full"])
+        assert exc_info.value.code == 1
+
+    def test_sarif_scope_full_with_reach_succeeds(self):
+        """--sarif-scope full with --reach should parse successfully"""
+        config = CliConfig.from_args(self.BASE_ARGS + ["--sarif-scope", "full", "--reach"])
+        assert config.sarif_scope == "full"
+        assert config.reach is True
+
+    def test_sarif_reachability_without_reach_exits(self):
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(self.BASE_ARGS + ["--sarif-reachability", "reachable"])
+        assert exc_info.value.code == 1
+
+    def test_sarif_reachability_with_reach_succeeds(self):
+        config = CliConfig.from_args(
+            self.BASE_ARGS + ["--reach", "--sarif-scope", "full", "--sarif-reachability", "potentially"]
+        )
+        assert config.sarif_reachability == "potentially"
+        assert config.reach is True
+
+    def test_sarif_grouping_alert_requires_full_scope(self):
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(self.BASE_ARGS + ["--reach", "--sarif-grouping", "alert"])
+        assert exc_info.value.code == 1
+
+    def test_sarif_reachability_reachable_with_reach_succeeds(self):
+        config = CliConfig.from_args(self.BASE_ARGS + ["--reach", "--sarif-reachability", "reachable"])
+        assert config.sarif_reachability == "reachable"
+
+    def test_config_file_toml_sets_defaults(self, tmp_path):
+        config_path = tmp_path / "socketcli.toml"
+        config_path.write_text(
+            "[socketcli]\n"
+            "reach = true\n"
+            "sarif_scope = \"full\"\n"
+            "sarif_grouping = \"alert\"\n"
+            "sarif_reachability = \"reachable\"\n",
+            encoding="utf-8",
+        )
+
+        config = CliConfig.from_args(self.BASE_ARGS + ["--config", str(config_path)])
+        assert config.reach is True
+        assert config.sarif_scope == "full"
+        assert config.sarif_grouping == "alert"
+        assert config.sarif_reachability == "reachable"
+
+    def test_cli_flag_overrides_config_file(self, tmp_path):
+        config_path = tmp_path / "socketcli.toml"
+        config_path.write_text(
+            "[socketcli]\n"
+            "reach = true\n"
+            "sarif_scope = \"full\"\n",
+            encoding="utf-8",
+        )
+
+        config = CliConfig.from_args(
+            self.BASE_ARGS + ["--config", str(config_path), "--sarif-scope", "diff"]
+        )
+        assert config.reach is True
+        assert config.sarif_scope == "diff"
+
+    def test_config_file_json_sets_defaults(self, tmp_path):
+        config_path = tmp_path / "socketcli.json"
+        config_path.write_text(
+            "{\"socketcli\": {\"reach\": true, \"sarif_scope\": \"full\", \"sarif_grouping\": \"alert\", \"sarif_reachability\": \"reachable\"}}",
+            encoding="utf-8",
+        )
+        config = CliConfig.from_args(self.BASE_ARGS + ["--config", str(config_path)])
+        assert config.reach is True
+        assert config.sarif_scope == "full"
+        assert config.sarif_grouping == "alert"
+        assert config.sarif_reachability == "reachable"
diff --git a/tests/unit/test_output.py b/tests/unit/test_output.py
index 5fa65d3..0fe007e 100644
--- a/tests/unit/test_output.py
+++ b/tests/unit/test_output.py
@@ -12,7 +12,10 @@ def handler(self):
         config.disable_blocking = False
         config.strict_blocking = False
         config.sarif_file = None
-        config.sarif_reachable_only = False
+        config.sarif_reachability = "all"
+        config.sarif_scope = "diff"
+        config.sarif_grouping = "instance"
+        config.sarif_reachability = "all"
         config.sbom_file = None
         return OutputHandler(config, Mock())
 
@@ -60,6 +63,58 @@ def test_json_output_format(self, handler, caplog):
         assert output["new_alerts"][0]["error"] is True
         assert output["new_alerts"][0]["description"] == "Test description"
 
+    def test_json_output_includes_unchanged_alerts_with_strict_blocking(self, caplog):
+        import logging
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = True
+        config.sbom_file = None
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+        diff.new_alerts = [
+            Issue(
+                title="New",
+                severity="high",
+                description="new",
+                error=True,
+                key="new-key",
+                type="test-type",
+                pkg_type="npm",
+                pkg_name="new-package",
+                pkg_version="1.0.0",
+                purl="pkg:npm/new-package@1.0.0",
+            )
+        ]
+        diff.unchanged_alerts = [
+            Issue(
+                title="Existing",
+                severity="high",
+                description="existing",
+                error=True,
+                key="existing-key",
+                type="test-type",
+                pkg_type="npm",
+                pkg_name="existing-package",
+                pkg_version="1.0.0",
+                purl="pkg:npm/existing-package@1.0.0",
+            )
+        ]
+
+        with caplog.at_level(logging.INFO, logger="socketcli"):
+            handler.output_console_json(diff)
+
+        output = json.loads(caplog.messages[-1])
+        assert len(output["new_alerts"]) == 2
+        titles = {a["title"] for a in output["new_alerts"]}
+        assert titles == {"New", "Existing"}
+
     def test_sbom_file_saving(self, handler, tmp_path):
         # Test SBOM file is created correctly
         diff = Diff()
@@ -182,6 +237,7 @@ def test_sarif_file_output(self, tmp_path):
 
         config = Mock(spec=CliConfig)
         config.sarif_file = str(sarif_path)
+        config.sarif_scope = "diff"
         config.sbom_file = None
 
         handler = OutputHandler(config, Mock())
@@ -210,21 +266,50 @@ def test_sarif_file_output(self, tmp_path):
             sarif_data = json.load(f)
         assert sarif_data["version"] == "2.1.0"
 
-    def test_sarif_reachable_only_filters_non_blocking(self, tmp_path):
-        """Test that --sarif-reachable-only excludes non-blocking (unreachable) alerts"""
+    def test_sarif_reachability_reachable_filters_non_reachable(self, tmp_path):
+        """Test that --sarif-reachability reachable uses .socket.facts.json reachability."""
         from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
         sarif_path = tmp_path / "report.sarif"
+        facts_path = tmp_path / ".socket.facts.json"
 
         config = Mock(spec=CliConfig)
         config.sarif_file = str(sarif_path)
-        config.sarif_reachable_only = True
+        config.sarif_reachability = "reachable"
+        config.sarif_scope = "diff"
         config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
 
         handler = OutputHandler(config, Mock())
 
-        def make_issue(name, error):
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "reachable-pkg",
+                    "version": "1.0.0",
+                    "vulnerabilities": [{"ghsaId": "GHSA-AAAA-BBBB-CCCC", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-AAAA-BBBB-CCCC",
+                        "reachability": [{"type": "reachable"}]
+                    }]
+                },
+                {
+                    "type": "npm",
+                    "name": "unreachable-pkg",
+                    "version": "1.0.0",
+                    "vulnerabilities": [{"ghsaId": "GHSA-DDDD-EEEE-FFFF", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-DDDD-EEEE-FFFF",
+                        "reachability": [{"type": "unreachable"}]
+                    }]
+                }
+            ]
+        }))
+
+        def make_issue(name, error, ghsa_id):
             return Issue(
                 pkg_name=name,
                 pkg_version="1.0.0",
@@ -237,13 +322,14 @@ def make_issue(name, error):
                 key=f"key-{name}",
                 purl=f"pkg:npm/{name}@1.0.0",
                 error=error,
+                props={"ghsaId": ghsa_id},
             )
 
         diff = Diff()
         diff.id = "test-scan-id"
         diff.new_alerts = [
-            make_issue("reachable-pkg", error=True),
-            make_issue("unreachable-pkg", error=False),
+            make_issue("reachable-pkg", error=False, ghsa_id="GHSA-AAAA-BBBB-CCCC"),
+            make_issue("unreachable-pkg", error=True, ghsa_id="GHSA-DDDD-EEEE-FFFF"),
         ]
 
         handler.output_console_sarif(diff)
@@ -255,8 +341,8 @@ def make_issue(name, error):
         assert any("reachable-pkg" in r for r in rule_ids)
         assert not any("unreachable-pkg" in r for r in rule_ids)
 
-    def test_sarif_reachable_only_false_includes_all(self, tmp_path):
-        """Test that without --sarif-reachable-only all alerts are included"""
+    def test_sarif_reachability_reachable_falls_back_to_blocking_when_facts_missing(self, tmp_path):
+        """Test that missing facts file falls back to historical blocking filter."""
         from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
@@ -264,7 +350,102 @@ def test_sarif_reachable_only_false_includes_all(self, tmp_path):
 
         config = Mock(spec=CliConfig)
         config.sarif_file = str(sarif_path)
-        config.sarif_reachable_only = False
+        config.sarif_reachability = "reachable"
+        config.sarif_scope = "diff"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = [
+            Issue(pkg_name="blocking-pkg", pkg_version="1.0.0", severity="high",
+                  title="Vuln", description="test", type="vulnerability",
+                  manifests="package.json", pkg_type="npm", key="k1",
+                  purl="pkg:npm/blocking-pkg@1.0.0", error=True),
+            Issue(pkg_name="warn-pkg", pkg_version="1.0.0", severity="low",
+                  title="Vuln", description="test", type="vulnerability",
+                  manifests="package.json", pkg_type="npm", key="k2",
+                  purl="pkg:npm/warn-pkg@1.0.0", error=False),
+        ]
+
+        handler.output_console_sarif(diff)
+
+        with open(sarif_path) as f:
+            sarif_data = json.load(f)
+
+        rule_ids = [r["ruleId"] for r in sarif_data["runs"][0]["results"]]
+        assert any("blocking-pkg" in r for r in rule_ids)
+        assert not any("warn-pkg" in r for r in rule_ids)
+
+    def test_sarif_output_includes_unchanged_with_strict_blocking(self, tmp_path):
+        """Strict blocking should include unchanged alerts in diff-scope SARIF output."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path_strict_false = tmp_path / "strict-false.sarif"
+        sarif_path_strict_true = tmp_path / "strict-true.sarif"
+
+        def build_handler(strict_blocking, output_path):
+            config = Mock(spec=CliConfig)
+            config.sarif_file = str(output_path)
+            config.sarif_reachability = "all"
+            config.sarif_scope = "diff"
+            config.sbom_file = None
+            config.strict_blocking = strict_blocking
+            config.target_path = str(tmp_path)
+            config.reach_output_file = ".socket.facts.json"
+            return OutputHandler(config, Mock())
+
+        def build_diff():
+            diff = Diff()
+            diff.id = "test-scan-id"
+            diff.new_alerts = [
+                Issue(pkg_name="pkg-a", pkg_version="1.0.0", severity="high",
+                      title="Vuln A", description="test", type="vulnerability",
+                      manifests="package.json", pkg_type="npm", key="a",
+                      purl="pkg:npm/pkg-a@1.0.0", error=True),
+            ]
+            diff.unchanged_alerts = [
+                Issue(pkg_name="pkg-old", pkg_version="1.0.0", severity="high",
+                      title="Old Vuln", description="test", type="vulnerability",
+                      manifests="package.json", pkg_type="npm", key="old",
+                      purl="pkg:npm/pkg-old@1.0.0", error=True),
+            ]
+            return diff
+
+        handler_false = build_handler(False, sarif_path_strict_false)
+        handler_true = build_handler(True, sarif_path_strict_true)
+
+        handler_false.output_console_sarif(build_diff())
+        handler_true.output_console_sarif(build_diff())
+
+        with open(sarif_path_strict_false) as f:
+            sarif_false = json.load(f)
+        with open(sarif_path_strict_true) as f:
+            sarif_true = json.load(f)
+
+        false_rule_ids = [r["ruleId"] for r in sarif_false["runs"][0]["results"]]
+        true_rule_ids = [r["ruleId"] for r in sarif_true["runs"][0]["results"]]
+
+        assert any("pkg-a" in r for r in false_rule_ids)
+        assert not any("pkg-old" in r for r in false_rule_ids)
+        assert any("pkg-a" in r for r in true_rule_ids)
+        assert any("pkg-old" in r for r in true_rule_ids)
+
+    def test_sarif_reachability_all_includes_all(self, tmp_path):
+        """Test that --sarif-reachability all includes all alerts."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        sarif_path = tmp_path / "report.sarif"
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(sarif_path)
+        config.sarif_reachability = "all"
+        config.sarif_scope = "diff"
         config.sbom_file = None
 
         handler = OutputHandler(config, Mock())
@@ -300,6 +481,7 @@ def test_sarif_no_file_when_not_configured(self, tmp_path):
 
         config = Mock(spec=CliConfig)
         config.sarif_file = None
+        config.sarif_scope = "diff"
         config.sbom_file = None
 
         handler = OutputHandler(config, Mock())
@@ -322,6 +504,7 @@ def test_sarif_file_nested_directory(self, tmp_path):
 
         config = Mock(spec=CliConfig)
         config.sarif_file = str(sarif_path)
+        config.sarif_scope = "diff"
         config.sbom_file = None
 
         handler = OutputHandler(config, Mock())
@@ -335,4 +518,299 @@ def test_sarif_file_nested_directory(self, tmp_path):
         assert sarif_path.exists()
         with open(sarif_path) as f:
             sarif_data = json.load(f)
-        assert sarif_data["version"] == "2.1.0"
\ No newline at end of file
+        assert sarif_data["version"] == "2.1.0"
+
+    def test_sarif_scope_full_before_after_reachable_filtering_snapshot(self, tmp_path):
+        """Full-scope SARIF should show before/after changes with reachable-only filtering."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        facts_path = tmp_path / ".socket.facts.json"
+        all_path = tmp_path / "full-all.sarif"
+        reachable_path = tmp_path / "full-reachable.sarif"
+
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "pkg-reach",
+                    "version": "1.0.0",
+                    "manifestFiles": ["package.json"],
+                    "vulnerabilities": [{"ghsaId": "GHSA-1111-2222-3333", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-1111-2222-3333",
+                        "reachability": [{"type": "reachable"}]
+                    }]
+                },
+                {
+                    "type": "npm",
+                    "name": "pkg-unreach",
+                    "version": "2.0.0",
+                    "manifestFiles": ["package-lock.json"],
+                    "vulnerabilities": [{"ghsaId": "GHSA-4444-5555-6666", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-4444-5555-6666",
+                        "reachability": [{"type": "unreachable"}]
+                    }]
+                }
+            ]
+        }))
+
+        def build_handler(output_path, reachable_only):
+            config = Mock(spec=CliConfig)
+            config.sarif_file = str(output_path)
+            config.sarif_reachability = "reachable" if reachable_only else "all"
+            config.sarif_scope = "full"
+            config.sbom_file = None
+            config.target_path = str(tmp_path)
+            config.reach_output_file = ".socket.facts.json"
+            return OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.new_alerts = []  # Full scope should not depend on diff alerts
+
+        handler_all = build_handler(all_path, reachable_only=False)
+        handler_all.output_console_sarif(diff)
+        with open(all_path) as f:
+            sarif_all = json.load(f)
+
+        handler_reachable = build_handler(reachable_path, reachable_only=True)
+        handler_reachable.output_console_sarif(diff)
+        with open(reachable_path) as f:
+            sarif_reachable = json.load(f)
+
+        all_results = sarif_all["runs"][0]["results"]
+        reachable_results = sarif_reachable["runs"][0]["results"]
+
+        # Before: includes reachable + unreachable
+        assert len(all_results) == 2
+        # After applying reachable-only: only reachable remains
+        assert len(reachable_results) == 1
+        assert reachable_results[0]["properties"]["reachability"] == "reachable"
+
+    def test_sarif_scope_full_works_when_diff_not_run(self, tmp_path):
+        """Full scope should still emit SARIF when diff id is NO_DIFF_RAN."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        facts_path = tmp_path / ".socket.facts.json"
+        out_path = tmp_path / "full-no-diff.sarif"
+
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "pkg-reach",
+                    "version": "1.0.0",
+                    "manifestFiles": ["package.json"],
+                    "vulnerabilities": [{"ghsaId": "GHSA-1111-2222-3333", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-1111-2222-3333",
+                        "reachability": [{"type": "reachable"}]
+                    }]
+                }
+            ]
+        }))
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(out_path)
+        config.sarif_reachability = "reachable"
+        config.sarif_scope = "full"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "NO_DIFF_RAN"
+        diff.new_alerts = []
+
+        handler.output_console_sarif(diff)
+
+        with open(out_path) as f:
+            sarif = json.load(f)
+
+        assert len(sarif["runs"][0]["results"]) == 1
+
+    def test_sarif_scope_full_dedupes_duplicate_manifest_uris(self, tmp_path):
+        """Full scope should not emit duplicate results for duplicate manifest entries."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        facts_path = tmp_path / ".socket.facts.json"
+        out_path = tmp_path / "full-dedup.sarif"
+
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "pkg-reach",
+                    "version": "1.0.0",
+                    "manifestFiles": ["package.json", "package.json"],
+                    "vulnerabilities": [{"ghsaId": "GHSA-1111-2222-3333", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-1111-2222-3333",
+                        "reachability": [{"type": "reachable"}]
+                    }]
+                }
+            ]
+        }))
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(out_path)
+        config.sarif_reachability = "reachable"
+        config.sarif_scope = "full"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff(id="snapshot", new_alerts=[])
+        handler.output_console_sarif(diff)
+
+        with open(out_path) as f:
+            sarif = json.load(f)
+
+        assert len(sarif["runs"][0]["results"]) == 1
+
+    def test_sarif_scope_full_with_sarif_file_suppresses_stdout(self, tmp_path, capsys):
+        """Full scope + --sarif-file should avoid printing massive SARIF JSON to stdout."""
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        facts_path = tmp_path / ".socket.facts.json"
+        out_path = tmp_path / "full-suppressed.sarif"
+
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "pkg-reach",
+                    "version": "1.0.0",
+                    "manifestFiles": ["package.json"],
+                    "vulnerabilities": [{"ghsaId": "GHSA-1111-2222-3333", "severity": "HIGH"}],
+                    "reachability": [{
+                        "ghsa_id": "GHSA-1111-2222-3333",
+                        "reachability": [{"type": "reachable"}]
+                    }]
+                }
+            ]
+        }))
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(out_path)
+        config.sarif_reachability = "reachable"
+        config.sarif_scope = "full"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+        diff = Diff(id="snapshot", new_alerts=[])
+
+        handler.output_console_sarif(diff)
+        captured = capsys.readouterr()
+
+        assert captured.out == ""
+        assert out_path.exists()
+
+    def test_sarif_scope_full_alert_grouping_dedupes_versions(self, tmp_path):
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        out_path = tmp_path / "full-alert-grouping.sarif"
+        facts_path = tmp_path / ".socket.facts.json"
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "tmp",
+                    "version": "0.1.0",
+                    "manifestFiles": [{"path": "package-lock.json"}],
+                    "vulnerabilities": [{"ghsaId": "GHSA-x", "range": "<0.2.4", "severity": "high"}],
+                    "reachability": [{"ghsa_id": "GHSA-x", "reachability": [{"type": "reachable"}]}],
+                },
+                {
+                    "type": "npm",
+                    "name": "tmp",
+                    "version": "0.0.24",
+                    "manifestFiles": [{"path": "package-lock.json"}],
+                    "vulnerabilities": [{"ghsaId": "GHSA-x", "range": "<0.2.4", "severity": "high"}],
+                    "reachability": [{"ghsa_id": "GHSA-x", "reachability": [{"type": "reachable"}]}],
+                },
+            ]
+        }))
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(out_path)
+        config.sarif_reachability = "all"
+        config.sarif_scope = "full"
+        config.sarif_grouping = "alert"
+        config.sarif_reachability = "reachable"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+        diff = Diff(id="snapshot", new_alerts=[])
+
+        handler.output_console_sarif(diff)
+        with open(out_path) as f:
+            sarif = json.load(f)
+
+        results = sarif["runs"][0]["results"]
+        assert len(results) == 1
+        props = results[0]["properties"]
+        assert sorted(props["versions"]) == ["0.0.24", "0.1.0"]
+        assert props["reachability"] == "reachable"
+
+    def test_sarif_scope_full_potentially_filter(self, tmp_path):
+        from socketsecurity.config import CliConfig
+        from unittest.mock import Mock
+
+        out_path = tmp_path / "full-potentially.sarif"
+        facts_path = tmp_path / ".socket.facts.json"
+        facts_path.write_text(json.dumps({
+            "components": [
+                {
+                    "type": "npm",
+                    "name": "alpha",
+                    "version": "1.0.0",
+                    "manifestFiles": [{"path": "package-lock.json"}],
+                    "vulnerabilities": [{"ghsaId": "GHSA-reach", "range": "<2.0.0", "severity": "high"}],
+                    "reachability": [{"ghsa_id": "GHSA-reach", "reachability": [{"type": "reachable"}]}],
+                },
+                {
+                    "type": "npm",
+                    "name": "beta",
+                    "version": "1.0.0",
+                    "manifestFiles": [{"path": "package-lock.json"}],
+                    "vulnerabilities": [{"ghsaId": "GHSA-unknown", "range": "<2.0.0", "severity": "high"}],
+                    "reachability": [{"ghsa_id": "GHSA-unknown", "reachability": [{"type": "unknown"}]}],
+                },
+            ]
+        }))
+
+        config = Mock(spec=CliConfig)
+        config.sarif_file = str(out_path)
+        config.sarif_reachability = "all"
+        config.sarif_scope = "full"
+        config.sarif_grouping = "instance"
+        config.sarif_reachability = "potentially"
+        config.sbom_file = None
+        config.target_path = str(tmp_path)
+        config.reach_output_file = ".socket.facts.json"
+
+        handler = OutputHandler(config, Mock())
+        diff = Diff(id="snapshot", new_alerts=[])
+
+        handler.output_console_sarif(diff)
+        with open(out_path) as f:
+            sarif = json.load(f)
+
+        results = sarif["runs"][0]["results"]
+        assert len(results) == 1
+        assert results[0]["ruleId"].startswith("beta==1.0.0")
diff --git a/tests/unit/test_slack_plugin.py b/tests/unit/test_slack_plugin.py
new file mode 100644
index 0000000..56c05b5
--- /dev/null
+++ b/tests/unit/test_slack_plugin.py
@@ -0,0 +1,122 @@
+import json
+from types import SimpleNamespace
+from unittest.mock import Mock, patch
+
+from socketsecurity.core.classes import Diff, Issue
+from socketsecurity.plugins.slack import SlackPlugin
+
+
+def _issue(pkg_name: str, ghsa_id: str, error: bool = False) -> Issue:
+    return Issue(
+        pkg_name=pkg_name,
+        pkg_version="1.0.0",
+        severity="high",
+        title=f"Vuln in {pkg_name}",
+        description="test",
+        type="vulnerability",
+        manifests="package.json",
+        pkg_type="npm",
+        key=f"key-{pkg_name}",
+        purl=f"pkg:npm/{pkg_name}@1.0.0",
+        error=error,
+        introduced_by=[("dep", "package.json")],
+        url="https://socket.dev/test",
+        props={"ghsaId": ghsa_id},
+    )
+
+
+def test_slack_diff_alerts_include_unchanged_when_strict_blocking():
+    plugin = SlackPlugin({
+        "enabled": True,
+        "mode": "webhook",
+        "url": "https://hooks.slack.com/services/test",
+        "url_configs": {"default": {}},
+    })
+    cfg = SimpleNamespace(
+        repo="example-repo",
+        reach=False,
+        strict_blocking=True,
+        enable_debug=False,
+        target_path=".",
+        reach_output_file=".socket.facts.json",
+    )
+
+    diff = Diff()
+    diff.new_alerts = [_issue("new-pkg", "GHSA-AAAA-BBBB-CCCC", error=True)]
+    diff.unchanged_alerts = [_issue("old-pkg", "GHSA-DDDD-EEEE-FFFF", error=True)]
+
+    captured_titles = []
+
+    def _capture(diff_arg, _config):
+        captured_titles.extend([a.title for a in diff_arg.new_alerts])
+        return [{"type": "section", "text": {"type": "mrkdwn", "text": "ok"}}]
+
+    with patch.object(SlackPlugin, "create_slack_blocks_from_diff", side_effect=_capture), \
+         patch("socketsecurity.plugins.slack.requests.post") as mock_post:
+        mock_post.return_value = Mock(status_code=200, text="ok")
+        plugin._send_webhook_alerts(diff, cfg)
+
+    assert "Vuln in new-pkg" in captured_titles
+    assert "Vuln in old-pkg" in captured_titles
+
+
+def test_slack_reachability_alerts_only_uses_facts_reachability(tmp_path):
+    facts_path = tmp_path / ".socket.facts.json"
+    facts_path.write_text(json.dumps({
+        "components": [
+            {
+                "type": "npm",
+                "name": "reachable-pkg",
+                "version": "1.0.0",
+                "vulnerabilities": [{"ghsaId": "GHSA-AAAA-BBBB-CCCC", "severity": "HIGH"}],
+                "reachability": [{
+                    "ghsa_id": "GHSA-AAAA-BBBB-CCCC",
+                    "reachability": [{"type": "reachable"}],
+                }],
+            },
+            {
+                "type": "npm",
+                "name": "unreachable-pkg",
+                "version": "1.0.0",
+                "vulnerabilities": [{"ghsaId": "GHSA-DDDD-EEEE-FFFF", "severity": "HIGH"}],
+                "reachability": [{
+                    "ghsa_id": "GHSA-DDDD-EEEE-FFFF",
+                    "reachability": [{"type": "unreachable"}],
+                }],
+            },
+        ],
+    }), encoding="utf-8")
+
+    plugin = SlackPlugin({
+        "enabled": True,
+        "mode": "webhook",
+        "url": "https://hooks.slack.com/services/test",
+        "url_configs": {"default": {"reachability_alerts_only": True}},
+    })
+    cfg = SimpleNamespace(
+        repo="example-repo",
+        reach=True,
+        strict_blocking=True,
+        enable_debug=False,
+        target_path=str(tmp_path),
+        reach_output_file=".socket.facts.json",
+    )
+
+    diff = Diff()
+    # Strict mode should include unchanged alert set before reachability filtering.
+    diff.new_alerts = [_issue("unreachable-pkg", "GHSA-DDDD-EEEE-FFFF", error=True)]
+    diff.unchanged_alerts = [_issue("reachable-pkg", "GHSA-AAAA-BBBB-CCCC", error=False)]
+
+    captured_titles = []
+
+    def _capture(diff_arg, _config):
+        captured_titles.extend([a.title for a in diff_arg.new_alerts])
+        return [{"type": "section", "text": {"type": "mrkdwn", "text": "ok"}}]
+
+    with patch.object(SlackPlugin, "create_slack_blocks_from_diff", side_effect=_capture), \
+         patch.object(SlackPlugin, "_send_reachability_alerts"), \
+         patch("socketsecurity.plugins.slack.requests.post") as mock_post:
+        mock_post.return_value = Mock(status_code=200, text="ok")
+        plugin._send_webhook_alerts(diff, cfg)
+
+    assert captured_titles == ["Vuln in reachable-pkg"]
diff --git a/uv.lock b/uv.lock
index 6ef77ff..8edd838 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1263,7 +1263,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.76"
+version = "2.2.78"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
diff --git a/workflows/buildkite.yml b/workflows/buildkite.yml
new file mode 100644
index 0000000..a2f8e45
--- /dev/null
+++ b/workflows/buildkite.yml
@@ -0,0 +1,13 @@
+# Socket Security Buildkite pipeline example
+# Runs Socket CLI in a Buildkite step using repository-level environment variables.
+
+steps:
+  - label: "Socket Security Scan"
+    command: |
+      socketcli \
+        --target-path . \
+        --scm api \
+        --pr-number 0
+    env:
+      # Configure this in Buildkite pipeline/repo settings.
+      SOCKET_SECURITY_API_TOKEN: "${SOCKET_SECURITY_API_TOKEN}"

From 27a4738f7ac7acacd289456296faa0e4c0ce9ea9 Mon Sep 17 00:00:00 2001
From: lelia <lelia@socket.dev>
Date: Mon, 23 Mar 2026 16:34:41 -0400
Subject: [PATCH 37/80] Update required Python version, tweak CI checks (#172)

* Add guard to not run on external fork PRs

Signed-off-by: lelia <lelia@socket.dev>

* Update python tests to include installation check

Signed-off-by: lelia <lelia@socket.dev>

* Bump project verison and required Python version

Signed-off-by: lelia <lelia@socket.dev>

* Add more unit test checks

Signed-off-by: lelia <lelia@socket.dev>

* Bump project version and required Python version

Signed-off-by: lelia <lelia@socket.dev>

* Add additional guardrails for PR check behaviors

Signed-off-by: lelia <lelia@socket.dev>

---------

Signed-off-by: lelia <lelia@socket.dev>
---
 .github/workflows/e2e-test.yml      |   4 ++
 .github/workflows/pr-preview.yml    |   1 +
 .github/workflows/python-tests.yml  |  20 ++++++
 .github/workflows/version-check.yml |   2 +-
 pyproject.toml                      |   5 +-
 socketsecurity/__init__.py          |   2 +-
 tests/unit/test_config.py           |  15 ++++
 uv.lock                             | 103 +---------------------------
 8 files changed, 45 insertions(+), 107 deletions(-)

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 6e0e66f..c5426fb 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -4,9 +4,11 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 jobs:
   e2e-scan:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
@@ -48,6 +50,7 @@ jobs:
           fi
 
   e2e-sarif:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
@@ -87,6 +90,7 @@ jobs:
           "
 
   e2e-reachability:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 28c7870..c14f190 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -5,6 +5,7 @@ on:
 
 jobs:
   preview:
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       id-token: write
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 3403b73..d30e67a 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -50,3 +50,23 @@ jobs:
           uv sync --extra test
       - name: 🧪 run tests
         run: uv run pytest -q tests/unit/ tests/core/
+
+  unsupported-python-install:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+      - name: 🐍 setup python
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: "3.10"
+      - name: 🚫 verify install is rejected on unsupported python
+        run: |
+          python -m pip install --upgrade pip
+          if pip install .; then
+            echo "Expected pip install . to fail on Python 3.10"
+            exit 1
+          fi
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index f2d63e4..3276e73 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Manage PR Comment
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
-        if: always()
+        if: always() && github.event.pull_request.head.repo.full_name == github.repository
         env:
           MAIN_VERSION: ${{ env.MAIN_VERSION }}
           PR_VERSION: ${{ env.PR_VERSION }}
diff --git a/pyproject.toml b/pyproject.toml
index d401856..7b7cd2a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,8 +6,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.78"
-requires-python = ">= 3.10"
+version = "2.2.79"
+requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
     'requests',
@@ -166,4 +166,3 @@ include = ["socketsecurity", "LICENSE"]
 dev = [
     "pre-commit>=4.3.0",
 ]
-
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 987c20b..e56db94 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.78'
+__version__ = '2.2.79'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 2c46628..4666b71 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -1,5 +1,7 @@
+from pathlib import Path
 import pytest
 from unittest.mock import patch
+import tomllib
 from socketsecurity.core.socket_config import SocketConfig
 from socketsecurity.config import CliConfig
 
@@ -162,3 +164,16 @@ def test_config_file_json_sets_defaults(self, tmp_path):
         assert config.sarif_scope == "full"
         assert config.sarif_grouping == "alert"
         assert config.sarif_reachability == "reachable"
+
+
+def test_pyproject_requires_python_matches_tomllib_usage():
+    pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
+    requires_python = pyproject["project"]["requires-python"]
+
+    assert requires_python.startswith(">=")
+
+    minimum_version = tuple(int(part) for part in requires_python.removeprefix(">=").split(".")[:2])
+    config_module = Path("socketsecurity/config.py").read_text(encoding="utf-8")
+
+    if "import tomllib" in config_module:
+        assert minimum_version >= (3, 11)
diff --git a/uv.lock b/uv.lock
index 8edd838..4c6607f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,13 +1,12 @@
 version = 1
 revision = 3
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 
 [[package]]
 name = "anyio"
 version = "4.12.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
     { name = "idna" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
@@ -16,15 +15,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7f/9c/36c5c37947ebfb8c7f22e0eb6e4d188ee2d53aa3880f3f2744fb894f0cb1/anyio-4.12.0-py3-none-any.whl", hash = "sha256:dad2376a628f98eeca4881fc56cd06affd18f659b17a747d3ff0307ced94b1bb", size = 113362, upload-time = "2025-11-28T23:36:57.897Z" },
 ]
 
-[[package]]
-name = "backports-asyncio-runner"
-version = "1.2.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/8e/ff/70dca7d7cb1cbc0edb2c6cc0c38b65cba36cccc491eca64cabd5fe7f8670/backports_asyncio_runner-1.2.0.tar.gz", hash = "sha256:a5aa7b2b7d8f8bfcaa2b57313f70792df84e32a2a746f585213373f900b42162", size = 69893, upload-time = "2025-07-02T02:27:15.685Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/a0/59/76ab57e3fe74484f48a53f8e337171b4a2349e506eabe136d7e01d059086/backports_asyncio_runner-1.2.0-py3-none-any.whl", hash = "sha256:0da0a936a8aeb554eccb426dc55af3ba63bcdc69fa1a600b5bb305413a4477b5", size = 12313, upload-time = "2025-07-02T02:27:14.263Z" },
-]
-
 [[package]]
 name = "backports-tarfile"
 version = "1.2.0"
@@ -40,23 +30,6 @@ version = "1.3.0"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/f4/b1/36a5182ce1d8ef9ef32bff69037bd28b389bbdb66338f8069e61da7028cb/backports_zstd-1.3.0.tar.gz", hash = "sha256:e8b2d68e2812f5c9970cabc5e21da8b409b5ed04e79b4585dbffa33e9b45ebe2", size = 997138, upload-time = "2025-12-29T17:28:06.143Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/76/70/766f6ebbb9db2ed75951f0a671ee15931dc69278c84d9f09b08dd6b67c3e/backports_zstd-1.3.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:0a2db17a6d9bf6b4dc223b3f6414aa9db6d1afe9de9bff61d582c2934ca456a0", size = 435664, upload-time = "2025-12-29T17:25:29.201Z" },
-    { url = "https://files.pythonhosted.org/packages/55/f8/7b3fad9c6ee5ff3bcd7c941586675007330197ff4a388f01c73198ecc8bb/backports_zstd-1.3.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:a7f16b98ba81780a9517ce6c493e1aea9b7d72de2b1efa08375136c270e1ecba", size = 362060, upload-time = "2025-12-29T17:25:30.94Z" },
-    { url = "https://files.pythonhosted.org/packages/68/9e/cad0f508ed7c3fbd07398f22b5bf25aa0523fcf56c84c3def642909e80ae/backports_zstd-1.3.0-cp310-cp310-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:1124a169a647671ccb4654a0ef1d0b42d6735c45ce3d0adf609df22fb1f099db", size = 505958, upload-time = "2025-12-29T17:25:32.694Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/dc/96dc55c043b0d86e53ae9608b496196936244c1ecf7e95cdf66d0dbc0f23/backports_zstd-1.3.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8410fda08b36202d01ab4503f6787c763898888cb1a48c19fce94711563d3ee3", size = 475571, upload-time = "2025-12-29T17:25:33.9Z" },
-    { url = "https://files.pythonhosted.org/packages/20/48/d9c8c8c2a5ac57fc5697f1945254af31407b0c5f80335a175a7c215b4118/backports_zstd-1.3.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ab139d1fc0e91a697e82fa834e6404098802f11b6035607174776173ded9a2cc", size = 581199, upload-time = "2025-12-29T17:25:35.566Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/ca/7fe70d2d39ed39e26a6c6f6c1dd229f1ab889500d5c90b17527702b1a21e/backports_zstd-1.3.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6f3115d203f387f77c23b5461fb6678d282d4f276f9f39298ad242b00120afc7", size = 640846, upload-time = "2025-12-29T17:25:36.86Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/d8/5b8580469e70b72402212885bf19b9d31eaf23549b602e0c294edf380e25/backports_zstd-1.3.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:116f65cce84e215dfac0414924b051faf8d29dc7188cf3944dd1e5be8dd15a32", size = 491061, upload-time = "2025-12-29T17:25:38.721Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/dd/17a752263fccd1ba24184b7e89c14cd31553d512e2e5b065f38e63a0ba86/backports_zstd-1.3.0-cp310-cp310-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:04def169e4a9ae291298124da4e097c6d6545d0e93164f934b716da04d24630a", size = 565071, upload-time = "2025-12-29T17:25:40.372Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/81/df23d3fe664b2497ab2ec01dc012cb9304e7d568c67f50b1b324fb2d8cbb/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:481b586291ef02a250f03d4c31a37c9881e5e93556568abbd20ca1ad720d443f", size = 481518, upload-time = "2025-12-29T17:25:41.925Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/cd/e50dd85fde890c5d79e1ed5dc241f1c45f87b6c12571fdb60add57f2ee66/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:0290979eea67f7275fa42d5859cc5bea94f2c08cca6bc36396673476773d2bad", size = 509464, upload-time = "2025-12-29T17:25:43.844Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/bb/e429156e4b834837fe78b4f32ed512491aea39415444420c79ccd3aa0526/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:01c699d8c803dc9f9c9d6ede21b75ec99f45c3b411821011692befca538928cb", size = 585563, upload-time = "2025-12-29T17:25:45.038Z" },
-    { url = "https://files.pythonhosted.org/packages/95/c0/1a0d245325827242aefe76f4f3477ec183b996b8db5105698564f8303481/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:2c662912cfc1a5ebd1d2162ac651549d58bd3c97a8096130ec13c703fca355f2", size = 562889, upload-time = "2025-12-29T17:25:46.576Z" },
-    { url = "https://files.pythonhosted.org/packages/93/42/126b2bc7540a15452c3ebdf190ebfea8a8644e29b22f4e10e2a6aa2389e4/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:3180c8eb085396928e9946167e610aa625922b82c3e2263c5f17000556370168", size = 631423, upload-time = "2025-12-29T17:25:47.81Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/32/018e49657411582569032b7d1bb5d62e514aad8b44952de740ec6250588d/backports_zstd-1.3.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5b9a8c75a294e7ffa18fc8425a763facc366435a8b442e4dffdc19fa9499a22c", size = 495122, upload-time = "2025-12-29T17:25:49.377Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/9e/cdd1d2e1d3612bb90d9cf9b23bea06f2155cdafccd8b6f28a1c4d7750004/backports_zstd-1.3.0-cp310-cp310-win32.whl", hash = "sha256:845defdb172385f17123d92a00d2e952d341e9ae310bfa2410c292bf03846034", size = 288573, upload-time = "2025-12-29T17:25:51.167Z" },
-    { url = "https://files.pythonhosted.org/packages/55/7c/2e9c80f08375bd14262cefa69297a926134f517c9955c0795eec5e1d470e/backports_zstd-1.3.0-cp310-cp310-win_amd64.whl", hash = "sha256:43a9fea6299c801da85221e387b32d90a9ad7c62aa2a34edf525359ce5ad8f3a", size = 313506, upload-time = "2025-12-29T17:25:52.778Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/5d/fa67e8174f54db44eb33498abb7f98bea4f2329e873b225391bda0113a5e/backports_zstd-1.3.0-cp310-cp310-win_arm64.whl", hash = "sha256:df8473cb117e1316e6c6101f2724e025bd8f50af2dc009d0001c0aabfb5eb57c", size = 288688, upload-time = "2025-12-29T17:25:54.012Z" },
     { url = "https://files.pythonhosted.org/packages/ac/28/ed31a0e35feb4538a996348362051b52912d50f00d25c2d388eccef9242c/backports_zstd-1.3.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:249f90b39d3741c48620021a968b35f268ca70e35f555abeea9ff95a451f35f9", size = 435660, upload-time = "2025-12-29T17:25:55.207Z" },
     { url = "https://files.pythonhosted.org/packages/00/0d/3db362169d80442adda9dd563c4f0bb10091c8c1c9a158037f4ecd53988e/backports_zstd-1.3.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:b0e71e83e46154a9d3ced6d4de9a2fea8207ee1e4832aeecf364dc125eda305c", size = 362056, upload-time = "2025-12-29T17:25:56.729Z" },
     { url = "https://files.pythonhosted.org/packages/bd/00/b67ba053a7d6f6dbe2f8a704b7d3a5e01b1d2e2e8edbc9b634f2702ef73c/backports_zstd-1.3.0-cp311-cp311-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:cbc6193acd21f96760c94dd71bf32b161223e8503f5277acb0a5ab54e5598957", size = 505957, upload-time = "2025-12-29T17:25:57.941Z" },
@@ -125,12 +98,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/32/04/cfab76878f360f124dbb533779e1e4603c801a0f5ada72ae5c742b7c4d7d/backports_zstd-1.3.0-cp313-cp313t-win32.whl", hash = "sha256:7d3f0f2499d2049ec53d2674c605a4b3052c217cc7ee49c05258046411685adc", size = 289389, upload-time = "2025-12-29T17:27:22.287Z" },
     { url = "https://files.pythonhosted.org/packages/cb/ff/dbcfb6c9c922ab6d98f3d321e7d0c7b34ecfa26f3ca71d930fe1ef639737/backports_zstd-1.3.0-cp313-cp313t-win_amd64.whl", hash = "sha256:eb2f8fab0b1ea05148394cb34a9e543a43477178765f2d6e7c84ed332e34935e", size = 314776, upload-time = "2025-12-29T17:27:23.458Z" },
     { url = "https://files.pythonhosted.org/packages/01/4b/82e4baae3117806639fe1c693b1f2f7e6133a7cefd1fa2e38018c8edcd68/backports_zstd-1.3.0-cp313-cp313t-win_arm64.whl", hash = "sha256:c66ad9eb5bfbe28c2387b7fc58ddcdecfb336d6e4e60bcba1694a906c1f21a6c", size = 289315, upload-time = "2025-12-29T17:27:24.601Z" },
-    { url = "https://files.pythonhosted.org/packages/95/b7/e843d32122f25d9568e75d1e7a29c00eae5e5728015604f3f6d02259b3a5/backports_zstd-1.3.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:3ab0d5632b84eff4355c42a04668cfe6466f7d390890f718978582bd1ff36949", size = 409771, upload-time = "2025-12-29T17:27:48.869Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/a5/d6a897d4b91732f54b4506858f1da65d7a5b2dc0dbe36a23992a64f09f5a/backports_zstd-1.3.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b97cea95dbb1a97c02afd718155fad93f747815069722107a429804c355e206", size = 339289, upload-time = "2025-12-29T17:27:50.055Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/b0/f0ce566ec221b284508eebbf574a779ba4a8932830db6ea03b6176f336a2/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:477895f2642f9397aeba69618df2c91d7f336e02df83d1e623ac37c5d3a5115e", size = 420335, upload-time = "2025-12-29T17:27:51.455Z" },
-    { url = "https://files.pythonhosted.org/packages/62/6d/bf55652c84c79b2565d3087265bcb097719540a313dee16359a54d83ab4e/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:330172aaf5fd3bfa53f49318abc6d1d4238cb043c384cf71f7b8f0fe2fb7ce31", size = 393880, upload-time = "2025-12-29T17:27:52.869Z" },
-    { url = "https://files.pythonhosted.org/packages/be/e0/d1feebb70ffeb150e2891c6f09700079f4a60085ebc67529eb1ca72fb5c2/backports_zstd-1.3.0-pp310-pypy310_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:32974e71eff15897ed3f8b7766a753d9f3197ea4f1c9025d80f8de099a691b99", size = 413840, upload-time = "2025-12-29T17:27:54.527Z" },
-    { url = "https://files.pythonhosted.org/packages/36/28/3b7be27ae51e418d3a724bbc4cb7fea77b6bd38b5007e333a56b0cb165c8/backports_zstd-1.3.0-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:993e3a34eaba5928a2065545e34bf75c65b9c34ecb67e43d5ef49b16cc182077", size = 299685, upload-time = "2025-12-29T17:27:56.149Z" },
     { url = "https://files.pythonhosted.org/packages/9a/d9/8c9c246e5ea79a4f45d551088b11b61f2dc7efcdc5dbe6df3be84a506e0c/backports_zstd-1.3.0-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:968167d29f012cee7b112ad031a8925e484e97e99288e55e4d62962c3a1013e3", size = 409666, upload-time = "2025-12-29T17:27:57.37Z" },
     { url = "https://files.pythonhosted.org/packages/a4/4f/a55b33c314ca8c9074e99daab54d04c5d212070ae7dbc435329baf1b139e/backports_zstd-1.3.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:d8f6fc7d62b71083b574193dd8fb3a60e6bb34880cc0132aad242943af301f7a", size = 339199, upload-time = "2025-12-29T17:27:58.542Z" },
     { url = "https://files.pythonhosted.org/packages/9d/13/ce31bd048b1c88d0f65d7af60b6cf89cfbed826c7c978f0ebca9a8a71cfc/backports_zstd-1.3.0-pp311-pypy311_pp73-manylinux2010_i686.manylinux_2_12_i686.manylinux_2_28_i686.whl", hash = "sha256:e0f2eca6aac280fdb77991ad3362487ee91a7fb064ad40043fb5a0bf5a376943", size = 420332, upload-time = "2025-12-29T17:28:00.332Z" },
@@ -182,14 +149,6 @@ dependencies = [
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/50/bd/b1a6362b80628111e6653c961f987faa55262b4002fcec42308cad1db680/cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c", size = 208811, upload-time = "2025-09-08T23:22:12.267Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/27/6933a8b2562d7bd1fb595074cf99cc81fc3789f6a6c05cdabb46284a3188/cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb", size = 216402, upload-time = "2025-09-08T23:22:13.455Z" },
-    { url = "https://files.pythonhosted.org/packages/05/eb/b86f2a2645b62adcfff53b0dd97e8dfafb5c8aa864bd0d9a2c2049a0d551/cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0", size = 203217, upload-time = "2025-09-08T23:22:14.596Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/e0/6cbe77a53acf5acc7c08cc186c9928864bd7c005f9efd0d126884858a5fe/cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4", size = 203079, upload-time = "2025-09-08T23:22:15.769Z" },
-    { url = "https://files.pythonhosted.org/packages/98/29/9b366e70e243eb3d14a5cb488dfd3a0b6b2f1fb001a203f653b93ccfac88/cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453", size = 216475, upload-time = "2025-09-08T23:22:17.427Z" },
-    { url = "https://files.pythonhosted.org/packages/21/7a/13b24e70d2f90a322f2900c5d8e1f14fa7e2a6b3332b7309ba7b2ba51a5a/cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495", size = 218829, upload-time = "2025-09-08T23:22:19.069Z" },
-    { url = "https://files.pythonhosted.org/packages/60/99/c9dc110974c59cc981b1f5b66e1d8af8af764e00f0293266824d9c4254bc/cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5", size = 211211, upload-time = "2025-09-08T23:22:20.588Z" },
-    { url = "https://files.pythonhosted.org/packages/49/72/ff2d12dbf21aca1b32a40ed792ee6b40f6dc3a9cf1644bd7ef6e95e0ac5e/cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb", size = 218036, upload-time = "2025-09-08T23:22:22.143Z" },
     { url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
     { url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
     { url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
@@ -241,22 +200,6 @@ version = "3.4.4"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/13/69/33ddede1939fdd074bce5434295f38fae7136463422fe4fd3e0e89b98062/charset_normalizer-3.4.4.tar.gz", hash = "sha256:94537985111c35f28720e43603b8e7b43a6ecfb2ce1d3058bbe955b73404e21a", size = 129418, upload-time = "2025-10-14T04:42:32.879Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1f/b8/6d51fc1d52cbd52cd4ccedd5b5b2f0f6a11bbf6765c782298b0f3e808541/charset_normalizer-3.4.4-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:e824f1492727fa856dd6eda4f7cee25f8518a12f3c4a56a74e8095695089cf6d", size = 209709, upload-time = "2025-10-14T04:40:11.385Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/af/1f9d7f7faafe2ddfb6f72a2e07a548a629c61ad510fe60f9630309908fef/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4bd5d4137d500351a30687c2d3971758aac9a19208fc110ccb9d7188fbe709e8", size = 148814, upload-time = "2025-10-14T04:40:13.135Z" },
-    { url = "https://files.pythonhosted.org/packages/79/3d/f2e3ac2bbc056ca0c204298ea4e3d9db9b4afe437812638759db2c976b5f/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:027f6de494925c0ab2a55eab46ae5129951638a49a34d87f4c3eda90f696b4ad", size = 144467, upload-time = "2025-10-14T04:40:14.728Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/85/1bf997003815e60d57de7bd972c57dc6950446a3e4ccac43bc3070721856/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f820802628d2694cb7e56db99213f930856014862f3fd943d290ea8438d07ca8", size = 162280, upload-time = "2025-10-14T04:40:16.14Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/8e/6aa1952f56b192f54921c436b87f2aaf7c7a7c3d0d1a765547d64fd83c13/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:798d75d81754988d2565bff1b97ba5a44411867c0cf32b77a7e8f8d84796b10d", size = 159454, upload-time = "2025-10-14T04:40:17.567Z" },
-    { url = "https://files.pythonhosted.org/packages/36/3b/60cbd1f8e93aa25d1c669c649b7a655b0b5fb4c571858910ea9332678558/charset_normalizer-3.4.4-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d1bb833febdff5c8927f922386db610b49db6e0d4f4ee29601d71e7c2694313", size = 153609, upload-time = "2025-10-14T04:40:19.08Z" },
-    { url = "https://files.pythonhosted.org/packages/64/91/6a13396948b8fd3c4b4fd5bc74d045f5637d78c9675585e8e9fbe5636554/charset_normalizer-3.4.4-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:9cd98cdc06614a2f768d2b7286d66805f94c48cde050acdbbb7db2600ab3197e", size = 151849, upload-time = "2025-10-14T04:40:20.607Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/7a/59482e28b9981d105691e968c544cc0df3b7d6133152fb3dcdc8f135da7a/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:077fbb858e903c73f6c9db43374fd213b0b6a778106bc7032446a8e8b5b38b93", size = 151586, upload-time = "2025-10-14T04:40:21.719Z" },
-    { url = "https://files.pythonhosted.org/packages/92/59/f64ef6a1c4bdd2baf892b04cd78792ed8684fbc48d4c2afe467d96b4df57/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:244bfb999c71b35de57821b8ea746b24e863398194a4014e4c76adc2bbdfeff0", size = 145290, upload-time = "2025-10-14T04:40:23.069Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/63/3bf9f279ddfa641ffa1962b0db6a57a9c294361cc2f5fcac997049a00e9c/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:64b55f9dce520635f018f907ff1b0df1fdc31f2795a922fb49dd14fbcdf48c84", size = 163663, upload-time = "2025-10-14T04:40:24.17Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/09/c9e38fc8fa9e0849b172b581fd9803bdf6e694041127933934184e19f8c3/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:faa3a41b2b66b6e50f84ae4a68c64fcd0c44355741c6374813a800cd6695db9e", size = 151964, upload-time = "2025-10-14T04:40:25.368Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/d1/d28b747e512d0da79d8b6a1ac18b7ab2ecfd81b2944c4c710e166d8dd09c/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:6515f3182dbe4ea06ced2d9e8666d97b46ef4c75e326b79bb624110f122551db", size = 161064, upload-time = "2025-10-14T04:40:26.806Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/9a/31d62b611d901c3b9e5500c36aab0ff5eb442043fb3a1c254200d3d397d9/charset_normalizer-3.4.4-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:cc00f04ed596e9dc0da42ed17ac5e596c6ccba999ba6bd92b0e0aef2f170f2d6", size = 155015, upload-time = "2025-10-14T04:40:28.284Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/f3/107e008fa2bff0c8b9319584174418e5e5285fef32f79d8ee6a430d0039c/charset_normalizer-3.4.4-cp310-cp310-win32.whl", hash = "sha256:f34be2938726fc13801220747472850852fe6b1ea75869a048d6f896838c896f", size = 99792, upload-time = "2025-10-14T04:40:29.613Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/66/e396e8a408843337d7315bab30dbf106c38966f1819f123257f5520f8a96/charset_normalizer-3.4.4-cp310-cp310-win_amd64.whl", hash = "sha256:a61900df84c667873b292c3de315a786dd8dac506704dea57bc957bd31e22c7d", size = 107198, upload-time = "2025-10-14T04:40:30.644Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/58/01b4f815bf0312704c267f2ccb6e5d42bcc7752340cd487bc9f8c3710597/charset_normalizer-3.4.4-cp310-cp310-win_arm64.whl", hash = "sha256:cead0978fc57397645f12578bfd2d5ea9138ea0fac82b2f63f7f7c6877986a69", size = 100262, upload-time = "2025-10-14T04:40:32.108Z" },
     { url = "https://files.pythonhosted.org/packages/ed/27/c6491ff4954e58a10f69ad90aca8a1b6fe9c5d3c6f380907af3c37435b59/charset_normalizer-3.4.4-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:6e1fcf0720908f200cd21aa4e6750a48ff6ce4afe7ff5a79a90d5ed8a08296f8", size = 206988, upload-time = "2025-10-14T04:40:33.79Z" },
     { url = "https://files.pythonhosted.org/packages/94/59/2e87300fe67ab820b5428580a53cad894272dbb97f38a7a814a2a1ac1011/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f819d5fe9234f9f82d75bdfa9aef3a3d72c4d24a6e57aeaebba32a704553aa0", size = 147324, upload-time = "2025-10-14T04:40:34.961Z" },
     { url = "https://files.pythonhosted.org/packages/07/fb/0cf61dc84b2b088391830f6274cb57c82e4da8bbc2efeac8c025edb88772/charset_normalizer-3.4.4-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a59cb51917aa591b1c4e6a43c132f0cdc3c76dbad6155df4e28ee626cc77a0a3", size = 142742, upload-time = "2025-10-14T04:40:36.105Z" },
@@ -351,18 +294,6 @@ version = "7.13.1"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/23/f9/e92df5e07f3fc8d4c7f9a0f146ef75446bf870351cd37b788cf5897f8079/coverage-7.13.1.tar.gz", hash = "sha256:b7593fe7eb5feaa3fbb461ac79aac9f9fc0387a5ca8080b0c6fe2ca27b091afd", size = 825862, upload-time = "2025-12-28T15:42:56.969Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2d/9a/3742e58fd04b233df95c012ee9f3dfe04708a5e1d32613bd2d47d4e1be0d/coverage-7.13.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:e1fa280b3ad78eea5be86f94f461c04943d942697e0dac889fa18fff8f5f9147", size = 218633, upload-time = "2025-12-28T15:40:10.165Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/45/7e6bdc94d89cd7c8017ce735cf50478ddfe765d4fbf0c24d71d30ea33d7a/coverage-7.13.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c3d8c679607220979434f494b139dfb00131ebf70bb406553d69c1ff01a5c33d", size = 219147, upload-time = "2025-12-28T15:40:12.069Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/38/0d6a258625fd7f10773fe94097dc16937a5f0e3e0cdf3adef67d3ac6baef/coverage-7.13.1-cp310-cp310-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:339dc63b3eba969067b00f41f15ad161bf2946613156fb131266d8debc8e44d0", size = 245894, upload-time = "2025-12-28T15:40:13.556Z" },
-    { url = "https://files.pythonhosted.org/packages/27/58/409d15ea487986994cbd4d06376e9860e9b157cfbfd402b1236770ab8dd2/coverage-7.13.1-cp310-cp310-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:db622b999ffe49cb891f2fff3b340cdc2f9797d01a0a202a0973ba2562501d90", size = 247721, upload-time = "2025-12-28T15:40:15.37Z" },
-    { url = "https://files.pythonhosted.org/packages/da/bf/6e8056a83fd7a96c93341f1ffe10df636dd89f26d5e7b9ca511ce3bcf0df/coverage-7.13.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d1443ba9acbb593fa7c1c29e011d7c9761545fe35e7652e85ce7f51a16f7e08d", size = 249585, upload-time = "2025-12-28T15:40:17.226Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/15/e1daff723f9f5959acb63cbe35b11203a9df77ee4b95b45fffd38b318390/coverage-7.13.1-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c832ec92c4499ac463186af72f9ed4d8daec15499b16f0a879b0d1c8e5cf4a3b", size = 246597, upload-time = "2025-12-28T15:40:19.028Z" },
-    { url = "https://files.pythonhosted.org/packages/74/a6/1efd31c5433743a6ddbc9d37ac30c196bb07c7eab3d74fbb99b924c93174/coverage-7.13.1-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:562ec27dfa3f311e0db1ba243ec6e5f6ab96b1edfcfc6cf86f28038bc4961ce6", size = 247626, upload-time = "2025-12-28T15:40:20.846Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/9f/1609267dd3e749f57fdd66ca6752567d1c13b58a20a809dc409b263d0b5f/coverage-7.13.1-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:4de84e71173d4dada2897e5a0e1b7877e5eefbfe0d6a44edee6ce31d9b8ec09e", size = 245629, upload-time = "2025-12-28T15:40:22.397Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/f6/6815a220d5ec2466383d7cc36131b9fa6ecbe95c50ec52a631ba733f306a/coverage-7.13.1-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:a5a68357f686f8c4d527a2dc04f52e669c2fc1cbde38f6f7eb6a0e58cbd17cae", size = 245901, upload-time = "2025-12-28T15:40:23.836Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/58/40576554cd12e0872faf6d2c0eb3bc85f71d78427946ddd19ad65201e2c0/coverage-7.13.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:77cc258aeb29a3417062758975521eae60af6f79e930d6993555eeac6a8eac29", size = 246505, upload-time = "2025-12-28T15:40:25.421Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/77/9233a90253fba576b0eee81707b5781d0e21d97478e5377b226c5b096c0f/coverage-7.13.1-cp310-cp310-win32.whl", hash = "sha256:bb4f8c3c9a9f34423dba193f241f617b08ffc63e27f67159f60ae6baf2dcfe0f", size = 221257, upload-time = "2025-12-28T15:40:27.217Z" },
-    { url = "https://files.pythonhosted.org/packages/e0/43/e842ff30c1a0a623ec80db89befb84a3a7aad7bfe44a6ea77d5a3e61fedd/coverage-7.13.1-cp310-cp310-win_amd64.whl", hash = "sha256:c8e2706ceb622bc63bac98ebb10ef5da80ed70fbd8a7999a5076de3afaef0fb1", size = 222191, upload-time = "2025-12-28T15:40:28.916Z" },
     { url = "https://files.pythonhosted.org/packages/b4/9b/77baf488516e9ced25fc215a6f75d803493fc3f6a1a1227ac35697910c2a/coverage-7.13.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a55d509a1dc5a5b708b5dad3b5334e07a16ad4c2185e27b40e4dba796ab7f88", size = 218755, upload-time = "2025-12-28T15:40:30.812Z" },
     { url = "https://files.pythonhosted.org/packages/d7/cd/7ab01154e6eb79ee2fab76bf4d89e94c6648116557307ee4ebbb85e5c1bf/coverage-7.13.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4d010d080c4888371033baab27e47c9df7d6fb28d0b7b7adf85a4a49be9298b3", size = 219257, upload-time = "2025-12-28T15:40:32.333Z" },
     { url = "https://files.pythonhosted.org/packages/01/d5/b11ef7863ffbbdb509da0023fad1e9eda1c0eaea61a6d2ea5b17d4ac706e/coverage-7.13.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d938b4a840fb1523b9dfbbb454f652967f18e197569c32266d4d13f37244c3d9", size = 249657, upload-time = "2025-12-28T15:40:34.1Z" },
@@ -455,7 +386,6 @@ version = "46.0.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/60/04/ee2a9e8542e4fa2773b81771ff8349ff19cdd56b7258a0cc442639052edb/cryptography-46.0.5.tar.gz", hash = "sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d", size = 750064, upload-time = "2026-02-10T19:18:38.255Z" }
 wheels = [
@@ -522,18 +452,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/02/10/5da547df7a391dcde17f59520a231527b8571e6f46fc8efb02ccb370ab12/docutils-0.22.4-py3-none-any.whl", hash = "sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de", size = 633196, upload-time = "2025-12-18T19:00:18.077Z" },
 ]
 
-[[package]]
-name = "exceptiongroup"
-version = "1.3.1"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/8a/0e/97c33bf5009bdbac74fd2beace167cab3f978feb69cc36f1ef79360d6c4e/exceptiongroup-1.3.1-py3-none-any.whl", hash = "sha256:a7a39a3bd276781e98394987d3a5701d0c4edffb633bb7a5144577f82c773598", size = 16740, upload-time = "2025-11-21T23:01:53.443Z" },
-]
-
 [[package]]
 name = "filelock"
 version = "3.20.3"
@@ -612,7 +530,6 @@ dependencies = [
     { name = "packaging" },
     { name = "pathspec" },
     { name = "pluggy" },
-    { name = "tomli", marker = "python_full_version < '3.11'" },
     { name = "trove-classifiers" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/0b/8e/e480359492affde4119a131da729dd26da742c2c9b604dff74836e47eef9/hatchling-1.28.0.tar.gz", hash = "sha256:4d50b02aece6892b8cd0b3ce6c82cb218594d3ec5836dbde75bf41a21ab004c8", size = 55365, upload-time = "2025-11-27T00:31:13.766Z" }
@@ -982,12 +899,10 @@ version = "9.0.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
-    { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
     { name = "iniconfig" },
     { name = "packaging" },
     { name = "pluggy" },
     { name = "pygments" },
-    { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
 wheels = [
@@ -999,7 +914,6 @@ name = "pytest-asyncio"
 version = "1.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "backports-asyncio-runner", marker = "python_full_version < '3.11'" },
     { name = "pytest" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
@@ -1070,15 +984,6 @@ version = "6.0.3"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f4/a0/39350dd17dd6d6c6507025c0e53aef67a9293a6d37d3511f23ea510d5800/pyyaml-6.0.3-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:214ed4befebe12df36bcc8bc2b64b396ca31be9304b8f59e25c11cf94a4c033b", size = 184227, upload-time = "2025-09-25T21:31:46.04Z" },
-    { url = "https://files.pythonhosted.org/packages/05/14/52d505b5c59ce73244f59c7a50ecf47093ce4765f116cdb98286a71eeca2/pyyaml-6.0.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02ea2dfa234451bbb8772601d7b8e426c2bfa197136796224e50e35a78777956", size = 174019, upload-time = "2025-09-25T21:31:47.706Z" },
-    { url = "https://files.pythonhosted.org/packages/43/f7/0e6a5ae5599c838c696adb4e6330a59f463265bfa1e116cfd1fbb0abaaae/pyyaml-6.0.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:b30236e45cf30d2b8e7b3e85881719e98507abed1011bf463a8fa23e9c3e98a8", size = 740646, upload-time = "2025-09-25T21:31:49.21Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/3a/61b9db1d28f00f8fd0ae760459a5c4bf1b941baf714e207b6eb0657d2578/pyyaml-6.0.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:66291b10affd76d76f54fad28e22e51719ef9ba22b29e1d7d03d6777a9174198", size = 840793, upload-time = "2025-09-25T21:31:50.735Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/1e/7acc4f0e74c4b3d9531e24739e0ab832a5edf40e64fbae1a9c01941cabd7/pyyaml-6.0.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9c7708761fccb9397fe64bbc0395abcae8c4bf7b0eac081e12b809bf47700d0b", size = 770293, upload-time = "2025-09-25T21:31:51.828Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/ef/abd085f06853af0cd59fa5f913d61a8eab65d7639ff2a658d18a25d6a89d/pyyaml-6.0.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:418cf3f2111bc80e0933b2cd8cd04f286338bb88bdc7bc8e6dd775ebde60b5e0", size = 732872, upload-time = "2025-09-25T21:31:53.282Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/15/2bc9c8faf6450a8b3c9fc5448ed869c599c0a74ba2669772b1f3a0040180/pyyaml-6.0.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:5e0b74767e5f8c593e8c9b5912019159ed0533c70051e9cce3e8b6aa699fcd69", size = 758828, upload-time = "2025-09-25T21:31:54.807Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/00/531e92e88c00f4333ce359e50c19b8d1de9fe8d581b1534e35ccfbc5f393/pyyaml-6.0.3-cp310-cp310-win32.whl", hash = "sha256:28c8d926f98f432f88adc23edf2e6d4921ac26fb084b028c733d01868d19007e", size = 142415, upload-time = "2025-09-25T21:31:55.885Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/fa/926c003379b19fca39dd4634818b00dec6c62d87faf628d1394e137354d4/pyyaml-6.0.3-cp310-cp310-win_amd64.whl", hash = "sha256:bdb2c67c6c1390b63c6ff89f210c8fd09d9a1217a465701eac7316313c915e4c", size = 158561, upload-time = "2025-09-25T21:31:57.406Z" },
     { url = "https://files.pythonhosted.org/packages/6d/16/a95b6757765b7b031c9374925bb718d55e0a9ba8a1b6a12d25962ea44347/pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e", size = 185826, upload-time = "2025-09-25T21:31:58.655Z" },
     { url = "https://files.pythonhosted.org/packages/16/19/13de8e4377ed53079ee996e1ab0a9c33ec2faf808a4647b7b4c0d46dd239/pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824", size = 175577, upload-time = "2025-09-25T21:32:00.088Z" },
     { url = "https://files.pythonhosted.org/packages/0c/62/d2eb46264d4b157dae1275b573017abec435397aa59cbcdab6fc978a8af4/pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c", size = 775556, upload-time = "2025-09-25T21:32:01.31Z" },
@@ -1494,7 +1399,6 @@ dependencies = [
     { name = "distlib" },
     { name = "filelock" },
     { name = "platformdirs" },
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz", hash = "sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba", size = 6032239, upload-time = "2026-01-09T18:21:01.296Z" }
 wheels = [
@@ -1507,9 +1411,6 @@ version = "6.0.0"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/db/7d/7f3d619e951c88ed75c6037b246ddcf2d322812ee8ea189be89511721d54/watchdog-6.0.0.tar.gz", hash = "sha256:9ddf7c82fda3ae8e24decda1338ede66e1c99883db93711d8fb941eaa2d8c282", size = 131220, upload-time = "2024-11-01T14:07:13.037Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0c/56/90994d789c61df619bfc5ce2ecdabd5eeff564e1eb47512bd01b5e019569/watchdog-6.0.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:d1cdb490583ebd691c012b3d6dae011000fe42edb7a82ece80965b42abd61f26", size = 96390, upload-time = "2024-11-01T14:06:24.793Z" },
-    { url = "https://files.pythonhosted.org/packages/55/46/9a67ee697342ddf3c6daa97e3a587a56d6c4052f881ed926a849fcf7371c/watchdog-6.0.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:bc64ab3bdb6a04d69d4023b29422170b74681784ffb9463ed4870cf2f3e66112", size = 88389, upload-time = "2024-11-01T14:06:27.112Z" },
-    { url = "https://files.pythonhosted.org/packages/44/65/91b0985747c52064d8701e1075eb96f8c40a79df889e59a399453adfb882/watchdog-6.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:c897ac1b55c5a1461e16dae288d22bb2e412ba9807df8397a635d88f671d36c3", size = 89020, upload-time = "2024-11-01T14:06:29.876Z" },
     { url = "https://files.pythonhosted.org/packages/e0/24/d9be5cd6642a6aa68352ded4b4b10fb0d7889cb7f45814fb92cecd35f101/watchdog-6.0.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:6eb11feb5a0d452ee41f824e271ca311a09e250441c262ca2fd7ebcf2461a06c", size = 96393, upload-time = "2024-11-01T14:06:31.756Z" },
     { url = "https://files.pythonhosted.org/packages/63/7a/6013b0d8dbc56adca7fdd4f0beed381c59f6752341b12fa0886fa7afc78b/watchdog-6.0.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:ef810fbf7b781a5a593894e4f439773830bdecb885e6880d957d5b9382a960d2", size = 88392, upload-time = "2024-11-01T14:06:32.99Z" },
     { url = "https://files.pythonhosted.org/packages/d1/40/b75381494851556de56281e053700e46bff5b37bf4c7267e858640af5a7f/watchdog-6.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:afd0fe1b2270917c5e23c2a65ce50c2a4abb63daafb0d419fde368e272a76b7c", size = 89019, upload-time = "2024-11-01T14:06:34.963Z" },
@@ -1519,8 +1420,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/68/98/b0345cabdce2041a01293ba483333582891a3bd5769b08eceb0d406056ef/watchdog-6.0.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:490ab2ef84f11129844c23fb14ecf30ef3d8a6abafd3754a6f75ca1e6654136c", size = 96480, upload-time = "2024-11-01T14:06:42.952Z" },
     { url = "https://files.pythonhosted.org/packages/85/83/cdf13902c626b28eedef7ec4f10745c52aad8a8fe7eb04ed7b1f111ca20e/watchdog-6.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:76aae96b00ae814b181bb25b1b98076d5fc84e8a53cd8885a318b42b6d3a5134", size = 88451, upload-time = "2024-11-01T14:06:45.084Z" },
     { url = "https://files.pythonhosted.org/packages/fe/c4/225c87bae08c8b9ec99030cd48ae9c4eca050a59bf5c2255853e18c87b50/watchdog-6.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a175f755fc2279e0b7312c0035d52e27211a5bc39719dd529625b1930917345b", size = 89057, upload-time = "2024-11-01T14:06:47.324Z" },
-    { url = "https://files.pythonhosted.org/packages/30/ad/d17b5d42e28a8b91f8ed01cb949da092827afb9995d4559fd448d0472763/watchdog-6.0.0-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:c7ac31a19f4545dd92fc25d200694098f42c9a8e391bc00bdd362c5736dbf881", size = 87902, upload-time = "2024-11-01T14:06:53.119Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ca/c3649991d140ff6ab67bfc85ab42b165ead119c9e12211e08089d763ece5/watchdog-6.0.0-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:9513f27a1a582d9808cf21a07dae516f0fab1cf2d7683a742c498b93eedabb11", size = 88380, upload-time = "2024-11-01T14:06:55.19Z" },
     { url = "https://files.pythonhosted.org/packages/a9/c7/ca4bf3e518cb57a686b2feb4f55a1892fd9a3dd13f470fca14e00f80ea36/watchdog-6.0.0-py3-none-manylinux2014_aarch64.whl", hash = "sha256:7607498efa04a3542ae3e05e64da8202e58159aa1fa4acddf7678d34a35d4f13", size = 79079, upload-time = "2024-11-01T14:06:59.472Z" },
     { url = "https://files.pythonhosted.org/packages/5c/51/d46dc9332f9a647593c947b4b88e2381c8dfc0942d15b8edc0310fa4abb1/watchdog-6.0.0-py3-none-manylinux2014_armv7l.whl", hash = "sha256:9041567ee8953024c83343288ccc458fd0a2d811d6a0fd68c4c22609e3490379", size = 79078, upload-time = "2024-11-01T14:07:01.431Z" },
     { url = "https://files.pythonhosted.org/packages/d4/57/04edbf5e169cd318d5f07b4766fee38e825d64b6913ca157ca32d1a42267/watchdog-6.0.0-py3-none-manylinux2014_i686.whl", hash = "sha256:82dc3e3143c7e38ec49d61af98d6558288c415eac98486a5c581726e0737c00e", size = 79076, upload-time = "2024-11-01T14:07:02.568Z" },

From abe5df315ddcb9e356cd841f858606fdee6b67b7 Mon Sep 17 00:00:00 2001
From: Ryan Eberhardt <reberhardt7@gmail.com>
Date: Wed, 25 Mar 2026 08:56:15 -0700
Subject: [PATCH 38/80] Fix GitHub Actions workflow security issues (zizmor)
 (#173)

- Fix template injection vulnerabilities by using environment variables
  instead of inline expressions in shell scripts (docker-stable, release)
- Pin third-party actions to full SHA commits (docker-stable)
- Add top-level permissions blocks with least-privilege scoping
  (docker-stable, e2e-test, version-check)
- Add persist-credentials: false to all checkout steps
- Add zizmor.yml configuration file
- Fix missing newlines at end of files

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/docker-stable.yml | 25 ++++++++++++++++---------
 .github/workflows/e2e-test.yml      |  6 ++++++
 .github/workflows/pr-preview.yml    |  1 +
 .github/workflows/release.yml       | 11 +++++++----
 .github/workflows/version-check.yml |  6 ++++++
 .github/zizmor.yml                  |  3 +++
 6 files changed, 39 insertions(+), 13 deletions(-)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/docker-stable.yml b/.github/workflows/docker-stable.yml
index 2a4c92d..3639ffc 100644
--- a/.github/workflows/docker-stable.yml
+++ b/.github/workflows/docker-stable.yml
@@ -6,39 +6,46 @@ on:
         description: 'Version to mark as stable (e.g., 1.2.3)'
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   stable:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Check if version exists in PyPI
         id: version_check
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
         run: |
-          if ! curl -s -f https://pypi.org/pypi/socketsecurity/${{ inputs.version }}/json > /dev/null; then
-            echo "Error: Version ${{ inputs.version }} not found on PyPI"
+          if ! curl -s -f "https://pypi.org/pypi/socketsecurity/${INPUT_VERSION}/json" > /dev/null; then
+            echo "Error: Version ${INPUT_VERSION} not found on PyPI"
             exit 1
           fi
-          echo "Version ${{ inputs.version }} found on PyPI - proceeding with release"
+          echo "Version ${INPUT_VERSION} found on PyPI - proceeding with release"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Docker Hub with Organization Token
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build & Push Stable Docker
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           push: true
           platforms: linux/amd64,linux/arm64
           tags: socketdev/cli:stable
           build-args: |
             CLI_VERSION=${{ inputs.version }}
-            
\ No newline at end of file
+            
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index c5426fb..03584f6 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   e2e-scan:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
@@ -14,6 +17,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
@@ -56,6 +60,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
@@ -96,6 +101,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index c14f190..1d7115a 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -15,6 +15,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
           python-version: '3.13'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 99372b6..5549b88 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
         with:
           python-version: '3.13'
@@ -26,11 +27,13 @@ jobs:
           
       - name: Get Version
         id: version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
           RAW_VERSION=$(hatch version)
           echo "VERSION=$RAW_VERSION" >> $GITHUB_ENV
-          if [ "v$RAW_VERSION" != "${{ github.ref_name }}" ]; then
-            echo "Error: Git tag (${{ github.ref_name }}) does not match hatch version (v$RAW_VERSION)"
+          if [ "v$RAW_VERSION" != "$REF_NAME" ]; then
+            echo "Error: Git tag ($REF_NAME) does not match hatch version (v$RAW_VERSION)"
             exit 1
           fi
 
@@ -52,7 +55,7 @@ jobs:
         env:
           VERSION: ${{ env.VERSION }}
         run: |
-          if curl -s -f "https://hub.docker.com/v2/repositories/socketdev/cli/tags/${{ env.VERSION }}" > /dev/null; then
+          if curl -s -f "https://hub.docker.com/v2/repositories/socketdev/cli/tags/${VERSION}" > /dev/null; then
             echo "Docker image socketdev/cli:${VERSION} already exists"
             echo "docker_exists=true" >> $GITHUB_OUTPUT
           else
@@ -113,4 +116,4 @@ jobs:
             socketdev/cli:latest
             socketdev/cli:${{ env.VERSION }}
           build-args: |
-            CLI_VERSION=${{ env.VERSION }}
\ No newline at end of file
+            CLI_VERSION=${{ env.VERSION }}
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 3276e73..5b9bda8 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -7,6 +7,11 @@ on:
       - 'setup.py'
       - 'pyproject.toml'
 
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
 jobs:
   check_version:
     runs-on: ubuntu-latest
@@ -14,6 +19,7 @@ jobs:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
           fetch-depth: 0  # Fetch all history for all branches
+          persist-credentials: false
 
       - name: Check version increment
         id: version_check
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..39d1b18
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,3 @@
+rules:
+  secrets-outside-env:
+    disable: true

From 064fb7dbb000b2ff05ab7a502e25a38f573d29aa Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Tue, 7 Apr 2026 18:09:20 +0200
Subject: [PATCH 39/80] Fix broken links on PyPI by using absolute GitHub URLs
 (#174)

PyPI renders the README but has no access to the repository file tree,
so all relative links (docs/, examples/config/, workflows/) resolved
against pypi.org and returned 404s. Replace with absolute URLs pointing
to the main branch on GitHub.
---
 README.md                  | 38 +++++++++++++++++++-------------------
 pyproject.toml             |  2 +-
 socketsecurity/__init__.py |  2 +-
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index ef84057..7929189 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 Socket Python CLI for Socket scans, diff reporting, reachability analysis, and SARIF/GitLab exports.
 
-Comprehensive docs are available in [`docs/`](docs/) for full flag reference, CI/CD-specific guidance, and contributor setup.
+Comprehensive docs are available in [`docs/`](https://github.com/SocketDev/socket-python-cli/tree/main/docs) for full flag reference, CI/CD-specific guidance, and contributor setup.
 
 ## Quick start
 
@@ -27,8 +27,8 @@ socketcli --target-path .
 ## Common use cases
 
 This section covers the paved path/common workflows.
-For advanced options and exhaustive details, see [`docs/cli-reference.md`](docs/cli-reference.md).
-For CI/CD-specific guidance, see [`docs/ci-cd.md`](docs/ci-cd.md).
+For advanced options and exhaustive details, see [`docs/cli-reference.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/cli-reference.md).
+For CI/CD-specific guidance, see [`docs/ci-cd.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/ci-cd.md).
 
 ### Basic policy scan (no SARIF)
 
@@ -91,7 +91,7 @@ socketcli \
 Dashboard parity note:
 - Full-scope SARIF is the closest match for dashboard-style filtering.
 - Exact result counts can still differ from the dashboard due to backend/API consolidation differences and grouping semantics.
-- See [`docs/troubleshooting.md#dashboard-vs-cli-result-counts`](docs/troubleshooting.md#dashboard-vs-cli-result-counts).
+- See [`docs/troubleshooting.md#dashboard-vs-cli-result-counts`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/troubleshooting.md#dashboard-vs-cli-result-counts).
 
 ## Config files (`--config`)
 
@@ -137,23 +137,23 @@ socketcli --config .socketcli.toml --target-path .
 Reference sample configs:
 
 TOML:
-- [`examples/config/sarif-dashboard-parity.toml`](examples/config/sarif-dashboard-parity.toml)
-- [`examples/config/sarif-instance-detail.toml`](examples/config/sarif-instance-detail.toml)
-- [`examples/config/sarif-diff-ci-cd.toml`](examples/config/sarif-diff-ci-cd.toml)
+- [`examples/config/sarif-dashboard-parity.toml`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-dashboard-parity.toml)
+- [`examples/config/sarif-instance-detail.toml`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-instance-detail.toml)
+- [`examples/config/sarif-diff-ci-cd.toml`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-diff-ci-cd.toml)
 
 JSON:
-- [`examples/config/sarif-dashboard-parity.json`](examples/config/sarif-dashboard-parity.json)
-- [`examples/config/sarif-instance-detail.json`](examples/config/sarif-instance-detail.json)
-- [`examples/config/sarif-diff-ci-cd.json`](examples/config/sarif-diff-ci-cd.json)
+- [`examples/config/sarif-dashboard-parity.json`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-dashboard-parity.json)
+- [`examples/config/sarif-instance-detail.json`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-instance-detail.json)
+- [`examples/config/sarif-diff-ci-cd.json`](https://github.com/SocketDev/socket-python-cli/blob/main/examples/config/sarif-diff-ci-cd.json)
 
 ## CI/CD examples
 
 Prebuilt workflow examples:
 
-- [GitHub Actions](workflows/github-actions.yml)
-- [Buildkite](workflows/buildkite.yml)
-- [GitLab CI](workflows/gitlab-ci.yml)
-- [Bitbucket Pipelines](workflows/bitbucket-pipelines.yml)
+- [GitHub Actions](https://github.com/SocketDev/socket-python-cli/blob/main/workflows/github-actions.yml)
+- [Buildkite](https://github.com/SocketDev/socket-python-cli/blob/main/workflows/buildkite.yml)
+- [GitLab CI](https://github.com/SocketDev/socket-python-cli/blob/main/workflows/gitlab-ci.yml)
+- [Bitbucket Pipelines](https://github.com/SocketDev/socket-python-cli/blob/main/workflows/bitbucket-pipelines.yml)
 
 Minimal pattern:
 
@@ -166,7 +166,7 @@ Minimal pattern:
 
 ## Common gotchas
 
-See [`docs/troubleshooting.md`](docs/troubleshooting.md#common-gotchas).
+See [`docs/troubleshooting.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/troubleshooting.md#common-gotchas).
 
 ## Quick verification checks
 
@@ -187,7 +187,7 @@ jq '.runs[0].results | length' sarif-diff-reachable.sarif
 
 ## Documentation reference
 
-- Full CLI reference: [`docs/cli-reference.md`](docs/cli-reference.md)
-- CI/CD guide: [`docs/ci-cd.md`](docs/ci-cd.md)
-- Troubleshooting guide: [`docs/troubleshooting.md`](docs/troubleshooting.md)
-- Development guide: [`docs/development.md`](docs/development.md)
+- Full CLI reference: [`docs/cli-reference.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/cli-reference.md)
+- CI/CD guide: [`docs/ci-cd.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/ci-cd.md)
+- Troubleshooting guide: [`docs/troubleshooting.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/troubleshooting.md)
+- Development guide: [`docs/development.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/development.md)
diff --git a/pyproject.toml b/pyproject.toml
index 7b7cd2a..6b37502 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.79"
+version = "2.2.80"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index e56db94..92eb029 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.79'
+__version__ = '2.2.80'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

From 04e41d8fe3557808461911407ae7d5288388f723 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Mon, 13 Apr 2026 17:47:42 -0400
Subject: [PATCH 40/80] Fix GitLab security report schema compliance + scan
 alert population (#182)

* Bump incremental version

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Fix gitlab security report schema validation errors

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Populate gitlab security report with alerts for full scans

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Skip license-metadata API call when fetching full scan alerts

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Consolidate e2e test workflows, add additional coverage

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Strip logger timestamp prefix to fix e2e test

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Include unchanged alerts in GitLab report

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Fix commit status to count new + unchanged alerts when strict blocking enabled

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Add comparison table of alert behaviors between GitLab + JSON/SARIF

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Document comment-based ignore behavior differences

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Add new unit tests for unchanged alerts

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: bump npm test fixture versions

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 .github/workflows/e2e-test.yml                | 216 +++++-------------
 docs/cli-reference.md                         |  35 ++-
 pyproject.toml                                |   2 +-
 socketsecurity/__init__.py                    |   2 +-
 socketsecurity/core/__init__.py               |  67 +++++-
 socketsecurity/core/messages.py               |  48 +++-
 socketsecurity/socketcli.py                   |  13 +-
 tests/e2e/fixtures/simple-npm/package.json    |   4 +-
 .../e2e/fixtures/simple-pypi/requirements.txt |   3 +
 tests/e2e/validate-gitlab.sh                  |  63 +++++
 tests/e2e/validate-json.sh                    |  33 +++
 tests/e2e/validate-reachability.sh            |  65 ++++++
 tests/e2e/validate-sarif.sh                   |  19 ++
 tests/e2e/validate-scan.sh                    |  16 ++
 tests/unit/test_gitlab_format.py              | 177 +++++++++++++-
 uv.lock                                       |   2 +-
 16 files changed, 585 insertions(+), 180 deletions(-)
 create mode 100644 tests/e2e/fixtures/simple-pypi/requirements.txt
 create mode 100755 tests/e2e/validate-gitlab.sh
 create mode 100755 tests/e2e/validate-json.sh
 create mode 100755 tests/e2e/validate-reachability.sh
 create mode 100755 tests/e2e/validate-sarif.sh
 create mode 100755 tests/e2e/validate-scan.sh

diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 03584f6..95e93c9 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -1,4 +1,4 @@
-name: E2E Test
+name: E2E Tests
 
 on:
   push:
@@ -10,93 +10,58 @@ permissions:
   contents: read
 
 jobs:
-  e2e-scan:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
-        with:
-          python-version: '3.12'
-
-      - name: Install CLI from local repo
-        run: |
-          python -m pip install --upgrade pip
-          pip install .
-
-      - name: Run Socket CLI scan
-        env:
-          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
-        run: |
-          set -o pipefail
-          socketcli \
-            --target-path tests/e2e/fixtures/simple-npm \
-            --disable-blocking \
-            --enable-debug \
-            2>&1 | tee /tmp/scan-output.log
-
-      - name: Verify scan produced a report
-        run: |
-          if grep -q "Full scan report URL: https://socket.dev/" /tmp/scan-output.log; then
-            echo "PASS: Full scan report URL found"
-            grep "Full scan report URL:" /tmp/scan-output.log
-          elif grep -q "Diff Url: https://socket.dev/" /tmp/scan-output.log; then
-            echo "PASS: Diff URL found"
-            grep "Diff Url:" /tmp/scan-output.log
-          else
-            echo "FAIL: No report URL found in scan output"
-            cat /tmp/scan-output.log
-            exit 1
-          fi
-
-  e2e-sarif:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
-        with:
-          python-version: '3.12'
-
-      - name: Install CLI from local repo
-        run: |
-          python -m pip install --upgrade pip
-          pip install .
-
-      - name: Run Socket CLI scan with --sarif-file
-        env:
-          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
-        run: |
-          set -o pipefail
-          socketcli \
-            --target-path tests/e2e/fixtures/simple-npm \
-            --sarif-file /tmp/results.sarif \
-            --disable-blocking \
-            2>&1 | tee /tmp/sarif-output.log
-
-      - name: Verify SARIF file is valid
-        run: |
-          python3 -c "
-          import json, sys
-          with open('/tmp/results.sarif') as f:
-              data = json.load(f)
-          assert data['version'] == '2.1.0', f'Invalid version: {data[\"version\"]}'
-          assert '\$schema' in data, 'Missing \$schema'
-          count = len(data['runs'][0]['results'])
-          print(f'PASS: Valid SARIF 2.1.0 with {count} result(s)')
-          "
-
-  e2e-reachability:
+  e2e:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: scan
+            args: >-
+              --target-path tests/e2e/fixtures/simple-npm
+              --disable-blocking
+              --enable-debug
+            validate: tests/e2e/validate-scan.sh
+
+          - name: sarif
+            args: >-
+              --target-path tests/e2e/fixtures/simple-npm
+              --sarif-file /tmp/results.sarif
+              --disable-blocking
+            validate: tests/e2e/validate-sarif.sh
+
+          - name: reachability
+            args: >-
+              --target-path tests/e2e/fixtures/simple-npm
+              --reach
+              --disable-blocking
+              --enable-debug
+            validate: tests/e2e/validate-reachability.sh
+            setup-node: "true"
+
+          - name: gitlab
+            args: >-
+              --target-path tests/e2e/fixtures/simple-npm
+              --enable-gitlab-security
+              --disable-blocking
+            validate: tests/e2e/validate-gitlab.sh
+
+          - name: json
+            args: >-
+              --target-path tests/e2e/fixtures/simple-npm
+              --enable-json
+              --disable-blocking
+            validate: tests/e2e/validate-json.sh
+
+          - name: pypi
+            args: >-
+              --target-path tests/e2e/fixtures/simple-pypi
+              --disable-blocking
+              --enable-debug
+            validate: tests/e2e/validate-scan.sh
+
+    name: e2e-${{ matrix.name }}
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
         with:
@@ -108,6 +73,7 @@ jobs:
           python-version: '3.12'
 
       - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        if: matrix.setup-node == 'true'
         with:
           node-version: '20'
 
@@ -117,85 +83,17 @@ jobs:
           pip install .
 
       - name: Install uv
+        if: matrix.setup-node == 'true'
         run: pip install uv
 
-      - name: Run Socket CLI with reachability
+      - name: Run Socket CLI
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
         run: |
           set -o pipefail
-          socketcli \
-            --target-path tests/e2e/fixtures/simple-npm \
-            --reach \
-            --disable-blocking \
-            --enable-debug \
-            2>&1 | tee /tmp/reach-output.log
-
-      - name: Verify reachability analysis completed
-        run: |
-          if grep -q "Reachability analysis completed successfully" /tmp/reach-output.log; then
-            echo "PASS: Reachability analysis completed"
-            grep "Reachability analysis completed successfully" /tmp/reach-output.log
-            grep "Results written to:" /tmp/reach-output.log || true
-          else
-            echo "FAIL: Reachability analysis did not complete successfully"
-            cat /tmp/reach-output.log
-            exit 1
-          fi
-
-      - name: Verify scan produced a report
-        run: |
-          if grep -q "Full scan report URL: https://socket.dev/" /tmp/reach-output.log; then
-            echo "PASS: Full scan report URL found"
-            grep "Full scan report URL:" /tmp/reach-output.log
-          elif grep -q "Diff Url: https://socket.dev/" /tmp/reach-output.log; then
-            echo "PASS: Diff URL found"
-            grep "Diff Url:" /tmp/reach-output.log
-          else
-            echo "FAIL: No report URL found in scan output"
-            cat /tmp/reach-output.log
-            exit 1
-          fi
+          socketcli ${{ matrix.args }} 2>&1 | tee /tmp/e2e-output.log
 
-      - name: Run scan with --sarif-file (all results)
+      - name: Validate results
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
-        run: |
-          socketcli \
-            --target-path tests/e2e/fixtures/simple-npm \
-            --reach \
-            --sarif-file /tmp/sarif-all.sarif \
-            --sarif-scope full \
-            --sarif-reachability all \
-            --disable-blocking \
-            2>/dev/null
-
-      - name: Run scan with --sarif-file --sarif-reachability reachable (filtered results)
-        env:
-          SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
-        run: |
-          socketcli \
-            --target-path tests/e2e/fixtures/simple-npm \
-            --reach \
-            --sarif-file /tmp/sarif-reachable.sarif \
-            --sarif-scope full \
-            --sarif-reachability reachable \
-            --disable-blocking \
-            2>/dev/null
-
-      - name: Verify reachable-only results are a subset of all results
-        run: |
-          test -f /tmp/sarif-all.sarif
-          test -f /tmp/sarif-reachable.sarif
-          python3 -c "
-          import json
-          with open('/tmp/sarif-all.sarif') as f:
-              all_data = json.load(f)
-          with open('/tmp/sarif-reachable.sarif') as f:
-              reach_data = json.load(f)
-          all_count = len(all_data['runs'][0]['results'])
-          reach_count = len(reach_data['runs'][0]['results'])
-          print(f'All results: {all_count}, Reachable-only results: {reach_count}')
-          assert reach_count <= all_count, f'FAIL: reachable ({reach_count}) > all ({all_count})'
-          print('PASS: Reachable-only results is a subset of all results')
-          "
+        run: bash ${{ matrix.validate }}
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 0c807f7..0fdee6c 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -700,17 +700,44 @@ The GitLab report includes **actionable security alerts** based on your Socket p
 
 All alert types are included in the GitLab report if they're marked as `error` or `warn` by your Socket Security policy, ensuring the Security Dashboard shows only actionable findings.
 
+### Alert Population: GitLab vs JSON/SARIF
+
+The GitLab Security Dashboard report and the JSON/SARIF diff outputs use different alert selection strategies, reflecting their distinct purposes:
+
+| Output Format | Default Alerts | With `--strict-blocking` |
+|:---|:---|:---|
+| `--enable-gitlab-security` | **All** alerts (new + existing) | All alerts (same) |
+| `--enable-json` | New alerts only | New + existing alerts |
+| `--enable-sarif` (diff scope) | New alerts only | New + existing alerts |
+
+**Why the difference?** GitLab's Security Dashboard is designed to present the full security posture of a project. An empty dashboard on a scan with no dependency changes would be misleading -- the vulnerabilities still exist, they just didn't change. By contrast, JSON and SARIF in diff scope are designed to answer "what changed?" and only include existing alerts when `--strict-blocking` explicitly requests it.
+
+> **Tip:** If you use `--enable-json` alongside `--enable-gitlab-security`, the GitLab report may contain more vulnerabilities than the JSON output. This is expected. To make JSON output match, add `--strict-blocking`.
+
+### Alert Ignoring via PR/MR Comments
+
+When using the CLI with SCM integration (`--scm github` or `--scm gitlab`), users can ignore specific alerts by reacting to Socket's PR/MR comments. Ignored alerts are removed from `--enable-json`, `--enable-sarif`, and console output.
+
+However, the GitLab Security Dashboard report includes **all** alerts matching your security policy (new and existing), regardless of comment-based ignores. This ensures the Security Dashboard always reflects the full set of known issues. To suppress a vulnerability from the GitLab report, adjust the alert's policy in Socket's dashboard rather than ignoring it via a PR comment.
+
 ### Report Schema
 
-Socket CLI generates reports compliant with [GitLab Dependency Scanning schema version 15.0.0](https://docs.gitlab.com/ee/development/integrations/secure.html). The reports include:
+Socket CLI generates reports compliant with [GitLab Dependency Scanning schema version 15.0.0](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/v15.0.0/dist/dependency-scanning-report-format.json). The reports include:
 
-- **Scan metadata**: Analyzer and scanner information
+- **Scan metadata**: Analyzer and scanner information with ISO 8601 timestamps
 - **Vulnerabilities**: Detailed vulnerability data with:
   - Unique deterministic UUIDs for tracking
   - Package location and dependency information
   - Severity levels mapped from Socket's analysis
   - Socket-specific alert types and CVE identifiers
   - Links to Socket.dev for detailed analysis
+- **Dependency files**: Manifest files and their dependencies discovered during the scan
+
+**Schema compatibility:** The v15.0.0 schema is supported across all GitLab versions 12.0+ (both self-hosted and cloud). The report includes the `dependency_files` field, which is required by v15.0.0 and accepted as an optional extra by newer schema versions, ensuring maximum compatibility across GitLab instances.
+
+### Performance Notes
+
+When `--enable-gitlab-security` (or `--enable-json` / `--enable-sarif`) is used with a full scan (non-diff mode), the CLI fetches package and alert data from the scan results to populate the report. This adds time proportional to the number of packages in the scan. Without these output flags, no additional data is fetched and scan performance is unchanged.
 
 ### Requirements
 
@@ -726,7 +753,9 @@ Socket CLI generates reports compliant with [GitLab Dependency Scanning schema v
 - Ensure the report file follows the correct schema format
 
 **Empty vulnerabilities array:**
-- This is normal if no new security issues were detected
+- The GitLab report includes both new and existing alerts, so repeated scans of the same repo should still populate the report as long as Socket detects actionable issues
+- If the report is empty, verify the Socket dashboard shows alerts for the scanned packages -- an empty report means no error/warn-level alerts exist
+- For full scans (non-diff mode), ensure you are using `--enable-gitlab-security` so alert data is fetched
 - Check Socket.dev dashboard for full analysis details
 
 ## Development
diff --git a/pyproject.toml b/pyproject.toml
index 6b37502..c912d72 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.80"
+version = "2.2.81"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 92eb029..d4a1870 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.80'
+__version__ = '2.2.81'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index edd2814..daaa9a8 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -659,9 +659,48 @@ def create_full_scan_with_report_url(
         diff.report_url = f"{base_socket}/{self.config.org_slug}/sbom/{new_full_scan.id}"
         diff.diff_url = diff.report_url
         diff.id = new_full_scan.id
-        diff.packages = {}
 
-        # Return result in the format expected by the user
+        needs_alerts = (
+            self.cli_config is not None
+            and (
+                self.cli_config.enable_gitlab_security
+                or self.cli_config.enable_json
+                or self.cli_config.enable_sarif
+            )
+        )
+
+        if needs_alerts:
+            log.info("Output format requires alerts, fetching SBOM data for full scan")
+            sbom_start = time.time()
+            sbom_artifacts_dict = self.get_sbom_data(new_full_scan.id)
+            sbom_artifacts = self.get_sbom_data_list(sbom_artifacts_dict)
+            packages = self._create_packages_dict_without_license_text(sbom_artifacts)
+            diff.packages = packages
+
+            all_alerts_collection: Dict[str, List[Issue]] = {}
+            for package_id, package in packages.items():
+                self.add_package_alerts_to_collection(
+                    package=package,
+                    alerts_collection=all_alerts_collection,
+                    packages=packages
+                )
+
+            consolidated: Set[str] = set()
+            for alert_key, alerts in all_alerts_collection.items():
+                for alert in alerts:
+                    alert_str = f"{alert.purl},{alert.type}"
+                    if (alert.error or alert.warn) and alert_str not in consolidated:
+                        diff.new_alerts.append(alert)
+                        consolidated.add(alert_str)
+
+            sbom_end = time.time()
+            log.info(
+                f"Fetched {len(packages)} packages and {len(diff.new_alerts)} alerts "
+                f"in {sbom_end - sbom_start:.2f}s"
+            )
+        else:
+            diff.packages = {}
+
         return diff
 
     def get_full_scan(self, full_scan_id: str) -> FullScan:
@@ -712,6 +751,30 @@ def create_packages_dict(self, sbom_artifacts: list[SocketArtifact]) -> dict[str
 
         return packages
 
+    @staticmethod
+    def _create_packages_dict_without_license_text(
+        sbom_artifacts: list[SocketArtifact],
+    ) -> dict[str, Package]:
+        """Like create_packages_dict but skips the license-metadata API call.
+
+        Used when we only need packages for alert extraction (e.g. populating
+        GitLab/JSON/SARIF reports from a full scan) and don't need license text.
+        """
+        packages: dict[str, Package] = {}
+        top_level_count: dict[str, int] = {}
+        for artifact in sbom_artifacts:
+            package = Package.from_socket_artifact(asdict(artifact))
+            if package.id not in packages:
+                packages[package.id] = package
+                if package.topLevelAncestors:
+                    for top_id in package.topLevelAncestors:
+                        top_level_count[top_id] = top_level_count.get(top_id, 0) + 1
+
+        for package_id, package in packages.items():
+            package.transitives = top_level_count.get(package_id, 0)
+
+        return packages
+
     def get_package_license_text(self, package: Package) -> str:
         """
         Gets the license text for a package if available.
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index db62a6b..0f3b62e 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -3,7 +3,7 @@
 import os
 import re
 import uuid
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 from mdutils import MdUtils
 from prettytable import PrettyTable
@@ -593,6 +593,20 @@ def create_security_comment_json(diff: Diff) -> dict:
             output["new_alerts"].append(json.loads(str(alert)))
         return output
 
+    @staticmethod
+    def _pkg_type_to_package_manager(pkg_type: str) -> str:
+        """Map Socket pkg_type to GitLab package_manager name for dependency_files."""
+        mapping = {
+            "npm": "npm",
+            "pypi": "pip",
+            "go": "go",
+            "maven": "maven",
+            "gem": "bundler",
+            "nuget": "nuget",
+            "cargo": "cargo",
+        }
+        return mapping.get(pkg_type, pkg_type or "unknown")
+
     @staticmethod
     def map_socket_severity_to_gitlab(severity: str) -> str:
         """
@@ -743,15 +757,18 @@ def create_security_comment_gitlab(diff: Diff) -> dict:
                     }
                 },
                 "type": "dependency_scanning",
-                "start_time": datetime.utcnow().isoformat() + "Z",
-                "end_time": datetime.utcnow().isoformat() + "Z",
+                "start_time": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S"),
+                "end_time": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S"),
                 "status": "success"
             },
-            "vulnerabilities": []
+            "vulnerabilities": [],
+            "dependency_files": []
         }
 
-        # Process each alert
-        for alert in diff.new_alerts:
+        dep_files_map: dict = {}
+
+        all_alerts = list(diff.new_alerts) + list(getattr(diff, 'unchanged_alerts', []))
+        for alert in all_alerts:
             vulnerability = {
                 "id": Messages.generate_uuid_from_alert_gitlab(alert),
                 "category": "dependency_scanning",
@@ -764,12 +781,29 @@ def create_security_comment_gitlab(diff: Diff) -> dict:
                 "location": Messages.extract_location_gitlab(alert)
             }
 
-            # Add solution if available
             if hasattr(alert, 'suggestion') and alert.suggestion:
                 vulnerability["solution"] = alert.suggestion
 
             gitlab_report["vulnerabilities"].append(vulnerability)
 
+            file_path = vulnerability["location"]["file"]
+            if file_path != "unknown":
+                pkg_manager = Messages._pkg_type_to_package_manager(
+                    alert.pkg_type if hasattr(alert, 'pkg_type') else ""
+                )
+                if file_path not in dep_files_map:
+                    dep_files_map[file_path] = {
+                        "path": file_path,
+                        "package_manager": pkg_manager,
+                        "dependencies": []
+                    }
+                dep_files_map[file_path]["dependencies"].append({
+                    "package": {"name": alert.pkg_name},
+                    "version": alert.pkg_version
+                })
+
+        gitlab_report["dependency_files"] = list(dep_files_map.values())
+
         return gitlab_report
 
     @staticmethod
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 6f17f58..a8de637 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -649,11 +649,20 @@ def main_code():
             scm.enable_merge_pipeline_check()
             passed = output_handler.report_pass(diff)
             state = "success" if passed else "failed"
-            blocking_count = sum(1 for a in diff.new_alerts if a.error)
+            new_blocking = sum(1 for a in diff.new_alerts if a.error)
+            unchanged_blocking = 0
+            if config.strict_blocking and hasattr(diff, 'unchanged_alerts'):
+                unchanged_blocking = sum(1 for a in diff.unchanged_alerts if a.error)
+            blocking_count = new_blocking + unchanged_blocking
             if passed:
                 description = "No blocking issues"
             else:
-                description = f"{blocking_count} blocking alert(s) found"
+                parts = []
+                if new_blocking:
+                    parts.append(f"{new_blocking} new")
+                if unchanged_blocking:
+                    parts.append(f"{unchanged_blocking} existing")
+                description = f"{blocking_count} blocking alert(s) found ({', '.join(parts)})"
             target_url = diff.report_url or diff.diff_url or ""
             scm.set_commit_status(state, description, target_url)
 
diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
index cf70416..8a7e8ec 100644
--- a/tests/e2e/fixtures/simple-npm/package.json
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -4,9 +4,9 @@
   "description": "Test fixture for reachability analysis",
   "main": "index.js",
   "dependencies": {
-    "lodash": "4.17.23",
+    "lodash": "4.18.1",
     "express": "4.22.0",
-    "axios": "1.13.5"
+    "axios": "1.15.0"
   },
   "devDependencies": {
     "typescript": "5.0.4",
diff --git a/tests/e2e/fixtures/simple-pypi/requirements.txt b/tests/e2e/fixtures/simple-pypi/requirements.txt
new file mode 100644
index 0000000..acce997
--- /dev/null
+++ b/tests/e2e/fixtures/simple-pypi/requirements.txt
@@ -0,0 +1,3 @@
+requests==2.31.0
+flask==3.0.0
+pyyaml==6.0.1
diff --git a/tests/e2e/validate-gitlab.sh b/tests/e2e/validate-gitlab.sh
new file mode 100755
index 0000000..259d07f
--- /dev/null
+++ b/tests/e2e/validate-gitlab.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPORT="gl-dependency-scanning-report.json"
+
+if [ ! -f "$REPORT" ]; then
+  echo "FAIL: GitLab report not found at $REPORT"
+  exit 1
+fi
+
+python3 -c "
+import json, re, sys
+
+with open('$REPORT') as f:
+    data = json.load(f)
+
+errors = []
+
+# v15.0.0 required root-level keys
+for key in ('version', 'scan', 'vulnerabilities', 'dependency_files'):
+    if key not in data:
+        errors.append(f'Missing required root key: {key}')
+
+if 'scan' in data:
+    scan = data['scan']
+
+    # Timestamp format: YYYY-MM-DDTHH:MM:SS (no microseconds, no trailing Z)
+    ts_pattern = re.compile(r'^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$')
+    for field in ('start_time', 'end_time'):
+        val = scan.get(field, '')
+        if not ts_pattern.match(val):
+            errors.append(f'scan.{field} \"{val}\" does not match pattern YYYY-MM-DDTHH:MM:SS')
+
+    if scan.get('type') != 'dependency_scanning':
+        errors.append(f'scan.type is \"{scan.get(\"type\")}\" expected \"dependency_scanning\"')
+
+    analyzer_id = scan.get('analyzer', {}).get('id', '')
+    if analyzer_id != 'socket-security':
+        errors.append(f'scan.analyzer.id is \"{analyzer_id}\" expected \"socket-security\"')
+
+    scanner_id = scan.get('scanner', {}).get('id', '')
+    if scanner_id != 'socket-cli':
+        errors.append(f'scan.scanner.id is \"{scanner_id}\" expected \"socket-cli\"')
+
+    if scan.get('status') != 'success':
+        errors.append(f'scan.status is \"{scan.get(\"status\")}\" expected \"success\"')
+
+# dependency_files structure check
+if 'dependency_files' in data:
+    for i, df in enumerate(data['dependency_files']):
+        for req in ('path', 'package_manager', 'dependencies'):
+            if req not in df:
+                errors.append(f'dependency_files[{i}] missing required key: {req}')
+
+if errors:
+    for e in errors:
+        print(f'FAIL: {e}')
+    sys.exit(1)
+
+vuln_count = len(data.get('vulnerabilities', []))
+dep_file_count = len(data.get('dependency_files', []))
+print(f'PASS: Valid GitLab v15.0.0 report with {vuln_count} vulnerability(ies) and {dep_file_count} dependency file(s)')
+"
diff --git a/tests/e2e/validate-json.sh b/tests/e2e/validate-json.sh
new file mode 100755
index 0000000..d4f5302
--- /dev/null
+++ b/tests/e2e/validate-json.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LOG="/tmp/e2e-output.log"
+
+python3 -c "
+import json, sys
+
+# The JSON output may be prefixed with a logger timestamp (e.g. '2026-04-08 22:46:50,580: {...}').
+# Try parsing the full line first, then from the first '{' character.
+found = False
+with open('$LOG') as f:
+    for line in f:
+        line = line.strip()
+        if not line or '{' not in line:
+            continue
+        # Try full line first, then from the first brace
+        for candidate in (line, line[line.index('{'):]):
+            try:
+                data = json.loads(candidate)
+                if isinstance(data, dict):
+                    found = True
+                    print(f'PASS: Valid JSON output with {len(data)} top-level key(s)')
+                    break
+            except json.JSONDecodeError:
+                continue
+        if found:
+            break
+
+if not found:
+    print('FAIL: No valid JSON object found in output')
+    sys.exit(1)
+"
diff --git a/tests/e2e/validate-reachability.sh b/tests/e2e/validate-reachability.sh
new file mode 100755
index 0000000..e6e365e
--- /dev/null
+++ b/tests/e2e/validate-reachability.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LOG="/tmp/e2e-output.log"
+
+# 1. Verify reachability analysis completed
+if grep -q "Reachability analysis completed successfully" "$LOG"; then
+  echo "PASS: Reachability analysis completed"
+  grep "Reachability analysis completed successfully" "$LOG"
+  grep "Results written to:" "$LOG" || true
+else
+  echo "FAIL: Reachability analysis did not complete successfully"
+  cat "$LOG"
+  exit 1
+fi
+
+# 2. Verify scan produced a report URL
+if grep -q "Full scan report URL: https://socket.dev/" "$LOG"; then
+  echo "PASS: Full scan report URL found"
+  grep "Full scan report URL:" "$LOG"
+elif grep -q "Diff Url: https://socket.dev/" "$LOG"; then
+  echo "PASS: Diff URL found"
+  grep "Diff Url:" "$LOG"
+else
+  echo "FAIL: No report URL found in scan output"
+  cat "$LOG"
+  exit 1
+fi
+
+# 3. Run SARIF with --sarif-reachability all
+socketcli \
+  --target-path tests/e2e/fixtures/simple-npm \
+  --reach \
+  --sarif-file /tmp/sarif-all.sarif \
+  --sarif-scope full \
+  --sarif-reachability all \
+  --disable-blocking \
+  2>/dev/null
+
+# 4. Run SARIF with --sarif-reachability reachable (filtered)
+socketcli \
+  --target-path tests/e2e/fixtures/simple-npm \
+  --reach \
+  --sarif-file /tmp/sarif-reachable.sarif \
+  --sarif-scope full \
+  --sarif-reachability reachable \
+  --disable-blocking \
+  2>/dev/null
+
+# 5. Verify reachable-only results are a subset of all results
+test -f /tmp/sarif-all.sarif
+test -f /tmp/sarif-reachable.sarif
+
+python3 -c "
+import json
+with open('/tmp/sarif-all.sarif') as f:
+    all_data = json.load(f)
+with open('/tmp/sarif-reachable.sarif') as f:
+    reach_data = json.load(f)
+all_count = len(all_data['runs'][0]['results'])
+reach_count = len(reach_data['runs'][0]['results'])
+print(f'All results: {all_count}, Reachable-only results: {reach_count}')
+assert reach_count <= all_count, f'FAIL: reachable ({reach_count}) > all ({all_count})'
+print('PASS: Reachable-only results is a subset of all results')
+"
diff --git a/tests/e2e/validate-sarif.sh b/tests/e2e/validate-sarif.sh
new file mode 100755
index 0000000..3846c0f
--- /dev/null
+++ b/tests/e2e/validate-sarif.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SARIF="/tmp/results.sarif"
+
+if [ ! -f "$SARIF" ]; then
+  echo "FAIL: SARIF file not found at $SARIF"
+  exit 1
+fi
+
+python3 -c "
+import json, sys
+with open('$SARIF') as f:
+    data = json.load(f)
+assert data['version'] == '2.1.0', f'Invalid version: {data[\"version\"]}'
+assert '\$schema' in data, 'Missing \$schema'
+count = len(data['runs'][0]['results'])
+print(f'PASS: Valid SARIF 2.1.0 with {count} result(s)')
+"
diff --git a/tests/e2e/validate-scan.sh b/tests/e2e/validate-scan.sh
new file mode 100755
index 0000000..fd8eccf
--- /dev/null
+++ b/tests/e2e/validate-scan.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+LOG="/tmp/e2e-output.log"
+
+if grep -q "Full scan report URL: https://socket.dev/" "$LOG"; then
+  echo "PASS: Full scan report URL found"
+  grep "Full scan report URL:" "$LOG"
+elif grep -q "Diff Url: https://socket.dev/" "$LOG"; then
+  echo "PASS: Diff URL found"
+  grep "Diff Url:" "$LOG"
+else
+  echo "FAIL: No report URL found in scan output"
+  cat "$LOG"
+  exit 1
+fi
diff --git a/tests/unit/test_gitlab_format.py b/tests/unit/test_gitlab_format.py
index 1799dcf..96218e4 100644
--- a/tests/unit/test_gitlab_format.py
+++ b/tests/unit/test_gitlab_format.py
@@ -1,3 +1,5 @@
+import re
+
 import pytest
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.classes import Diff, Issue
@@ -6,8 +8,11 @@
 class TestGitLabFormat:
     """Test suite for GitLab Security Dashboard format generation"""
 
+    # GitLab v15.0.0 schema: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$
+    GITLAB_TIMESTAMP_RE = re.compile(r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}$")
+
     def test_gitlab_report_structure(self):
-        """Test basic GitLab report structure is valid"""
+        """Test basic GitLab report structure matches v15.0.0 schema requirements"""
         diff = Diff()
         diff.new_alerts = []
         diff.id = "test-scan-id"
@@ -15,10 +20,11 @@ def test_gitlab_report_structure(self):
 
         report = Messages.create_security_comment_gitlab(diff)
 
-        # Verify required top-level fields
+        # All four root-level keys required by v15.0.0 schema
         assert "version" in report
         assert "scan" in report
         assert "vulnerabilities" in report
+        assert "dependency_files" in report
 
         # Verify scan structure
         assert report["scan"]["type"] == "dependency_scanning"
@@ -28,6 +34,12 @@ def test_gitlab_report_structure(self):
         assert report["scan"]["scanner"]["id"] == "socket-cli"
         assert report["scan"]["status"] == "success"
 
+        # Timestamps must match GitLab pattern (no microseconds, no trailing Z)
+        assert self.GITLAB_TIMESTAMP_RE.match(report["scan"]["start_time"]), \
+            f"start_time '{report['scan']['start_time']}' doesn't match GitLab pattern"
+        assert self.GITLAB_TIMESTAMP_RE.match(report["scan"]["end_time"]), \
+            f"end_time '{report['scan']['end_time']}' doesn't match GitLab pattern"
+
     def test_vulnerability_mapping(self):
         """Test Socket Issue maps correctly to GitLab vulnerability"""
         diff = Diff()
@@ -391,3 +403,164 @@ def test_manifests_attribute_fallback(self):
         vuln = report["vulnerabilities"][0]
 
         assert vuln["location"]["file"] == "requirements.txt"
+
+    def test_dependency_files_populated_from_alerts(self):
+        """Test dependency_files is built from alert locations per v15.0.0 schema"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        diff.new_alerts = [
+            Issue(
+                pkg_name="pkg-a",
+                pkg_version="1.0.0",
+                type="malware",
+                severity="high",
+                title="Alert A",
+                manifests="package.json",
+                pkg_type="npm",
+                key="key-a",
+                purl="pkg:npm/pkg-a@1.0.0"
+            ),
+            Issue(
+                pkg_name="pkg-b",
+                pkg_version="2.0.0",
+                type="vulnerability",
+                severity="medium",
+                title="Alert B",
+                manifests="requirements.txt",
+                pkg_type="pypi",
+                key="key-b",
+                purl="pkg:pypi/pkg-b@2.0.0"
+            ),
+        ]
+
+        report = Messages.create_security_comment_gitlab(diff)
+
+        assert "dependency_files" in report
+        dep_files = report["dependency_files"]
+        assert len(dep_files) == 2
+
+        paths = {df["path"] for df in dep_files}
+        assert "package.json" in paths
+        assert "requirements.txt" in paths
+
+        for df in dep_files:
+            assert "path" in df
+            assert "package_manager" in df
+            assert "dependencies" in df
+            assert isinstance(df["dependencies"], list)
+            assert len(df["dependencies"]) >= 1
+            for dep in df["dependencies"]:
+                assert "package" in dep
+                assert "name" in dep["package"]
+                assert "version" in dep
+
+    def test_dependency_files_groups_by_manifest(self):
+        """Test multiple alerts from the same manifest are grouped into one dependency_file"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        diff.new_alerts = [
+            Issue(
+                pkg_name="pkg-a", pkg_version="1.0.0", type="malware", severity="high",
+                title="A", manifests="package.json", pkg_type="npm", key="k1", purl="pkg:npm/pkg-a@1.0.0"
+            ),
+            Issue(
+                pkg_name="pkg-b", pkg_version="2.0.0", type="vulnerability", severity="low",
+                title="B", manifests="package.json", pkg_type="npm", key="k2", purl="pkg:npm/pkg-b@2.0.0"
+            ),
+        ]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        dep_files = report["dependency_files"]
+
+        assert len(dep_files) == 1
+        assert dep_files[0]["path"] == "package.json"
+        assert dep_files[0]["package_manager"] == "npm"
+        assert len(dep_files[0]["dependencies"]) == 2
+
+    def test_dependency_files_empty_when_no_alerts(self):
+        """Test dependency_files is an empty array when there are no alerts"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+        diff.new_alerts = []
+
+        report = Messages.create_security_comment_gitlab(diff)
+        assert report["dependency_files"] == []
+
+    def test_dependency_files_skips_unknown_manifest(self):
+        """Test alerts with unknown manifest don't produce dependency_file entries"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        diff.new_alerts = [
+            Issue(
+                pkg_name="pkg-a", pkg_version="1.0.0", type="malware", severity="high",
+                title="A", pkg_type="npm", key="k1", purl="pkg:npm/pkg-a@1.0.0"
+            ),
+        ]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        assert report["dependency_files"] == []
+
+    def test_unchanged_alerts_included_in_report(self):
+        """Test that unchanged_alerts are included alongside new_alerts in the GitLab report"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        diff.new_alerts = [
+            Issue(
+                pkg_name="new-pkg", pkg_version="1.0.0", type="malware", severity="high",
+                title="New Alert", manifests="package.json", pkg_type="npm", key="k1", purl="pkg:npm/new-pkg@1.0.0"
+            ),
+        ]
+        diff.unchanged_alerts = [
+            Issue(
+                pkg_name="existing-pkg", pkg_version="2.0.0", type="vulnerability", severity="medium",
+                title="Existing Alert", manifests="package.json", pkg_type="npm", key="k2", purl="pkg:npm/existing-pkg@2.0.0"
+            ),
+        ]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        assert len(report["vulnerabilities"]) == 2
+
+        names = {v["name"] for v in report["vulnerabilities"]}
+        assert "New Alert" in names
+        assert "Existing Alert" in names
+
+    def test_only_unchanged_alerts_produces_nonempty_report(self):
+        """Test that a diff with no new alerts but unchanged alerts still populates the report"""
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+
+        diff.new_alerts = []
+        diff.unchanged_alerts = [
+            Issue(
+                pkg_name="stable-pkg", pkg_version="3.0.0", type="vulnerability", severity="critical",
+                title="Known Issue", manifests="requirements.txt", pkg_type="pypi", key="k1", purl="pkg:pypi/stable-pkg@3.0.0"
+            ),
+        ]
+
+        report = Messages.create_security_comment_gitlab(diff)
+        assert len(report["vulnerabilities"]) == 1
+        assert report["vulnerabilities"][0]["name"] == "Known Issue"
+        assert len(report["dependency_files"]) == 1
+        assert report["dependency_files"][0]["path"] == "requirements.txt"
+
+    def test_pkg_type_to_package_manager_mapping(self):
+        """Test package manager mapping covers common ecosystems"""
+        assert Messages._pkg_type_to_package_manager("npm") == "npm"
+        assert Messages._pkg_type_to_package_manager("pypi") == "pip"
+        assert Messages._pkg_type_to_package_manager("go") == "go"
+        assert Messages._pkg_type_to_package_manager("maven") == "maven"
+        assert Messages._pkg_type_to_package_manager("gem") == "bundler"
+        assert Messages._pkg_type_to_package_manager("nuget") == "nuget"
+        assert Messages._pkg_type_to_package_manager("cargo") == "cargo"
+        assert Messages._pkg_type_to_package_manager("") == "unknown"
+        assert Messages._pkg_type_to_package_manager("swift") == "swift"
diff --git a/uv.lock b/uv.lock
index 4c6607f..4d82501 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.78"
+version = "2.2.81"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 2bbe39086468d3c6f9ebca7795e80b1f0710e9a9 Mon Sep 17 00:00:00 2001
From: Bill Li <me@bill.li>
Date: Wed, 15 Apr 2026 16:02:07 +0100
Subject: [PATCH 41/80] chore: adding disable ignore flag (#183)

* chore: adding disable ignore flag
---
 docs/cli-reference.md             |   3 +-
 pyproject.toml                    |   2 +-
 socketsecurity/__init__.py        |   2 +-
 socketsecurity/config.py          |  15 ++++
 socketsecurity/core/messages.py   |  29 +++++--
 socketsecurity/socketcli.py       |  20 +++--
 tests/unit/test_disable_ignore.py | 138 ++++++++++++++++++++++++++++++
 uv.lock                           |   2 +-
 8 files changed, 191 insertions(+), 20 deletions(-)
 create mode 100644 tests/unit/test_disable_ignore.py

diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 0fdee6c..bef8a5a 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -151,7 +151,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
           [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-scope {diff,full}] [--sarif-grouping {instance,alert}] [--sarif-reachability {all,reachable,potentially,reachable-or-potentially}] [--enable-gitlab-security] [--gitlab-security-file <path>]
           [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
-          [--ignore-commit-files] [--disable-blocking] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
+          [--ignore-commit-files] [--disable-blocking] [--disable-ignore] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
           [--reach] [--reach-version REACH_VERSION] [--reach-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-exclude-paths REACH_EXCLUDE_PATHS]
           [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-output-file REACH_OUTPUT_FILE]
@@ -306,6 +306,7 @@ The CLI will automatically install `@coana-tech/cli` if not present. Use `--reac
 |:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
 | `--ignore-commit-files`    | False    | False   | Ignore commit files                                                   |
 | `--disable-blocking`       | False    | False   | Disable blocking mode                                                 |
+| `--disable-ignore`         | False    | False   | Disable support for `@SocketSecurity ignore` commands in PR comments. When set, alerts cannot be suppressed via comments and ignore instructions are hidden from comment output. |
 | `--strict-blocking`        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
 | `--enable-diff`            | False    | False   | Enable diff mode even when using `--integration api` (forces diff mode without SCM integration) |
 | `--scm`                    | False    | api     | Source control management type                                        |
diff --git a/pyproject.toml b/pyproject.toml
index c912d72..a07a1f8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.81"
+version = "2.2.82"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index d4a1870..a9cab02 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.81'
+__version__ = '2.2.82'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 9c3b40b..bc7689f 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -91,6 +91,7 @@ class CliConfig:
     files: str = None
     ignore_commit_files: bool = False
     disable_blocking: bool = False
+    disable_ignore: bool = False
     strict_blocking: bool = False
     integration_type: IntegrationType = "api"
     integration_org_slug: Optional[str] = None
@@ -201,6 +202,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'files': args.files,
             'ignore_commit_files': args.ignore_commit_files,
             'disable_blocking': args.disable_blocking,
+            'disable_ignore': args.disable_ignore,
             'strict_blocking': args.strict_blocking,
             'integration_type': args.integration,
             'pending_head': args.pending_head,
@@ -693,6 +695,19 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=argparse.SUPPRESS
     )
+    advanced_group.add_argument(
+        "--disable-ignore",
+        dest="disable_ignore",
+        action="store_true",
+        help="Disable support for @SocketSecurity ignore commands in PR comments. "
+             "Alerts cannot be suppressed via comments when this flag is set."
+    )
+    advanced_group.add_argument(
+        "--disable_ignore",
+        dest="disable_ignore",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
     advanced_group.add_argument(
         "--strict-blocking",
         dest="strict_blocking",
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index 0f3b62e..2f1cf91 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -850,6 +850,8 @@ def security_comment_template(diff: Diff, config=None) -> str:
   <tbody>
     """
 
+        show_ignore = not (config and getattr(config, 'disable_ignore', False))
+
         # Loop through security alerts (non-license), dynamically generating rows
         for alert in security_alerts:
             severity_icon = Messages.get_severity_icon(alert.severity)
@@ -858,6 +860,12 @@ def security_comment_template(diff: Diff, config=None) -> str:
             # Generate proper manifest URL
             manifest_url = Messages.get_manifest_file_url(diff, alert.manifests, config)
             # Generate a table row for each alert
+            ignore_html = (
+                f"<p><em>Mark as acceptable risk:</em> To ignore this alert only in this pull request, reply with:<br/>"
+                f"<code>@SocketSecurity ignore {alert.pkg_name}@{alert.pkg_version}</code><br/>"
+                f"Or ignore all future alerts with:<br/>"
+                f"<code>@SocketSecurity ignore-all</code></p>"
+            ) if show_ignore else ""
             comment += f"""
 <!-- start-socket-alert-{alert.pkg_name}@{alert.pkg_version} -->
 <tr>
@@ -870,16 +878,13 @@ def security_comment_template(diff: Diff, config=None) -> str:
       <summary>{alert.pkg_name}@{alert.pkg_version} - {alert.title}</summary>
       <p><strong>Note:</strong> {alert.description}</p>
       <p><strong>Source:</strong> <a href="{manifest_url}">Manifest File</a></p>
-      <p>ℹ️ Read more on:  
-      <a href="{alert.purl}">This package</a> |  
-      <a href="{alert.url}">This alert</a> |  
+      <p>ℹ️ Read more on:
+      <a href="{alert.purl}">This package</a> |
+      <a href="{alert.url}">This alert</a> |
       <a href="https://socket.dev/alerts/malware">What is known malware?</a></p>
       <blockquote>
         <p><em>Suggestion:</em> {alert.suggestion}</p>
-        <p><em>Mark as acceptable risk:</em> To ignore this alert only in this pull request, reply with:<br/>
-        <code>@SocketSecurity ignore {alert.pkg_name}@{alert.pkg_version}</code><br/>
-        Or ignore all future alerts with:<br/>
-        <code>@SocketSecurity ignore-all</code></p>
+        {ignore_html}
       </blockquote>
     </details>
   </td>
@@ -917,14 +922,20 @@ def security_comment_template(diff: Diff, config=None) -> str:
             
             # Generate proper manifest URL for license violations
             license_manifest_url = Messages.get_manifest_file_url(diff, first_alert.manifests, config)
-            
+
+            license_ignore_html = (
+                f"<p><em>Mark the package as acceptable risk:</em> To ignore this alert only in this pull request, reply with the comment "
+                f"<code>@SocketSecurity ignore {first_alert.pkg_name}@{first_alert.pkg_version}</code>. "
+                f"You can also ignore all packages with <code>@SocketSecurity ignore-all</code>. "
+                f"To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.</p>"
+            ) if show_ignore else ""
             comment += f"""      </ul>
       <p><strong>From:</strong> <a href="{license_manifest_url}">Manifest File</a></p>
       <p>ℹ️ Read more on: <a href="{first_alert.purl}">This package</a> | <a href="https://socket.dev/alerts/license">What is a license policy violation?</a></p>
       <blockquote>
         <p><em>Next steps:</em> Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at <strong>support@socket.dev</strong>.</p>
         <p><em>Suggestion:</em> Find a package that does not violate your license policy or adjust your policy to allow this package's license.</p>
-        <p><em>Mark the package as acceptable risk:</em> To ignore this alert only in this pull request, reply with the comment <code>@SocketSecurity ignore {first_alert.pkg_name}@{first_alert.pkg_version}</code>. You can also ignore all packages with <code>@SocketSecurity ignore-all</code>. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.</p>
+        {license_ignore_html}
       </blockquote>
     </details>
   </td>
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index a8de637..e7d86da 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -486,10 +486,13 @@ def main_code():
         # 3. Updates the comment to remove ignored alerts
         # This is completely separate from the main scanning functionality
         log.info("Comment initiated flow")
-        
-        comments = scm.get_comments_for_pr()
-        log.debug("Removing comment alerts")
-        scm.remove_comment_alerts(comments)
+
+        if not config.disable_ignore:
+            comments = scm.get_comments_for_pr()
+            log.debug("Removing comment alerts")
+            scm.remove_comment_alerts(comments)
+        else:
+            log.info("Ignore commands disabled (--disable-ignore), skipping comment processing")
     
     elif scm is not None and scm.check_event_type() != "comment" and not force_api_mode:
         log.info("Push initiated flow")
@@ -497,10 +500,13 @@ def main_code():
             log.info("Starting comment logic for PR/MR event")
             diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
             comments = scm.get_comments_for_pr()
-            log.debug("Removing comment alerts")
-            
+
             # FIXME: this overwrites diff.new_alerts, which was previously populated by Core.create_issue_alerts
-            diff.new_alerts = Comments.remove_alerts(comments, diff.new_alerts)
+            if not config.disable_ignore:
+                log.debug("Removing comment alerts")
+                diff.new_alerts = Comments.remove_alerts(comments, diff.new_alerts)
+            else:
+                log.info("Ignore commands disabled (--disable-ignore), all alerts will be reported")
             log.debug("Creating Dependency Overview Comment")
             
             overview_comment = Messages.dependency_overview_template(diff)
diff --git a/tests/unit/test_disable_ignore.py b/tests/unit/test_disable_ignore.py
new file mode 100644
index 0000000..e151a3f
--- /dev/null
+++ b/tests/unit/test_disable_ignore.py
@@ -0,0 +1,138 @@
+"""Tests for the --disable-ignore flag."""
+
+import pytest
+from dataclasses import dataclass
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core.classes import Comment, Diff, Issue
+from socketsecurity.core.messages import Messages
+from socketsecurity.core.scm_comments import Comments
+
+
+# --- CLI flag parsing tests ---
+
+class TestDisableIgnoreFlag:
+    def test_flag_defaults_to_false(self):
+        config = CliConfig.from_args(["--api-token", "test"])
+        assert config.disable_ignore is False
+
+    def test_flag_parsed_with_dashes(self):
+        config = CliConfig.from_args(["--api-token", "test", "--disable-ignore"])
+        assert config.disable_ignore is True
+
+    def test_flag_parsed_with_underscores(self):
+        config = CliConfig.from_args(["--api-token", "test", "--disable_ignore"])
+        assert config.disable_ignore is True
+
+    def test_flag_independent_of_disable_blocking(self):
+        config = CliConfig.from_args([
+            "--api-token", "test",
+            "--disable-ignore",
+            "--disable-blocking",
+        ])
+        assert config.disable_ignore is True
+        assert config.disable_blocking is True
+
+
+# --- Alert suppression tests ---
+
+def _make_alert(**overrides) -> Issue:
+    defaults = dict(
+        pkg_name="lodash",
+        pkg_version="4.17.21",
+        pkg_type="npm",
+        severity="high",
+        title="Known Malware",
+        description="Test description",
+        type="malware",
+        url="https://socket.dev/test",
+        manifests="package.json",
+        props={},
+        key="test-key",
+        purl="pkg:npm/lodash@4.17.21",
+        error=True,
+        warn=False,
+        ignore=False,
+        monitor=False,
+        suggestion="Remove this package",
+        next_step_title="Next steps",
+        emoji="🚨",
+    )
+    defaults.update(overrides)
+    return Issue(**defaults)
+
+
+def _make_comment(body: str, comment_id: int = 1) -> Comment:
+    return Comment(
+        id=comment_id,
+        body=body,
+        body_list=body.split("\n"),
+        reactions={"+1": 0},
+        user={"login": "test-user", "id": 123},
+    )
+
+
+class TestRemoveAlertsRespectedByFlag:
+    """Verify that Comments.remove_alerts behaves correctly so the
+    disable_ignore conditional in socketcli.py has the right effect."""
+
+    def test_remove_alerts_suppresses_matching_alert(self):
+        """Without --disable-ignore, matching alerts are removed."""
+        alert = _make_alert()
+        ignore_comment = _make_comment("SocketSecurity ignore npm/lodash@4.17.21")
+        comments = Comments.check_for_socket_comments({ignore_comment.id: ignore_comment})
+        result = Comments.remove_alerts(comments, [alert])
+        assert len(result) == 0
+
+    def test_alerts_preserved_when_no_ignore_comments(self):
+        """With --disable-ignore the caller skips remove_alerts entirely,
+        which is equivalent to passing empty comments."""
+        alert = _make_alert()
+        result = Comments.remove_alerts({}, [alert])
+        assert len(result) == 1
+        assert result[0].pkg_name == "lodash"
+
+    def test_ignore_all_suppresses_all_alerts(self):
+        alert1 = _make_alert()
+        alert2 = _make_alert(pkg_name="express", pkg_version="4.18.2",
+                             purl="pkg:npm/express@4.18.2")
+        ignore_comment = _make_comment("SocketSecurity ignore-all")
+        comments = Comments.check_for_socket_comments({ignore_comment.id: ignore_comment})
+        result = Comments.remove_alerts(comments, [alert1, alert2])
+        assert len(result) == 0
+
+
+# --- Comment output tests ---
+
+@dataclass
+class _FakeConfig:
+    disable_ignore: bool = False
+    scm: str = "github"
+
+
+class TestSecurityCommentIgnoreInstructions:
+    def _make_diff_with_alert(self) -> Diff:
+        diff = Diff()
+        diff.id = "test-scan-id"
+        diff.diff_url = "https://socket.dev/test"
+        diff.new_alerts = [_make_alert()]
+        return diff
+
+    def test_ignore_instructions_shown_by_default(self):
+        diff = self._make_diff_with_alert()
+        config = _FakeConfig(disable_ignore=False)
+        comment = Messages.security_comment_template(diff, config)
+        assert "@SocketSecurity ignore" in comment
+        assert "Mark as acceptable risk" in comment
+
+    def test_ignore_instructions_hidden_when_disabled(self):
+        diff = self._make_diff_with_alert()
+        config = _FakeConfig(disable_ignore=True)
+        comment = Messages.security_comment_template(diff, config)
+        assert "@SocketSecurity ignore" not in comment
+        assert "Mark as acceptable risk" not in comment
+
+    def test_ignore_instructions_shown_when_config_is_none(self):
+        diff = self._make_diff_with_alert()
+        comment = Messages.security_comment_template(diff, config=None)
+        assert "@SocketSecurity ignore" in comment
diff --git a/uv.lock b/uv.lock
index 4d82501..1755013 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.81"
+version = "2.2.82"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From aa1ba531d1910ea53c359fec74e1c005f62659ee Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Fri, 17 Apr 2026 10:15:08 +0200
Subject: [PATCH 42/80] fix: strip git name-rev suffix operators from detected
 branch name (#189)

In detached-HEAD CI checkouts (common in Buildkite/CircleCI/Jenkins/etc.
where none of the GitHub/GitLab/Bitbucket CI env vars are recognized),
the Python CLI falls back to `git name-rev --name-only HEAD` to detect
the current branch. When the checked-out SHA is not exactly at a branch
tip (e.g. master moved forward after the pipeline started), name-rev
returns strings like `remotes/origin/master~1` or `master^0`. The
previous split('/')[-1] cleanup kept the `~N`/`^N` suffix, which the
Socket API then rejected with "Invalid branch name".

Strip anything from the first `~` or `^` onward before the prefix
split. Both characters are forbidden in git ref names per
check-ref-format(1), so truncating at them is always safe.

Assisted-by: Claude Code:opus-4-7
---
 CHANGELOG.md                         | 4 ++++
 pyproject.toml                       | 2 +-
 socketsecurity/__init__.py           | 2 +-
 socketsecurity/core/git_interface.py | 6 ++++++
 4 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 683e0ad..e2ea6c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2.2.83
+
+- Fixed branch detection in detached-HEAD CI checkouts. When `git name-rev --name-only HEAD` returned an output with a suffix operator (e.g. `remotes/origin/master~1`, `master^0`), the `~N`/`^N` was previously passed through as the branch name and rejected by the Socket API as an invalid Git ref. The suffix is now stripped before the prefix split, producing the bare branch name.
+
 ## 2.2.71
 
 - Added `strace` to the Docker image for debugging purposes.
diff --git a/pyproject.toml b/pyproject.toml
index a07a1f8..07501c5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.82"
+version = "2.2.83"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index a9cab02..f233dd0 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.82'
+__version__ = '2.2.83'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/git_interface.py b/socketsecurity/core/git_interface.py
index d750284..da61406 100644
--- a/socketsecurity/core/git_interface.py
+++ b/socketsecurity/core/git_interface.py
@@ -1,3 +1,4 @@
+import re
 import urllib.parse
 import os
 
@@ -108,6 +109,11 @@ def __init__(self, path: str):
                     # Try git name-rev first (most reliable for detached HEAD)
                     result = self.repo.git.name_rev('--name-only', 'HEAD')
                     if result and result != 'undefined':
+                        # Strip name-rev suffix operators (~N, ^N, or combinations
+                        # like master~3^2). These characters are forbidden in git
+                        # ref names, so cutting at the first occurrence can never
+                        # truncate a real branch name.
+                        result = re.split(r'[~^]', result, maxsplit=1)[0]
                         # Clean up the result (remove any prefixes like 'remotes/origin/')
                         git_detected_branch = result.split('/')[-1]
                         log.debug(f"Branch detected from git name-rev: {git_detected_branch}")

From 94f3313dad8e2b638ae550a0e067ef8d52991577 Mon Sep 17 00:00:00 2001
From: Bill Li <me@bill.li>
Date: Tue, 21 Apr 2026 18:00:21 +0100
Subject: [PATCH 43/80] feat(ignore): adding event logger for ignored comments
 (#178)

* feat(ignore): adding event logger for ignored comments
---
 pyproject.toml                                |   2 +-
 socketsecurity/__init__.py                    |   2 +-
 socketsecurity/core/cli_client.py             |  16 ++
 socketsecurity/core/scm/gitlab.py             |  42 ++++
 socketsecurity/core/scm_comments.py           |   8 +-
 socketsecurity/socketcli.py                   | 118 +++++++++
 tests/unit/test_client.py                     |  51 +++-
 tests/unit/test_ignore_telemetry_filtering.py | 237 ++++++++++++++++++
 uv.lock                                       |   2 +-
 9 files changed, 471 insertions(+), 7 deletions(-)
 create mode 100644 tests/unit/test_ignore_telemetry_filtering.py

diff --git a/pyproject.toml b/pyproject.toml
index 07501c5..3963007 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.83"
+version = "2.2.84"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index f233dd0..9ca3b60 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.83'
+__version__ = '2.2.84'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/cli_client.py b/socketsecurity/core/cli_client.py
index 8bb2ed6..bfad0d1 100644
--- a/socketsecurity/core/cli_client.py
+++ b/socketsecurity/core/cli_client.py
@@ -1,4 +1,5 @@
 import base64
+import json
 import logging
 from typing import Dict, List, Optional, Union
 
@@ -55,3 +56,18 @@ def request(
         except requests.exceptions.RequestException as e:
             logger.error(f"API request failed: {str(e)}")
             raise APIFailure(f"Request failed: {str(e)}")
+
+    def post_telemetry_events(self, org_slug: str, events: List[Dict]) -> None:
+        """Post telemetry events one at a time to the v0 telemetry API. Fire-and-forget — logs errors but never raises."""
+        logger.debug(f"Sending {len(events)} telemetry event(s) to v0/orgs/{org_slug}/telemetry")
+        for i, event in enumerate(events):
+            try:
+                logger.debug(f"Telemetry event {i+1}/{len(events)}: {json.dumps(event)}")
+                resp = self.request(
+                    path=f"orgs/{org_slug}/telemetry",
+                    method="POST",
+                    payload=json.dumps(event),
+                )
+                logger.debug(f"Telemetry event {i+1}/{len(events)} sent: status={resp.status_code}")
+            except Exception as e:
+                logger.warning(f"Failed to send telemetry event {i+1}/{len(events)}: {e}")
diff --git a/socketsecurity/core/scm/gitlab.py b/socketsecurity/core/scm/gitlab.py
index e88e050..b3b3492 100644
--- a/socketsecurity/core/scm/gitlab.py
+++ b/socketsecurity/core/scm/gitlab.py
@@ -1,3 +1,4 @@
+import json
 import os
 import sys
 from dataclasses import dataclass
@@ -219,6 +220,24 @@ def update_comment(self, body: str, comment_id: str) -> None:
             base_url=self.config.api_url
         )
 
+    def has_thumbsup_reaction(self, comment_id: int) -> bool:
+        """Best-effort check for 'thumbsup' award emoji on a MR note."""
+        if not self.config.mr_project_id or not self.config.mr_iid:
+            return False
+        path = f"projects/{self.config.mr_project_id}/merge_requests/{self.config.mr_iid}/notes/{comment_id}/award_emoji"
+        try:
+            response = self._request_with_fallback(
+                path=path,
+                headers=self.config.headers,
+                base_url=self.config.api_url
+            )
+            for emoji in response.json():
+                if emoji.get("name") == "thumbsup":
+                    return True
+        except Exception as e:
+            log.debug(f"Could not check award emoji for note {comment_id} (best effort): {e}")
+        return False
+
     def get_comments_for_pr(self) -> dict:
         log.debug(f"Getting Gitlab comments for Repo {self.config.repository} for PR {self.config.mr_iid}")
         path = f"projects/{self.config.mr_project_id}/merge_requests/{self.config.mr_iid}/notes"
@@ -326,9 +345,32 @@ def set_commit_status(self, state: str, description: str, target_url: str = '')
         except Exception as e:
             log.error(f"Failed to set commit status: {e}")
 
+    def post_thumbsup_reaction(self, comment_id: int) -> None:
+        """Best-effort: add 'thumbsup' award emoji to a MR note."""
+        if not self.config.mr_project_id or not self.config.mr_iid:
+            return
+        path = f"projects/{self.config.mr_project_id}/merge_requests/{self.config.mr_iid}/notes/{comment_id}/award_emoji"
+        try:
+            headers = {**self.config.headers, "Content-Type": "application/json"}
+            self._request_with_fallback(
+                path=path,
+                payload=json.dumps({"name": "thumbsup"}),
+                method="POST",
+                headers=headers,
+                base_url=self.config.api_url
+            )
+        except Exception as e:
+            log.debug(f"Could not add thumbsup emoji to note {comment_id} (best effort): {e}")
+
+    def handle_ignore_reactions(self, comments: dict) -> None:
+        for comment in comments.get("ignore", []):
+            if "SocketSecurity ignore" in comment.body and not self.has_thumbsup_reaction(comment.id):
+                self.post_thumbsup_reaction(comment.id)
+
     def remove_comment_alerts(self, comments: dict):
         security_alert = comments.get("security")
         if security_alert is not None:
             # Type narrowing: after None check, mypy knows this is Comment
             new_body = Comments.process_security_comment(security_alert, comments)
+            self.handle_ignore_reactions(comments)
             self.update_comment(new_body, str(security_alert.id))
diff --git a/socketsecurity/core/scm_comments.py b/socketsecurity/core/scm_comments.py
index bd1b4d7..741578e 100644
--- a/socketsecurity/core/scm_comments.py
+++ b/socketsecurity/core/scm_comments.py
@@ -51,11 +51,13 @@ def get_ignore_options(comments: dict) -> [bool, list]:
         for comment in comments["ignore"]:
             comment: Comment
             first_line = comment.body_list[0]
-            if not ignore_all and "SocketSecurity ignore" in first_line:
+            if not ignore_all and "socketsecurity ignore" in first_line.lower():
                 try:
                     first_line = first_line.lstrip("@")
-                    _, command = first_line.split("SocketSecurity ")
-                    command = command.strip()
+                    # Case-insensitive split: find "SocketSecurity " regardless of casing
+                    lower_line = first_line.lower()
+                    split_idx = lower_line.index("socketsecurity ") + len("socketsecurity ")
+                    command = first_line[split_idx:].strip()
                     if command == "ignore-all":
                         ignore_all = True
                     else:
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index e7d86da..76e5099 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -4,6 +4,8 @@
 import traceback
 import shutil
 import warnings
+from datetime import datetime, timezone
+from uuid import uuid4
 
 from dotenv import load_dotenv
 from git import InvalidGitRepositoryError, NoSuchPathError
@@ -478,6 +480,17 @@ def main_code():
 
     # Handle SCM-specific flows
     log.debug(f"Flow decision: scm={scm is not None}, force_diff_mode={force_diff_mode}, force_api_mode={force_api_mode}, enable_diff={config.enable_diff}")
+
+    def _is_unprocessed(c):
+        """Check if an ignore comment has not yet been marked with '+1' reaction.
+        For GitHub, reactions['+1'] is already in the comment response (no extra call).
+        For GitLab, has_thumbsup_reaction() makes a lazy API call per comment."""
+        if getattr(c, "reactions", {}).get("+1"):
+            return False
+        if hasattr(scm, "has_thumbsup_reaction") and scm.has_thumbsup_reaction(c.id):
+            return False
+        return True
+
     if scm is not None and scm.check_event_type() == "comment":
         # FIXME: This entire flow should be a separate command called "filter_ignored_alerts_in_comments"
         # It's not related to scanning or diff generation - it just:
@@ -489,6 +502,44 @@ def main_code():
 
         if not config.disable_ignore:
             comments = scm.get_comments_for_pr()
+
+            # Emit telemetry for ignore comments before +1 reaction is added.
+            # The +1 reaction (added by remove_comment_alerts) serves as the "processed" marker.
+            if "ignore" in comments:
+                unprocessed = [c for c in comments["ignore"] if _is_unprocessed(c)]
+                if unprocessed:
+                    try:
+                        events = []
+                        for c in unprocessed:
+                            single = {"ignore": [c]}
+                            ignore_all, ignore_commands = Comments.get_ignore_options(single)
+                            user = getattr(c, "user", None) or getattr(c, "author", None) or {}
+                            now = datetime.now(timezone.utc).isoformat()
+                            shared_fields = {
+                                "event_kind": "user-action",
+                                "client_action": "ignore",
+                                "alert_action": "error",
+                                "event_sender_created_at": now,
+                                "vcs_provider": integration_type,
+                                "owner": config.repo.split("/")[0] if "/" in config.repo else "",
+                                "repo": config.repo,
+                                "pr_number": pr_number,
+                                "ignore_all": ignore_all,
+                                "sender_name": user.get("login") or user.get("username", ""),
+                                "sender_id": str(user.get("id", "")),
+                            }
+                            if ignore_commands:
+                                for name, version in ignore_commands:
+                                    events.append({**shared_fields, "event_id": str(uuid4()), "artifact_input": f"{name}@{version}"})
+                            elif ignore_all:
+                                events.append({**shared_fields, "event_id": str(uuid4())})
+
+                        if events:
+                            log.debug(f"Ignore telemetry: {len(events)} events to send")
+                            client.post_telemetry_events(org_slug, events)
+                    except Exception as e:
+                        log.warning(f"Failed to send ignore telemetry: {e}")
+
             log.debug("Removing comment alerts")
             scm.remove_comment_alerts(comments)
         else:
@@ -504,9 +555,76 @@ def main_code():
             # FIXME: this overwrites diff.new_alerts, which was previously populated by Core.create_issue_alerts
             if not config.disable_ignore:
                 log.debug("Removing comment alerts")
+                alerts_before = list(diff.new_alerts)
                 diff.new_alerts = Comments.remove_alerts(comments, diff.new_alerts)
+
+                ignored_alerts = [a for a in alerts_before if a not in diff.new_alerts]
+                # Emit telemetry per-comment so each event carries the comment author.
+                unprocessed_ignore = [
+                    c for c in comments.get("ignore", [])
+                    if _is_unprocessed(c)
+                ]
+                if ignored_alerts and unprocessed_ignore:
+                    try:
+                        events = []
+                        now = datetime.now(timezone.utc).isoformat()
+                        for c in unprocessed_ignore:
+                            single = {"ignore": [c]}
+                            c_ignore_all, c_ignore_commands = Comments.get_ignore_options(single)
+                            user = getattr(c, "user", None) or getattr(c, "author", None) or {}
+                            sender_name = user.get("login") or user.get("username", "")
+                            sender_id = str(user.get("id", ""))
+
+                            # Match this comment's targets to the actual ignored alerts
+                            matched_alerts = []
+                            if c_ignore_all:
+                                matched_alerts = ignored_alerts
+                            else:
+                                for alert in ignored_alerts:
+                                    full_name = f"{alert.pkg_type}/{alert.pkg_name}"
+                                    purl = (full_name, alert.pkg_version)
+                                    purl_star = (full_name, "*")
+                                    if purl in c_ignore_commands or purl_star in c_ignore_commands:
+                                        matched_alerts.append(alert)
+
+                            shared_fields = {
+                                "event_kind": "user-action",
+                                "client_action": "ignore",
+                                "event_sender_created_at": now,
+                                "vcs_provider": integration_type,
+                                "owner": config.repo.split("/")[0] if "/" in config.repo else "",
+                                "repo": config.repo,
+                                "pr_number": pr_number,
+                                "ignore_all": c_ignore_all,
+                                "sender_name": sender_name,
+                                "sender_id": sender_id,
+                            }
+                            if matched_alerts:
+                                for alert in matched_alerts:
+                                    # Derive alert_action from the alert's resolved action flags
+                                    if getattr(alert, "error", False):
+                                        alert_action = "error"
+                                    elif getattr(alert, "warn", False):
+                                        alert_action = "warn"
+                                    elif getattr(alert, "monitor", False):
+                                        alert_action = "monitor"
+                                    else:
+                                        alert_action = "error"
+                                    events.append({**shared_fields, "alert_action": alert_action, "event_id": str(uuid4()), "artifact_purl": alert.purl})
+                            elif c_ignore_all:
+                                events.append({**shared_fields, "event_id": str(uuid4())})
+
+                        if events:
+                            client.post_telemetry_events(org_slug, events)
+
+                        # Mark ignore comments as processed with +1 reaction
+                        if hasattr(scm, "handle_ignore_reactions"):
+                            scm.handle_ignore_reactions(comments)
+                    except Exception as e:
+                        log.warning(f"Failed to send ignore telemetry: {e}")
             else:
                 log.info("Ignore commands disabled (--disable-ignore), all alerts will be reported")
+
             log.debug("Creating Dependency Overview Comment")
             
             overview_comment = Messages.dependency_overview_template(diff)
diff --git a/tests/unit/test_client.py b/tests/unit/test_client.py
index 3998d39..e0f62d8 100644
--- a/tests/unit/test_client.py
+++ b/tests/unit/test_client.py
@@ -122,4 +122,53 @@ def test_request_with_payload(client):
 
         args, kwargs = mock_request.call_args
         assert kwargs['method'] == "POST"
-        assert kwargs['data'] == payload
\ No newline at end of file
+        assert kwargs['data'] == payload
+
+
+def test_post_telemetry_events_sends_individually(client):
+    """Test that telemetry events are posted one at a time to v0 API"""
+    import json
+
+    events = [
+        {"event_kind": "user-action", "client_action": "ignore_alerts", "artifact_purl": "pkg:npm/foo@1.0.0"},
+        {"event_kind": "user-action", "client_action": "ignore_alerts", "artifact_purl": "pkg:npm/bar@2.0.0"},
+    ]
+
+    with patch('requests.request') as mock_request:
+        mock_response = Mock()
+        mock_response.status_code = 201
+        mock_request.return_value = mock_response
+
+        client.post_telemetry_events("test-org", events)
+
+        assert mock_request.call_count == 2
+
+        first_call = mock_request.call_args_list[0]
+        assert first_call.kwargs['url'] == "https://api.socket.dev/v0/orgs/test-org/telemetry"
+        assert first_call.kwargs['method'] == "POST"
+        assert first_call.kwargs['data'] == json.dumps(events[0])
+
+        second_call = mock_request.call_args_list[1]
+        assert second_call.kwargs['data'] == json.dumps(events[1])
+
+
+def test_post_telemetry_events_continues_on_failure(client):
+    """Test that a failed event does not prevent subsequent events from being sent"""
+    import json
+
+    events = [
+        {"event_kind": "user-action", "artifact_purl": "pkg:npm/foo@1.0.0"},
+        {"event_kind": "user-action", "artifact_purl": "pkg:npm/bar@2.0.0"},
+    ]
+
+    with patch('requests.request') as mock_request:
+        mock_response = Mock()
+        mock_response.status_code = 201
+        mock_request.side_effect = [
+            requests.exceptions.ConnectionError("timeout"),
+            mock_response,
+        ]
+
+        client.post_telemetry_events("test-org", events)
+
+        assert mock_request.call_count == 2
diff --git a/tests/unit/test_ignore_telemetry_filtering.py b/tests/unit/test_ignore_telemetry_filtering.py
new file mode 100644
index 0000000..39b7691
--- /dev/null
+++ b/tests/unit/test_ignore_telemetry_filtering.py
@@ -0,0 +1,237 @@
+"""Tests for the +1 reaction dedup logic used to filter ignore comments for telemetry."""
+
+from unittest.mock import Mock
+
+from socketsecurity.core.classes import Comment
+from socketsecurity.core.scm_comments import Comments
+
+
+def _make_comment(body: str, thumbs_up: int = 0, comment_id: int = 1, user: dict | None = None) -> Comment:
+    return Comment(
+        id=comment_id,
+        body=body,
+        body_list=body.split("\n"),
+        reactions={"+1": thumbs_up},
+        user=user or {"login": "test-user", "id": 123},
+    )
+
+
+def _filter_unprocessed(comments: list[Comment], scm=None) -> list[Comment]:
+    """Mirrors the _is_unprocessed logic in socketcli.py."""
+    def _is_unprocessed(c):
+        if getattr(c, "reactions", {}).get("+1"):
+            return False
+        if hasattr(scm, "has_thumbsup_reaction") and scm.has_thumbsup_reaction(c.id):
+            return False
+        return True
+
+    return [c for c in comments if _is_unprocessed(c)]
+
+
+class TestUnprocessedIgnoreFiltering:
+    def test_returns_comments_without_thumbsup(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=0, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/express@4.18.2", thumbs_up=0, comment_id=2),
+        ]
+        result = _filter_unprocessed(comments)
+        assert len(result) == 2
+
+    def test_excludes_comments_with_thumbsup(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/express@4.18.2", thumbs_up=0, comment_id=2),
+        ]
+        result = _filter_unprocessed(comments)
+        assert len(result) == 1
+        assert result[0].id == 2
+
+    def test_returns_empty_when_all_processed(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+            _make_comment("SocketSecurity ignore-all", thumbs_up=2, comment_id=2),
+        ]
+        result = _filter_unprocessed(comments)
+        assert len(result) == 0
+
+    def test_handles_missing_reactions_attr(self):
+        c = Comment(id=1, body="SocketSecurity ignore npm/foo@1.0.0", body_list=["SocketSecurity ignore npm/foo@1.0.0"])
+        # No reactions attribute set at all
+        result = _filter_unprocessed([c])
+        assert len(result) == 1
+
+    def test_handles_empty_reactions_dict(self):
+        c = _make_comment("SocketSecurity ignore npm/foo@1.0.0", comment_id=1)
+        c.reactions = {}
+        result = _filter_unprocessed([c])
+        assert len(result) == 1
+
+    def test_handles_reactions_with_thumbsup_zero(self):
+        c = _make_comment("SocketSecurity ignore npm/foo@1.0.0", thumbs_up=0, comment_id=1)
+        result = _filter_unprocessed([c])
+        assert len(result) == 1
+
+
+class TestUnprocessedIgnoreFilteringWithScmFallback:
+    """Tests for the has_thumbsup_reaction fallback path (GitLab)."""
+
+    def test_scm_fallback_excludes_processed_comments(self):
+        """When inline reactions['+1'] is 0 but scm says it has thumbsup, exclude it."""
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=0, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/express@4.18.2", thumbs_up=0, comment_id=2),
+        ]
+        scm = Mock()
+        scm.has_thumbsup_reaction = Mock(side_effect=lambda cid: cid == 1)
+
+        result = _filter_unprocessed(comments, scm=scm)
+        assert len(result) == 1
+        assert result[0].id == 2
+
+    def test_scm_fallback_not_called_when_inline_thumbsup_present(self):
+        """When inline reactions['+1'] is truthy, scm.has_thumbsup_reaction should not be called."""
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+        ]
+        scm = Mock()
+        scm.has_thumbsup_reaction = Mock(return_value=False)
+
+        result = _filter_unprocessed(comments, scm=scm)
+        assert len(result) == 0
+        scm.has_thumbsup_reaction.assert_not_called()
+
+    def test_scm_without_has_thumbsup_reaction_skips_fallback(self):
+        """When scm doesn't have has_thumbsup_reaction (e.g. GitHub), only inline check runs."""
+        comments = [
+            _make_comment("SocketSecurity ignore npm/foo@1.0.0", thumbs_up=0, comment_id=1),
+        ]
+        scm = Mock(spec=[])  # no methods at all
+
+        result = _filter_unprocessed(comments, scm=scm)
+        assert len(result) == 1
+
+    def test_scm_fallback_returns_all_unprocessed(self):
+        """When scm says none have thumbsup, all are returned."""
+        comments = [
+            _make_comment("SocketSecurity ignore npm/foo@1.0.0", thumbs_up=0, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/bar@2.0.0", thumbs_up=0, comment_id=2),
+        ]
+        scm = Mock()
+        scm.has_thumbsup_reaction = Mock(return_value=False)
+
+        result = _filter_unprocessed(comments, scm=scm)
+        assert len(result) == 2
+
+
+class TestUnprocessedIgnoreFilteringWithCommentsParsing:
+    """Integration: filter unprocessed comments, then parse ignore options."""
+
+    def test_only_new_artifacts_are_parsed(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/express@4.18.2", thumbs_up=0, comment_id=2),
+            _make_comment("SocketSecurity ignore npm/axios@1.6.0", thumbs_up=0, comment_id=3),
+        ]
+        unprocessed = _filter_unprocessed(comments)
+        unprocessed_comments = {"ignore": unprocessed}
+        ignore_all, ignore_commands = Comments.get_ignore_options(unprocessed_comments)
+
+        assert not ignore_all
+        assert ("npm/express", "4.18.2") in ignore_commands
+        assert ("npm/axios", "1.6.0") in ignore_commands
+        assert ("npm/lodash", "4.17.21") not in ignore_commands
+
+    def test_ignore_all_from_unprocessed(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+            _make_comment("SocketSecurity ignore-all", thumbs_up=0, comment_id=2),
+        ]
+        unprocessed = _filter_unprocessed(comments)
+        unprocessed_comments = {"ignore": unprocessed}
+        ignore_all, ignore_commands = Comments.get_ignore_options(unprocessed_comments)
+
+        assert ignore_all
+
+    def test_no_unprocessed_means_no_telemetry(self):
+        comments = [
+            _make_comment("SocketSecurity ignore npm/lodash@4.17.21", thumbs_up=1, comment_id=1),
+            _make_comment("SocketSecurity ignore npm/express@4.18.2", thumbs_up=2, comment_id=2),
+        ]
+        unprocessed = _filter_unprocessed(comments)
+        assert len(unprocessed) == 0
+
+
+def _build_event(comment, ignore_all=False, ignore_commands=None, artifact_input=None, artifact_purl=None):
+    """Mirrors the event construction logic in socketcli.py."""
+    from datetime import datetime, timezone
+    from uuid import uuid4
+
+    user = getattr(comment, "user", None) or getattr(comment, "author", None) or {}
+    shared_fields = {
+        "event_kind": "user-action",
+        "client_action": "ignore",
+        "alert_action": "error",
+        "event_sender_created_at": datetime.now(timezone.utc).isoformat(),
+        "vcs_provider": "github",
+        "owner": "test-owner",
+        "repo": "test-owner/test-repo",
+        "pr_number": 1,
+        "ignore_all": ignore_all,
+        "sender_name": user.get("login") or user.get("username", ""),
+        "sender_id": str(user.get("id", "")),
+    }
+    if artifact_input:
+        return {**shared_fields, "event_id": str(uuid4()), "artifact_input": artifact_input}
+    if artifact_purl:
+        return {**shared_fields, "event_id": str(uuid4()), "artifact_purl": artifact_purl}
+    return {**shared_fields, "event_id": str(uuid4())}
+
+
+class TestTelemetryEventPayloadShape:
+    """Tests that telemetry event payloads contain the required fields."""
+
+    def test_per_artifact_event_has_required_fields(self):
+        c = _make_comment("SocketSecurity ignore npm/lodash@4.17.21", user={"login": "alice", "id": 1})
+        event = _build_event(c, artifact_input="npm/lodash@4.17.21")
+
+        assert event["event_kind"] == "user-action"
+        assert event["client_action"] == "ignore"
+        assert event["alert_action"] == "error"
+        assert event["vcs_provider"] == "github"
+        assert event["sender_name"] == "alice"
+        assert event["sender_id"] == "1"
+        assert event["artifact_input"] == "npm/lodash@4.17.21"
+        assert "event_id" in event
+        assert "event_sender_created_at" in event
+
+    def test_ignore_all_event_has_required_fields(self):
+        c = _make_comment("SocketSecurity ignore-all", user={"login": "bob", "id": 2})
+        event = _build_event(c, ignore_all=True)
+
+        assert event["event_kind"] == "user-action"
+        assert event["client_action"] == "ignore"
+        assert event["alert_action"] == "error"
+        assert event["ignore_all"] is True
+        assert event["sender_name"] == "bob"
+        assert "artifact_input" not in event
+        assert "artifact_purl" not in event
+
+    def test_push_flow_event_uses_artifact_purl(self):
+        c = _make_comment("SocketSecurity ignore npm/lodash@4.17.21", user={"login": "alice", "id": 1})
+        event = _build_event(c, artifact_purl="pkg:npm/lodash@4.17.21")
+
+        assert event["artifact_purl"] == "pkg:npm/lodash@4.17.21"
+        assert event["alert_action"] == "error"
+        assert "artifact_input" not in event
+
+    def test_gitlab_author_populates_sender(self):
+        c = Comment(
+            id=1, body="SocketSecurity ignore npm/foo@1.0.0",
+            body_list=["SocketSecurity ignore npm/foo@1.0.0"],
+            reactions={"+1": 0},
+            author={"username": "gitlab-dev", "id": 42},
+        )
+        event = _build_event(c, artifact_input="npm/foo@1.0.0")
+
+        assert event["sender_name"] == "gitlab-dev"
+        assert event["sender_id"] == "42"
diff --git a/uv.lock b/uv.lock
index 1755013..cb5ff37 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.82"
+version = "2.2.84"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 82d3e9038fa221a1ec69e00f83e214628ec34808 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 23 Apr 2026 06:23:11 +0200
Subject: [PATCH 44/80] Add hidden reach-continue-on-* flags for Coana v15
 (#191)

* Add hidden reach-continue-on-* flags for Coana v15

Coana v15 introduces four new halt-by-default behaviors in socket mode
and corresponding --reach-continue-on-* opt-outs. Expose them as hidden
flags on the Python CLI so it is ready to forward them when Coana v15
becomes the default.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Bump version to 2.2.85

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 pyproject.toml                            |  2 +-
 socketsecurity/__init__.py                |  2 +-
 socketsecurity/config.py                  | 32 +++++++++++++++++++++++
 socketsecurity/core/tools/reachability.py | 16 ++++++++++++
 socketsecurity/socketcli.py               |  6 ++++-
 5 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 3963007..c0e07c7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.84"
+version = "2.2.85"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 9ca3b60..ec5936b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.84'
+__version__ = '2.2.85'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index bc7689f..1d18c6a 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -131,6 +131,10 @@ class CliConfig:
     reach_additional_params: Optional[List[str]] = None
     only_facts_file: bool = False
     reach_use_only_pregenerated_sboms: bool = False
+    reach_continue_on_analysis_errors: bool = False
+    reach_continue_on_install_errors: bool = False
+    reach_continue_on_missing_lock_files: bool = False
+    reach_continue_on_no_source_files: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
     config_file: Optional[str] = None
@@ -236,6 +240,10 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_additional_params': args.reach_additional_params,
             'only_facts_file': args.only_facts_file,
             'reach_use_only_pregenerated_sboms': args.reach_use_only_pregenerated_sboms,
+            'reach_continue_on_analysis_errors': args.reach_continue_on_analysis_errors,
+            'reach_continue_on_install_errors': args.reach_continue_on_install_errors,
+            'reach_continue_on_missing_lock_files': args.reach_continue_on_missing_lock_files,
+            'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
             'config_file': args.config_file,
@@ -861,6 +869,30 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="When using this option, the scan is created based only on pre-generated CDX and SPDX files in your project. (requires --reach)"
     )
+    reachability_group.add_argument(
+        "--reach-continue-on-analysis-errors",
+        dest="reach_continue_on_analysis_errors",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
+    reachability_group.add_argument(
+        "--reach-continue-on-install-errors",
+        dest="reach_continue_on_install_errors",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
+    reachability_group.add_argument(
+        "--reach-continue-on-missing-lock-files",
+        dest="reach_continue_on_missing_lock_files",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
+    reachability_group.add_argument(
+        "--reach-continue-on-no-source-files",
+        dest="reach_continue_on_no_source_files",
+        action="store_true",
+        help=argparse.SUPPRESS
+    )
 
     parser.add_argument(
         '--version',
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 581ea70..27593c8 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -104,6 +104,10 @@ def run_reachability_analysis(
         allow_unverified: bool = False,
         enable_debug: bool = False,
         use_only_pregenerated_sboms: bool = False,
+        continue_on_analysis_errors: bool = False,
+        continue_on_install_errors: bool = False,
+        continue_on_missing_lock_files: bool = False,
+        continue_on_no_source_files: bool = False,
     ) -> Dict[str, Any]:
         """
         Run reachability analysis.
@@ -196,6 +200,18 @@ def run_reachability_analysis(
         if use_only_pregenerated_sboms:
             cmd.append("--use-only-pregenerated-sboms")
 
+        if continue_on_analysis_errors:
+            cmd.append("--reach-continue-on-analysis-errors")
+
+        if continue_on_install_errors:
+            cmd.append("--reach-continue-on-install-errors")
+
+        if continue_on_missing_lock_files:
+            cmd.append("--reach-continue-on-missing-lock-files")
+
+        if continue_on_no_source_files:
+            cmd.append("--reach-continue-on-no-source-files")
+
         # Add any additional parameters provided by the user
         if additional_params:
             cmd.extend(additional_params)
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 76e5099..1f2b166 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -303,7 +303,11 @@ def main_code():
                     additional_params=config.reach_additional_params,
                     allow_unverified=config.allow_unverified,
                     enable_debug=config.enable_debug,
-                    use_only_pregenerated_sboms=config.reach_use_only_pregenerated_sboms
+                    use_only_pregenerated_sboms=config.reach_use_only_pregenerated_sboms,
+                    continue_on_analysis_errors=config.reach_continue_on_analysis_errors,
+                    continue_on_install_errors=config.reach_continue_on_install_errors,
+                    continue_on_missing_lock_files=config.reach_continue_on_missing_lock_files,
+                    continue_on_no_source_files=config.reach_continue_on_no_source_files,
                 )
                 
                 log.info(f"Reachability analysis completed successfully")

From 206efe9ac8a20af47c2cd5f84ae930d8d9f96bd9 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 24 Apr 2026 14:09:33 -0400
Subject: [PATCH 45/80] fix: bump Socket SDK version, handle missing diff
 scores (#193)

* fix: handle missing diff scores in dependency overview

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: bump release version for CLI

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: bump SDK version for release

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 pyproject.toml                         |  4 +-
 socketsecurity/__init__.py             |  2 +-
 socketsecurity/core/classes.py         |  6 ++-
 socketsecurity/core/messages.py        | 25 ++++++++--
 tests/unit/test_dependency_overview.py | 67 ++++++++++++++++++++++++++
 uv.lock                                | 10 ++--
 6 files changed, 99 insertions(+), 15 deletions(-)
 create mode 100644 tests/unit/test_dependency_overview.py

diff --git a/pyproject.toml b/pyproject.toml
index c0e07c7..49bb294 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.85"
+version = "2.2.86"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.32,<4.0.0",
+    "socketdev>=3.0.33,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index ec5936b..c816fab 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.85'
+__version__ = '2.2.86'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/classes.py b/socketsecurity/core/classes.py
index d211079..db14522 100644
--- a/socketsecurity/core/classes.py
+++ b/socketsecurity/core/classes.py
@@ -207,7 +207,7 @@ def from_diff_artifact(cls, data: dict) -> "Package":
                 name=data["name"],
                 version=data["version"],
                 type=data["type"],
-                score=data.get("score", data.get("scores", {})),
+                score=data.get("score") or data.get("scores") or {},
                 alerts=data.get("alerts", []),
                 author=data.get("author", []),
                 size=data.get("size"),
@@ -236,7 +236,7 @@ def from_diff_artifact(cls, data: dict) -> "Package":
             name=data["name"],
             version=data["version"],
             type=data["type"],
-            score=data.get("score", data.get("scores", {})),
+            score=data.get("score") or data.get("scores") or {},
             alerts=data.get("alerts", []),
             author=data.get("author", []),
             size=data.get("size"),
@@ -448,6 +448,8 @@ def __init__(self, **kwargs):
             self.capabilities = []
         if not hasattr(self, "is_new"):
             self.is_new = False
+        if not hasattr(self, "scores") or self.scores is None:
+            self.scores = {}
         self.author_url = Purl.generate_author_data(self.author, self.ecosystem)
 
     @staticmethod
diff --git a/socketsecurity/core/messages.py b/socketsecurity/core/messages.py
index 2f1cf91..319e454 100644
--- a/socketsecurity/core/messages.py
+++ b/socketsecurity/core/messages.py
@@ -1179,12 +1179,27 @@ def score_to_badge(score):
                 score_percent = int(score * 100)  # Convert to integer percentage
                 return f"[![{score_percent}](https://github-app-statics.socket.dev/score-{score_percent}.svg)]({added.url})"
 
+            def get_score_for_badge(score_name: str) -> float:
+                scores = getattr(added, "scores", None)
+                if isinstance(scores, dict):
+                    raw_score = scores.get(score_name)
+                else:
+                    raw_score = getattr(scores, score_name, None) if scores is not None else None
+
+                if raw_score is None:
+                    return 1.0
+
+                score = float(raw_score)
+                if score > 1:
+                    score = score / 100
+                return max(0.0, min(score, 1.0))
+
             # Generate badges for each score type
-            supply_chain_risk_badge = score_to_badge(added.scores.get("supplyChain", 100))
-            vulnerability_badge = score_to_badge(added.scores.get("vulnerability", 100))
-            quality_badge = score_to_badge(added.scores.get("quality", 100))
-            maintenance_badge = score_to_badge(added.scores.get("maintenance", 100))
-            license_badge = score_to_badge(added.scores.get("license", 100))
+            supply_chain_risk_badge = score_to_badge(get_score_for_badge("supplyChain"))
+            vulnerability_badge = score_to_badge(get_score_for_badge("vulnerability"))
+            quality_badge = score_to_badge(get_score_for_badge("quality"))
+            maintenance_badge = score_to_badge(get_score_for_badge("maintenance"))
+            license_badge = score_to_badge(get_score_for_badge("license"))
 
             # Add the row for this package
             row = [
diff --git a/tests/unit/test_dependency_overview.py b/tests/unit/test_dependency_overview.py
new file mode 100644
index 0000000..3afb805
--- /dev/null
+++ b/tests/unit/test_dependency_overview.py
@@ -0,0 +1,67 @@
+from socketsecurity.core.classes import Diff, Package, Purl
+from socketsecurity.core.messages import Messages
+
+
+def _make_purl(name: str, scores) -> Purl:
+    return Purl(
+        id=f"pkg:npm/{name}@1.0.0",
+        name=name,
+        version="1.0.0",
+        ecosystem="npm",
+        direct=True,
+        introduced_by=[("direct", "package.json")],
+        author=["test-author"],
+        size=1000,
+        transitives=0,
+        url=f"https://socket.dev/npm/package/{name}/overview/1.0.0",
+        purl=f"pkg:npm/{name}@1.0.0",
+        scores=scores,
+    )
+
+
+def test_package_from_diff_artifact_normalizes_null_score():
+    package = Package.from_diff_artifact(
+        {
+            "id": "pkg:npm/example@1.0.0",
+            "name": "example",
+            "version": "1.0.0",
+            "type": "npm",
+            "diffType": "added",
+            "score": None,
+            "alerts": [],
+            "author": [],
+            "topLevelAncestors": [],
+            "direct": True,
+            "manifestFiles": [],
+        }
+    )
+
+    assert package.score == {}
+
+
+def test_dependency_overview_template_defaults_missing_or_null_scores(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+
+    diff = Diff(
+        id="test-diff",
+        diff_url="https://socket.dev/test-diff",
+        new_packages=[
+            _make_purl("missing-scores", None),
+            _make_purl(
+                "partial-scores",
+                {
+                    "supplyChain": 0.42,
+                    "vulnerability": None,
+                },
+            ),
+        ],
+        removed_packages=[],
+        new_alerts=[],
+    )
+
+    comment = Messages.dependency_overview_template(diff)
+
+    assert "Socket Security: Dependency Overview" in comment
+    assert "score-42.svg" in comment
+    assert "score-100.svg" in comment
+    assert "score-10000.svg" not in comment
diff --git a/uv.lock b/uv.lock
index cb5ff37..a90e6b2 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1155,20 +1155,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.32"
+version = "3.0.33"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/06/03/95800661041781428cc753aea65d8e1bc44d108f4be29c6a0815d18fcdd3/socketdev-3.0.32.tar.gz", hash = "sha256:89167632834dcf222877d599e68ed87a3a08e7abe171759f54490712ea8aa89a", size = 170997, upload-time = "2026-02-27T17:59:58.554Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/19/8c/b4608637bda66dd32cf9a421cee66e93d429f7445c8bd709032772e0f4ca/socketdev-3.0.33.tar.gz", hash = "sha256:704d672649f27390733cef4cbdad9ce8dc994794a4af56f77d2f2dc815bfe762", size = 172013, upload-time = "2026-04-24T17:02:48.616Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/81/5c/58fa24c442d2bb8b8cab926c89cd4fb2613f73a35556e385d9bdb00abb72/socketdev-3.0.32-py3-none-any.whl", hash = "sha256:6a22356dadf4741eb731593b1d5ed4d708769f945998723bbfd1b613b8c968cc", size = 66868, upload-time = "2026-02-27T17:59:56.896Z" },
+    { url = "https://files.pythonhosted.org/packages/07/78/4408ba21724ce0648e39bd17854b19186ab77f6baedbb8b98721d6dd287a/socketdev-3.0.33-py3-none-any.whl", hash = "sha256:642eebd0b01b884c6aba8b5264e749ff71310147104e8e8de02ab24e4eab5837", size = 66975, upload-time = "2026-04-24T17:02:46.439Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.84"
+version = "2.2.86"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1221,7 +1221,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.32,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.33,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 60219d351c3fe93bfcebcbc25128f413854aacc5 Mon Sep 17 00:00:00 2001
From: Ricky Reusser <572717+rreusser@users.noreply.github.com>
Date: Mon, 18 May 2026 17:39:50 -0400
Subject: [PATCH 46/80] Add bun and vlt lockfiles (#202)

* Add bun and vlt lockfiles

* Add bun.lockb

* Add unit tests for bun.lock, bun.lockb, and vlt-lock.json manifest matching

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Bump version to 2.2.87

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Add missing version refs

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
---
 pyproject.toml                        |  2 +-
 socketsecurity/__init__.py            |  2 +-
 socketsecurity/core/utils.py          | 11 ++++++-
 tests/core/test_has_manifest_files.py | 43 +++++++++++++++++++++++++++
 4 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 49bb294..50b0518 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.86"
+version = "2.2.88"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index c816fab..a7dcdfb 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.86'
+__version__ = '2.2.88'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/utils.py b/socketsecurity/core/utils.py
index 6e9fb09..9485ec8 100644
--- a/socketsecurity/core/utils.py
+++ b/socketsecurity/core/utils.py
@@ -38,6 +38,15 @@
         },
         "pnpm-workspace.yml": {
             "pattern": "pnpm-workspace.yml"
+        },
+        "bun.lock": {
+            "pattern": "bun.lock"
+        },
+        "bun.lockb": {
+            "pattern": "bun.lockb"
+        },
+        "vlt-lock.json": {
+            "pattern": "vlt-lock.json"
         }
     },
     "pypi": {
@@ -105,4 +114,4 @@
             "pattern": "packages.lock.json"
         }
     }
-}
\ No newline at end of file
+}
diff --git a/tests/core/test_has_manifest_files.py b/tests/core/test_has_manifest_files.py
index 150ffbd..228253f 100644
--- a/tests/core/test_has_manifest_files.py
+++ b/tests/core/test_has_manifest_files.py
@@ -1,6 +1,7 @@
 from unittest.mock import patch
 
 from socketsecurity.core import Core
+from socketsecurity.core.utils import socket_globs
 
 # Minimal patterns matching what the Socket API returns
 MOCK_PATTERNS = {
@@ -8,6 +9,9 @@
         "packagejson": {"pattern": "package.json"},
         "packagelockjson": {"pattern": "package-lock.json"},
         "yarnlock": {"pattern": "yarn.lock"},
+        "bunlock": {"pattern": "bun.lock"},
+        "bunlockb": {"pattern": "bun.lockb"},
+        "vltlockjson": {"pattern": "vlt-lock.json"},
     },
     "pypi": {
         "requirements": {"pattern": "*requirements.txt"},
@@ -66,3 +70,42 @@ def test_dot_slash_prefix_normalized(self, mock_patterns):
     def test_pom_xml_root(self, mock_patterns):
         core = Core.__new__(Core)
         assert core.has_manifest_files(["pom.xml"]) is True
+
+    def test_bun_lock_root(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["bun.lock"]) is True
+
+    def test_bun_lockb_root(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["bun.lockb"]) is True
+
+    def test_vlt_lock_json_root(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["vlt-lock.json"]) is True
+
+    def test_bun_lock_subdirectory(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["apps/web/bun.lock"]) is True
+
+
+@patch.object(Core, "get_supported_patterns", side_effect=RuntimeError("API unreachable"))
+@patch.object(Core, "__init__", lambda self, *a, **kw: None)
+class TestHasManifestFilesFallback:
+    """Exercises the socket_globs fallback path used when the Socket API is unreachable."""
+
+    def test_fallback_matches_bun_lock(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["bun.lock"]) is True
+
+    def test_fallback_matches_bun_lockb(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["bun.lockb"]) is True
+
+    def test_fallback_matches_vlt_lock_json(self, mock_patterns):
+        core = Core.__new__(Core)
+        assert core.has_manifest_files(["vlt-lock.json"]) is True
+
+    def test_fallback_patterns_dict_contains_new_entries(self, mock_patterns):
+        assert "bun.lock" in socket_globs["npm"]
+        assert "bun.lockb" in socket_globs["npm"]
+        assert "vlt-lock.json" in socket_globs["npm"]

From 0d19e64c0d3bdb6d0fc6d06387f37e79c3053fcb Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 20 May 2026 15:46:26 -0400
Subject: [PATCH 47/80] Fix uv lockfile sync + version incrementation checks
 (#204)

* update uv.lock to reflect new version

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update version check workflow to include uv.lock

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update python hooks to include uv sync

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* remove unused setup.py check from workflow

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* rev all versions to v2.2.89

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 .github/workflows/version-check.yml | 14 ++++++++++++-
 .hooks/sync_version.py              | 31 ++++++++++++++++++++++++++---
 pyproject.toml                      |  2 +-
 socketsecurity/__init__.py          |  2 +-
 uv.lock                             |  2 +-
 5 files changed, 44 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 5b9bda8..7c18905 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -4,8 +4,8 @@ on:
     types: [opened, synchronize, ready_for_review]
     paths:
       - 'socketsecurity/**'
-      - 'setup.py'
       - 'pyproject.toml'
+      - 'uv.lock'
 
 permissions:
   contents: read
@@ -46,6 +46,18 @@ jobs:
           print(f'✅ Version properly incremented from {main_ver} to {pr_ver}')
           "
 
+      - name: Require uv.lock update when pyproject changes
+        run: |
+          CHANGED_FILES="$(git diff --name-only origin/main...HEAD)"
+
+          if echo "$CHANGED_FILES" | grep -qx 'pyproject.toml'; then
+            if ! echo "$CHANGED_FILES" | grep -qx 'uv.lock'; then
+              echo "❌ pyproject.toml changed, but uv.lock was not updated."
+              echo "Run 'uv lock' and commit uv.lock with the version bump."
+              exit 1
+            fi
+          fi
+
       - name: Manage PR Comment
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
         if: always() && github.event.pull_request.head.repo.full_name == github.repository
diff --git a/.hooks/sync_version.py b/.hooks/sync_version.py
index f26dd76..4abf179 100644
--- a/.hooks/sync_version.py
+++ b/.hooks/sync_version.py
@@ -8,6 +8,7 @@
 
 INIT_FILE = pathlib.Path("socketsecurity/__init__.py")
 PYPROJECT_FILE = pathlib.Path("pyproject.toml")
+UV_LOCK_FILE = pathlib.Path("uv.lock")
 
 VERSION_PATTERN = re.compile(r"__version__\s*=\s*['\"]([^'\"]+)['\"]")
 PYPROJECT_PATTERN = re.compile(r'^version\s*=\s*".*"$', re.MULTILINE)
@@ -72,6 +73,21 @@ def inject_version(version: str):
         new_pyproject = re.sub(r"(\[project\])", rf"\1\nversion = \"{version}\"", pyproject)
     PYPROJECT_FILE.write_text(new_pyproject)
 
+
+def run_uv_lock() -> bool:
+    before = UV_LOCK_FILE.read_bytes() if UV_LOCK_FILE.exists() else b""
+    try:
+        subprocess.run(["uv", "lock"], check=True, text=True)
+    except FileNotFoundError:
+        print("❌ `uv` is required but was not found in PATH.")
+        sys.exit(1)
+    except subprocess.CalledProcessError:
+        print("❌ `uv lock` failed. Please run it manually and fix any errors.")
+        sys.exit(1)
+
+    after = UV_LOCK_FILE.read_bytes() if UV_LOCK_FILE.exists() else b""
+    return before != after
+
 def main():
     dev_mode = "--dev" in sys.argv
     current_version = read_version_from_init(INIT_FILE)
@@ -84,15 +100,24 @@ def main():
             base_version = current_version.split(".dev")[0] if ".dev" in current_version else current_version
             new_version = find_next_available_dev_version(base_version)
             inject_version(new_version)
-            print("⚠️ Version was unchanged — auto-bumped. Please git add + commit again.")
+            uv_lock_changed = run_uv_lock()
+            lock_hint = " and uv.lock" if uv_lock_changed else ""
+            print(f"⚠️ Version was unchanged — auto-bumped. Please git add{lock_hint} + commit again.")
             sys.exit(0)
         else:
             new_version = bump_patch_version(current_version)
             inject_version(new_version)
-            print("⚠️ Version was unchanged — auto-bumped. Please git add + commit again.")
+            uv_lock_changed = run_uv_lock()
+            lock_hint = " and uv.lock" if uv_lock_changed else ""
+            print(f"⚠️ Version was unchanged — auto-bumped. Please git add{lock_hint} + commit again.")
             sys.exit(1)
     else:
-        print("✅ Version already bumped — proceeding.")
+        uv_lock_changed = run_uv_lock()
+        if uv_lock_changed:
+            print("⚠️ Version already bumped, but uv.lock was out of date and has been updated. Please git add uv.lock + commit again.")
+            sys.exit(1)
+
+        print("✅ Version already bumped and uv.lock is up to date — proceeding.")
         sys.exit(0)
 
 if __name__ == "__main__":
diff --git a/pyproject.toml b/pyproject.toml
index 50b0518..4b7f380 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.88"
+version = "2.2.89"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index a7dcdfb..9547cf5 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.88'
+__version__ = '2.2.89'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index a90e6b2..3266b98 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.86"
+version = "2.2.89"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 0445421dd12f46a8f44fc0c7684e15e944a7b642 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Thu, 21 May 2026 14:54:51 -0400
Subject: [PATCH 48/80] Migrate license enrichment to org-scoped endpoint
 (#180)

* Backfill changelog for v2.2.74+ releases

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Migrate license enrichment to org-scoped endpoint

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Fix github project homepage on PyPI

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Bump version for release

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Properly bump version

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* bump SDK version to stage CLI release

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix e2e reachability tests, respect --disable-blocking when set

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* document --disable-blocking exit behavior

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Eric Hibbs <eric@socket.dev>
---
 .gitignore                            |  2 +
 CHANGELOG.md                          | 39 +++++++++++++++++++
 docs/cli-reference.md                 |  2 +-
 pyproject.toml                        |  6 +--
 socketsecurity/__init__.py            |  2 +-
 socketsecurity/config.py              |  6 ++-
 socketsecurity/core/__init__.py       |  5 +++
 tests/core/test_package_and_alerts.py | 39 ++++++++++++++++++-
 tests/e2e/validate-reachability.sh    | 54 +++++++++++++++++----------
 uv.lock                               | 10 ++---
 10 files changed, 134 insertions(+), 31 deletions(-)

diff --git a/.gitignore b/.gitignore
index e01bafe..990cbcc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,8 @@ test.py
 *.cpython-312.pyc`
 file_generator.py
 .coverage
+.coverage.*
+htmlcov/
 .env.local
 Pipfile
 test/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2ea6c0..8ab4d97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,9 +1,48 @@
 # Changelog
 
+## 2.2.90
+
+- Migrated license enrichment PURL lookup to the org-scoped endpoint (`POST /v0/orgs/{slug}/purl`) from the deprecated global endpoint (`POST /v0/purl`).
+
 ## 2.2.83
 
 - Fixed branch detection in detached-HEAD CI checkouts. When `git name-rev --name-only HEAD` returned an output with a suffix operator (e.g. `remotes/origin/master~1`, `master^0`), the `~N`/`^N` was previously passed through as the branch name and rejected by the Socket API as an invalid Git ref. The suffix is now stripped before the prefix split, producing the bare branch name.
 
+## 2.2.80
+
+- Hardened GitHub Actions workflows.
+- Fixed broken links on PyPI page.
+
+## 2.2.79
+
+- Updated minimum required Python version.
+- Tweaked CI checks.
+
+## 2.2.78
+
+- Fixed reachability filtering.
+- Added config file support.
+
+## 2.2.77
+
+- Fixed `has_manifest_files` failing to match root-level manifest files.
+
+## 2.2.76
+
+- Added SARIF file output support.
+- Improved reachability filtering.
+
+## 2.2.75
+
+- Fixed `workspace` flag regression by updating SDK dependency.
+
+## 2.2.74
+
+- Added `--workspace` flag to CLI args.
+- Added GitLab branch protection flag.
+- Added e2e tests for full scans and full scans with reachability.
+- Bumped dependencies: `cryptography`, `virtualenv`, `filelock`, `urllib3`.
+
 ## 2.2.71
 
 - Added `strace` to the Docker image for debugging purposes.
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index bef8a5a..c26c3a4 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -305,7 +305,7 @@ The CLI will automatically install `@coana-tech/cli` if not present. Use `--reac
 | Parameter                | Required | Default | Description                                                           |
 |:-------------------------|:---------|:--------|:----------------------------------------------------------------------|
 | `--ignore-commit-files`    | False    | False   | Ignore commit files                                                   |
-| `--disable-blocking`       | False    | False   | Disable blocking mode                                                 |
+| `--disable-blocking`       | False    | False   | Non-blocking CI mode: the CLI always exits **0**, even when blocking alerts are present (including with `--strict-blocking`). Also exits 0 on uncaught runtime errors and Socket API failures, so the job is treated as successful while findings and errors are still logged. Takes precedence over `--strict-blocking`. |
 | `--disable-ignore`         | False    | False   | Disable support for `@SocketSecurity ignore` commands in PR comments. When set, alerts cannot be suppressed via comments and ignore instructions are hidden from comment output. |
 | `--strict-blocking`        | False    | False   | Fail on ANY security policy violations (blocking severity), not just new ones. Only works in diff mode. See [Strict Blocking Mode](#strict-blocking-mode) for details. |
 | `--enable-diff`            | False    | False   | Enable diff mode even when using `--integration api` (forces diff mode without SCM integration) |
diff --git a/pyproject.toml b/pyproject.toml
index 4b7f380..81b9d87 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.89"
+version = "2.2.90"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.33,<4.0.0",
+    "socketdev>=3.1.0,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
@@ -57,7 +57,7 @@ socketcli = "socketsecurity.socketcli:cli"
 socketclidev = "socketsecurity.socketcli:cli"
 
 [project.urls]
-Homepage = "https://socket.dev"
+Homepage = "https://github.com/SocketDev/socket-python-cli"
 
 [tool.coverage.run]
 source = ["socketsecurity"]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 9547cf5..90049de 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.89'
+__version__ = '2.2.90'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 1d18c6a..1e2717c 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -695,7 +695,11 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--disable-blocking",
         dest="disable_blocking",
         action="store_true",
-        help="Disable blocking mode"
+        help=(
+            "Non-blocking CI mode: always exit 0, even when blocking alerts are present "
+            "(including with --strict-blocking), on uncaught errors, or on Socket API failures. "
+            "Findings and errors are still logged. Overrides --strict-blocking."
+        ),
     )
     advanced_group.add_argument(
         "--disable_blocking",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index daaa9a8..0a6b827 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -898,6 +898,7 @@ def get_license_text_via_purl(self, packages: dict[str, Package], batch_size: in
             results = self.sdk.purl.post(
                 license=True,
                 components=batch_components,
+                org_slug=self.config.org_slug,
                 licenseattrib=True,
                 licensedetails=True
             )
@@ -946,6 +947,8 @@ def get_added_and_removed_packages(
             )
         except APIFailure as e:
             log.error(f"API Error: {e}")
+            if self.cli_config and self.cli_config.disable_blocking:
+                sys.exit(0)
             sys.exit(1)
         except Exception as e:
             import traceback
@@ -1123,6 +1126,8 @@ def create_new_diff(
                     os.unlink(temp_file)
                 except OSError:
                     pass
+            if self.cli_config and self.cli_config.disable_blocking:
+                sys.exit(0)
             sys.exit(1)
         except Exception as e:
             import traceback
diff --git a/tests/core/test_package_and_alerts.py b/tests/core/test_package_and_alerts.py
index 09a8455..f616479 100644
--- a/tests/core/test_package_and_alerts.py
+++ b/tests/core/test_package_and_alerts.py
@@ -228,4 +228,41 @@ def test_get_new_alerts_with_readded(self):
         
         # With ignore_readded=False
         new_alerts = Core.get_new_alerts(added_alerts, removed_alerts, ignore_readded=False)
-        assert len(new_alerts) == 1 
+        assert len(new_alerts) == 1
+
+    def test_get_license_text_via_purl_uses_org_scoped_endpoint(self, core, mock_sdk):
+        """Test license enrichment calls the org-scoped PURL SDK method."""
+        core.sdk.purl = Mock()
+        core.sdk.purl.post.return_value = [
+            {
+                "type": "npm",
+                "name": "lodash",
+                "version": "4.18.1",
+                "licenseAttrib": [{"name": "MIT"}],
+                "licenseDetails": [{"license": "MIT"}],
+            }
+        ]
+
+        packages = {
+            "npm/lodash@4.18.1": Package(
+                id="pkg:npm/lodash@4.18.1",
+                type="npm",
+                name="lodash",
+                version="4.18.1",
+                score={},
+                alerts=[],
+                topLevelAncestors=[],
+            )
+        }
+
+        result = core.get_license_text_via_purl(packages)
+
+        core.sdk.purl.post.assert_called_once_with(
+            license=True,
+            components=[{"purl": "pkg:/npm/lodash@4.18.1"}],
+            org_slug="test-org",
+            licenseattrib=True,
+            licensedetails=True,
+        )
+        assert result["npm/lodash@4.18.1"].licenseAttrib == [{"name": "MIT"}]
+        assert result["npm/lodash@4.18.1"].licenseDetails == [{"license": "MIT"}]
diff --git a/tests/e2e/validate-reachability.sh b/tests/e2e/validate-reachability.sh
index e6e365e..e32f004 100755
--- a/tests/e2e/validate-reachability.sh
+++ b/tests/e2e/validate-reachability.sh
@@ -27,31 +27,47 @@ else
   exit 1
 fi
 
-# 3. Run SARIF with --sarif-reachability all
-socketcli \
-  --target-path tests/e2e/fixtures/simple-npm \
-  --reach \
-  --sarif-file /tmp/sarif-all.sarif \
-  --sarif-scope full \
-  --sarif-reachability all \
-  --disable-blocking \
-  2>/dev/null
+FACTS_PATH="tests/e2e/fixtures/simple-npm/.socket.facts.json"
+if [ ! -f "$FACTS_PATH" ]; then
+  echo "FAIL: Expected reachability facts at $FACTS_PATH after initial scan"
+  exit 1
+fi
+echo "PASS: Reachability facts file present at $FACTS_PATH"
+
+# 3-4. Build SARIF from the facts file produced by the initial --reach run.
+# Avoid re-running reach + full scan here; duplicate API scans are slow and flaky in CI.
+uv run python -c "
+import json
+from pathlib import Path
 
-# 4. Run SARIF with --sarif-reachability reachable (filtered)
-socketcli \
-  --target-path tests/e2e/fixtures/simple-npm \
-  --reach \
-  --sarif-file /tmp/sarif-reachable.sarif \
-  --sarif-scope full \
-  --sarif-reachability reachable \
-  --disable-blocking \
-  2>/dev/null
+from socketsecurity.core.alert_selection import load_components_with_alerts
+from socketsecurity.core.messages import Messages
+
+target = 'tests/e2e/fixtures/simple-npm'
+facts_file = '.socket.facts.json'
+components = load_components_with_alerts(target, facts_file)
+if not components:
+    raise SystemExit('FAIL: no components with alerts in .socket.facts.json')
+
+for outfile, reach_filter in [
+    ('/tmp/sarif-all.sarif', 'all'),
+    ('/tmp/sarif-reachable.sarif', 'reachable'),
+]:
+    sarif = Messages.create_security_comment_sarif_from_facts(
+        components,
+        reachability_filter=reach_filter,
+        grouping='instance',
+    )
+    Path(outfile).write_text(json.dumps(sarif, indent=2))
+    count = len(sarif['runs'][0]['results'])
+    print(f'PASS: Wrote {outfile} ({count} results, filter={reach_filter})')
+"
 
 # 5. Verify reachable-only results are a subset of all results
 test -f /tmp/sarif-all.sarif
 test -f /tmp/sarif-reachable.sarif
 
-python3 -c "
+uv run python -c "
 import json
 with open('/tmp/sarif-all.sarif') as f:
     all_data = json.load(f)
diff --git a/uv.lock b/uv.lock
index 3266b98..ec4b94f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1155,20 +1155,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.0.33"
+version = "3.1.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/19/8c/b4608637bda66dd32cf9a421cee66e93d429f7445c8bd709032772e0f4ca/socketdev-3.0.33.tar.gz", hash = "sha256:704d672649f27390733cef4cbdad9ce8dc994794a4af56f77d2f2dc815bfe762", size = 172013, upload-time = "2026-04-24T17:02:48.616Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/95/3e/50f05942e23d12043028d71c0e502c0d02c470686afc3dfbab0d1931e5c1/socketdev-3.1.0.tar.gz", hash = "sha256:a9534189d50c9f6c39e802280cc2317f830dd0c9970677e8cde843a69daa84ed", size = 172581, upload-time = "2026-05-21T17:14:03.607Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/07/78/4408ba21724ce0648e39bd17854b19186ab77f6baedbb8b98721d6dd287a/socketdev-3.0.33-py3-none-any.whl", hash = "sha256:642eebd0b01b884c6aba8b5264e749ff71310147104e8e8de02ab24e4eab5837", size = 66975, upload-time = "2026-04-24T17:02:46.439Z" },
+    { url = "https://files.pythonhosted.org/packages/df/76/4fb37245468dd9c67137059ce6833db97d76c808bf0d10397f1b5a2943d1/socketdev-3.1.0-py3-none-any.whl", hash = "sha256:e9245916d423952aba4f0018bea2bca28740530ec30308089c48dddb2133e38a", size = 67255, upload-time = "2026-05-21T17:14:01.873Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.89"
+version = "2.2.90"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1221,7 +1221,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.33,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.1.0,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From d502ab36556bdc685bd3426d65f8447586796dcc Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 29 May 2026 16:35:40 -0400
Subject: [PATCH 49/80] Add legal artifact presets, FOSSA-compatible outputs
 (#199)

* add legal presets, file-based compliance artifacts

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* add unit test coverage for new config defaults and outputs

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* document legal preset flag and default artifacts

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update lockfile

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* bump version to pass checks

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update lockfile to match new version

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* handle missing SBOM and package data in legal artifacts

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update tests to check for missing data issues

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* add opt-in FOSSA-compatible legal artifact mode

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* cover FOSSA-compatible legal outputs/sample scenarios

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update README docs to include FOSSA compatibility mode

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* bump version for release

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* update uv lockfile version

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix compatibility unit tests

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* bump version for release

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix version check sync logic to check pypi properly

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* test: add FOSSA reference fixtures and parity harness

* fix: emit fossa project.id as <locator>\$<revision>

Real FOSSA artifacts use \$ as the revision separator in project.id, not
\-. Update _build_project_metadata and add two tests that pin the correct
separator and fallback behaviour.

* test: lock fossa analyze top-level keyset invariants

* fix: source vulnerability version ranges from Socket field names

* fix: emit consistent defaults for FOSSA fields with no Socket source

Adds customRiskScore: None to vulnerability entries (FOSSA samples
include this field, sometimes null). Documents all gap fields and their
defaults in the module docstring. Locks the new key in EXPECTED_VULNERABILITY_KEYS.

* feat: reshape fossa-sbom.json to 5-key attribution top-level

Replaces the 2-key {project, dependencies} shape with the real FOSSA
attribution shape: copyrightsByLicense, deepDependencies,
directDependencies, licenses, project.

The SBOM project field is now the 2-key {name, revision} subset rather
than the 6-key analyze project shape. _partition_dependencies is a stub
returning ([], []) until Tasks 7-9 fill in per-dependency entries.

* feat: build FOSSA-shape Dependency entries with attribution text

Add _build_dependency_entry and _build_dependency_licenses to produce
the 14-key per-dependency dict that matches real FOSSA attribution
output. License entries prefer licenseAttrib (full attribText + spdxExpr),
fall back to declared license string, or emit [] when unlicensed.

Also removes the stale test_fossa_attribution_payload_shape_is_stable
test, which asserted the pre-Task-6 two-key shape and was already
failing.

* feat: partition SBOM dependencies into direct and deep

* feat: compute SBOM dependencyPaths from topLevelAncestors

Replaces the stub that always returned [package.name] with real logic:
direct deps emit just their name; transitive deps emit one
"<ancestor> > <package>" chain per top-level ancestor, falling back to
name-only when ancestors are absent or not in the lookup.

* fix: write fossa-sbom.json with indent=2 for consistency

* test: assert structural parity against real FOSSA fixtures

* test: update legacy FOSSA-shape assertions for wrapper parity

Pin project.id to dollar separator, replace 2-key SBOM with 5-key
shape, and update per-dependency assertions to the 14-key
_build_dependency_entry contract.

* docs: document partialFix/completeFix collapse and otherLicenses gap

* style: apply ruff --fix to touched files

* fix: always include unchanged alerts in FOSSA output

FOSSA's /api/v2/issues endpoint returns a point-in-time snapshot of all
issues at the scan revision, not only diff-new ones. The previous
implementation only included unchanged alerts when --strict-blocking
was set, causing FOSSA-mode output to under-represent project-wide
findings compared to the typical FOSSA pipeline.

* test: sanitize customer references in FOSSA reference fixtures

Replace customer org ID and project name with generic placeholders
(1234/example-validation-project) across all four fixtures and the README.
Structural shape, key sets, value types, and per-field cardinality are
unchanged. Parity tests assert keysets only, so the substitution is
transparent to test behavior.

* docs: correct README description of FOSSA SBOM shape

The SBOM artifact now matches FOSSA's `report --json attribution`
shape with five top-level keys, not the previously documented
`project` / `dependencies` two-key payload.

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
Co-authored-by: Eric Hibbs <eric@socket.dev>
---
 .github/workflows/version-check.yml           |   45 +-
 .hooks/sync_version.py                        |   63 +-
 README.md                                     |   30 +
 pyproject.toml                                |    6 +-
 socketsecurity/__init__.py                    |    2 +-
 socketsecurity/config.py                      |   70 +
 socketsecurity/fossa_compat.py                |  459 ++++++
 socketsecurity/output.py                      |  153 +-
 socketsecurity/socketcli.py                   |   67 +-
 tests/fixtures/fossa/README.md                |   18 +
 tests/fixtures/fossa/fossa-analyze-empty.json |   13 +
 .../fossa/fossa-analyze-populated.json        | 1275 +++++++++++++++++
 .../fixtures/fossa/fossa-sbom-empty-deep.json |    1 +
 .../fixtures/fossa/fossa-sbom-populated.json  |    1 +
 tests/unit/test_cli_config.py                 |   49 +-
 tests/unit/test_fossa_compat.py               |  470 ++++++
 tests/unit/test_fossa_parity.py               |  106 ++
 tests/unit/test_output.py                     |  289 +++-
 tests/unit/test_socketcli.py                  |  134 ++
 uv.lock                                       |    4 +-
 20 files changed, 3140 insertions(+), 115 deletions(-)
 create mode 100644 socketsecurity/fossa_compat.py
 create mode 100644 tests/fixtures/fossa/README.md
 create mode 100644 tests/fixtures/fossa/fossa-analyze-empty.json
 create mode 100644 tests/fixtures/fossa/fossa-analyze-populated.json
 create mode 100644 tests/fixtures/fossa/fossa-sbom-empty-deep.json
 create mode 100644 tests/fixtures/fossa/fossa-sbom-populated.json
 create mode 100644 tests/unit/test_fossa_compat.py
 create mode 100644 tests/unit/test_fossa_parity.py
 create mode 100644 tests/unit/test_socketcli.py

diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 7c18905..1eefa27 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -35,16 +35,43 @@ jobs:
           MAIN_VERSION=$(git show origin/main:socketsecurity/__init__.py | grep -o "__version__.*" | awk '{print $3}' | tr -d "'")
           echo "MAIN_VERSION=$MAIN_VERSION" >> $GITHUB_ENV
 
-          # Compare versions using Python
-          python3 -c "
+          export PR_VERSION
+          export MAIN_VERSION
+
+          # Compare against both main and latest published PyPI release.
+          python3 <<'PY'
+          import json
+          import os
+          import urllib.request
           from packaging import version
-          pr_ver = version.parse('${PR_VERSION}')
-          main_ver = version.parse('${MAIN_VERSION}')
-          if pr_ver <= main_ver:
-              print(f'❌ Version must be incremented! Main: {main_ver}, PR: {pr_ver}')
-              exit(1)
-          print(f'✅ Version properly incremented from {main_ver} to {pr_ver}')
-          "
+
+          pr_ver = version.parse(os.environ["PR_VERSION"])
+          main_ver = version.parse(os.environ["MAIN_VERSION"])
+
+          with urllib.request.urlopen("https://pypi.org/pypi/socketsecurity/json") as response:
+              pypi_data = json.load(response)
+
+          published_versions = []
+          for raw in pypi_data.get("releases", {}).keys():
+              parsed = version.parse(raw)
+              if not parsed.is_prerelease and not parsed.is_devrelease:
+                  published_versions.append(parsed)
+
+          pypi_ver = max(published_versions) if published_versions else version.parse("0.0.0")
+          required_floor = max(main_ver, pypi_ver)
+
+          if pr_ver <= required_floor:
+              print(
+                  f"❌ Version must be greater than main and PyPI! "
+                  f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
+              )
+              raise SystemExit(1)
+
+          print(
+              f"✅ Version properly incremented. "
+              f"Main: {main_ver}, PyPI: {pypi_ver}, PR: {pr_ver}"
+          )
+          PY
 
       - name: Require uv.lock update when pyproject changes
         run: |
diff --git a/.hooks/sync_version.py b/.hooks/sync_version.py
index 4abf179..57b29d3 100644
--- a/.hooks/sync_version.py
+++ b/.hooks/sync_version.py
@@ -12,7 +12,9 @@
 
 VERSION_PATTERN = re.compile(r"__version__\s*=\s*['\"]([^'\"]+)['\"]")
 PYPROJECT_PATTERN = re.compile(r'^version\s*=\s*".*"$', re.MULTILINE)
-PYPI_API = "https://test.pypi.org/pypi/socketsecurity/json"
+STABLE_VERSION_PATTERN = re.compile(r"^\d+\.\d+\.\d+$")
+PYPI_PROD_API = "https://pypi.org/pypi/socketsecurity/json"
+PYPI_TEST_API = "https://test.pypi.org/pypi/socketsecurity/json"
 
 def read_version_from_init(path: pathlib.Path) -> str:
     content = path.read_text()
@@ -39,17 +41,39 @@ def bump_patch_version(version: str) -> str:
     parts[-1] = str(int(parts[-1]) + 1)
     return ".".join(parts)
 
-def fetch_existing_versions() -> set:
+def parse_stable_version(version: str):
+    if not STABLE_VERSION_PATTERN.fullmatch(version):
+        return None
+    return tuple(int(part) for part in version.split("."))
+
+
+def format_stable_version(version_parts) -> str:
+    return ".".join(str(part) for part in version_parts)
+
+
+def fetch_existing_versions(api_url: str) -> set:
     try:
-        with urllib.request.urlopen(PYPI_API) as response:
+        with urllib.request.urlopen(api_url) as response:
             data = json.load(response)
             return set(data.get("releases", {}).keys())
     except Exception as e:
-        print(f"⚠️ Warning: Failed to fetch existing versions from Test PyPI: {e}")
+        print(f"⚠️ Warning: Failed to fetch versions from {api_url}: {e}")
         return set()
 
+
+def fetch_latest_stable_pypi_version():
+    versions = fetch_existing_versions(PYPI_PROD_API)
+    stable_versions = []
+    for ver in versions:
+        parsed = parse_stable_version(ver)
+        if parsed is not None:
+            stable_versions.append(parsed)
+    if not stable_versions:
+        return None
+    return max(stable_versions)
+
 def find_next_available_dev_version(base_version: str) -> str:
-    existing_versions = fetch_existing_versions()
+    existing_versions = fetch_existing_versions(PYPI_TEST_API)
     for i in range(1, 100):
         candidate = f"{base_version}.dev{i}"
         if candidate not in existing_versions:
@@ -57,6 +81,19 @@ def find_next_available_dev_version(base_version: str) -> str:
     print("❌ Could not find available .devN slot after 100 attempts.")
     sys.exit(1)
 
+
+def find_next_stable_patch_version(current_version: str) -> str:
+    current_stable = current_version.split(".dev")[0] if ".dev" in current_version else current_version
+    current_parts = parse_stable_version(current_stable)
+    if current_parts is None:
+        print(f"❌ Unsupported version format for stable bump: {current_version}")
+        sys.exit(1)
+
+    latest_pypi_parts = fetch_latest_stable_pypi_version()
+    base_parts = max([current_parts, latest_pypi_parts] if latest_pypi_parts else [current_parts])
+    next_parts = (base_parts[0], base_parts[1], base_parts[2] + 1)
+    return format_stable_version(next_parts)
+
 def inject_version(version: str):
     print(f"🔁 Updating version to: {version}")
 
@@ -105,13 +142,25 @@ def main():
             print(f"⚠️ Version was unchanged — auto-bumped. Please git add{lock_hint} + commit again.")
             sys.exit(0)
         else:
-            new_version = bump_patch_version(current_version)
+            new_version = find_next_stable_patch_version(current_version)
             inject_version(new_version)
             uv_lock_changed = run_uv_lock()
             lock_hint = " and uv.lock" if uv_lock_changed else ""
-            print(f"⚠️ Version was unchanged — auto-bumped. Please git add{lock_hint} + commit again.")
+            print(f"⚠️ Version was unchanged — auto-bumped to {new_version}. Please git add{lock_hint} + commit again.")
             sys.exit(1)
     else:
+        if not dev_mode:
+            current_parts = parse_stable_version(current_version)
+            latest_pypi_parts = fetch_latest_stable_pypi_version()
+            if current_parts is not None and latest_pypi_parts is not None and current_parts <= latest_pypi_parts:
+                next_parts = (latest_pypi_parts[0], latest_pypi_parts[1], latest_pypi_parts[2] + 1)
+                new_version = format_stable_version(next_parts)
+                inject_version(new_version)
+                uv_lock_changed = run_uv_lock()
+                lock_hint = " and uv.lock" if uv_lock_changed else ""
+                print(f"⚠️ Version {current_version} is already published on PyPI — auto-bumped to {new_version}. Please git add{lock_hint} + commit again.")
+                sys.exit(1)
+
         uv_lock_changed = run_uv_lock()
         if uv_lock_changed:
             print("⚠️ Version already bumped, but uv.lock was out of date and has been updated. Please git add uv.lock + commit again.")
diff --git a/README.md b/README.md
index 7929189..66f042c 100644
--- a/README.md
+++ b/README.md
@@ -84,6 +84,7 @@ socketcli \
 | Use case | Recommended mode | Key flags |
 |:--|:--|:--|
 | Basic policy enforcement in CI | Diff-based policy check | `--strict-blocking` |
+| Legal/compliance artifact generation | Legal preset | `--legal` |
 | Reachable-focused SARIF for reporting | Full-scope grouped SARIF | `--reach --sarif-scope full --sarif-grouping alert --sarif-reachability reachable --sarif-file <path>` |
 | Detailed reachability export for investigations | Full-scope instance SARIF | `--reach --sarif-scope full --sarif-grouping instance --sarif-reachability all --sarif-file <path>` |
 | Net-new PR findings only | Diff-scope SARIF | `--reach --sarif-scope diff --sarif-reachability reachable --sarif-file <path>` |
@@ -134,6 +135,35 @@ Run:
 socketcli --config .socketcli.toml --target-path .
 ```
 
+Legal/compliance preset example:
+
+```bash
+socketcli --legal --target-path .
+```
+
+This preset enables license generation and writes default artifacts unless you override them:
+- `socket-report.json`
+- `socket-summary.txt`
+- `socket-report-link.txt`
+- `socket-sbom.json`
+- `socket-license.json`
+
+FOSSA-compatibility shaped legal artifacts:
+
+```bash
+socketcli --legal-format fossa --target-path .
+```
+
+This switches the JSON report and legal artifact payloads to FOSSA-style compatibility shapes:
+- the analyze artifact becomes a `project` / `vulnerability` / `licensing` / `quality` report
+- the SBOM artifact becomes a FOSSA-attribution-style payload with `copyrightsByLicense`, `deepDependencies`, `directDependencies`, `licenses`, and `project` keys
+
+When `--legal-format fossa` is used without explicit output paths, the defaults are closer to the FOSSA pipeline contract:
+- `fossa-analyze.json`
+- `fossa-test.txt`
+- `fossa-link.txt`
+- `fossa-sbom.json`
+
 Reference sample configs:
 
 TOML:
diff --git a/pyproject.toml b/pyproject.toml
index 81b9d87..137b98d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.90"
+version = "2.2.91"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.1.0,<4.0.0",
+    "socketdev>=3.0.33,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
 ]
@@ -57,7 +57,7 @@ socketcli = "socketsecurity.socketcli:cli"
 socketclidev = "socketsecurity.socketcli:cli"
 
 [project.urls]
-Homepage = "https://github.com/SocketDev/socket-python-cli"
+Homepage = "https://socket.dev"
 
 [tool.coverage.run]
 source = ["socketsecurity"]
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 90049de..7fdf737 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.90'
+__version__ = '2.2.91'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 1e2717c..c048af2 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -79,6 +79,7 @@ class CliConfig:
     enable_debug: bool = False
     allow_unverified: bool = False
     enable_json: bool = False
+    json_file: Optional[str] = None
     enable_sarif: bool = False
     sarif_file: Optional[str] = None
     sarif_scope: str = "diff"
@@ -86,6 +87,8 @@ class CliConfig:
     sarif_reachability: str = "all"
     enable_gitlab_security: bool = False
     gitlab_security_file: Optional[str] = None
+    summary_file: Optional[str] = None
+    report_link_file: Optional[str] = None
     disable_overview: bool = False
     disable_security_issue: bool = False
     files: str = None
@@ -137,6 +140,8 @@ class CliConfig:
     reach_continue_on_no_source_files: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
+    legal: bool = False
+    legal_format: str = "socket"
     config_file: Optional[str] = None
     
     @classmethod
@@ -194,6 +199,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'enable_diff': args.enable_diff,
             'allow_unverified': args.allow_unverified,
             'enable_json': args.enable_json,
+            'json_file': args.json_file,
             'enable_sarif': args.enable_sarif,
             'sarif_file': args.sarif_file,
             'sarif_scope': args.sarif_scope,
@@ -201,6 +207,8 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'sarif_reachability': args.sarif_reachability,
             'enable_gitlab_security': args.enable_gitlab_security,
             'gitlab_security_file': args.gitlab_security_file,
+            'summary_file': args.summary_file,
+            'report_link_file': args.report_link_file,
             'disable_overview': args.disable_overview,
             'disable_security_issue': args.disable_security_issue,
             'files': args.files,
@@ -246,9 +254,40 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
+            'legal': args.legal or args.legal_format == "fossa",
+            'legal_format': args.legal_format,
             'config_file': args.config_file,
             'version': __version__
         }
+
+        if config_args['legal']:
+            config_args['generate_license'] = True
+            if not config_args['json_file']:
+                config_args['json_file'] = "socket-report.json"
+            if not config_args['summary_file']:
+                config_args['summary_file'] = "socket-summary.txt"
+            if not config_args['report_link_file']:
+                config_args['report_link_file'] = "socket-report-link.txt"
+            if not config_args['sbom_file']:
+                config_args['sbom_file'] = "socket-sbom.json"
+            if config_args['license_file_name'] == "license_output.json":
+                config_args['license_file_name'] = "socket-license.json"
+
+        if config_args['legal_format'] == "fossa":
+            if not args.json_file:
+                config_args['json_file'] = "fossa-analyze.json"
+            if not args.summary_file:
+                config_args['summary_file'] = "fossa-test.txt"
+            if not args.report_link_file:
+                config_args['report_link_file'] = "fossa-link.txt"
+            if not args.license_file_name:
+                # argparse always provides a default, so this branch is defensive only
+                config_args['license_file_name'] = "fossa-sbom.json"
+            elif args.license_file_name == "license_output.json":
+                config_args['license_file_name'] = "fossa-sbom.json"
+            if not args.sbom_file:
+                # FOSSA's "SBOM" artifact is the attribution payload; suppress the extra Socket-only SBOM file by default.
+                config_args['sbom_file'] = None
         excluded_ecosystems = config_args["excluded_ecosystems"]
         if isinstance(excluded_ecosystems, list):
             config_args["excluded_ecosystems"] = excluded_ecosystems
@@ -570,6 +609,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Output in JSON format"
     )
+    output_group.add_argument(
+        "--json-file",
+        dest="json_file",
+        metavar="<path>",
+        help="Output file path for JSON report"
+    )
     output_group.add_argument(
         "--enable-sarif",
         dest="enable_sarif",
@@ -617,6 +662,18 @@ def create_argument_parser() -> argparse.ArgumentParser:
         default="gl-dependency-scanning-report.json",
         help="Output file path for GitLab Security report (default: gl-dependency-scanning-report.json)"
     )
+    output_group.add_argument(
+        "--summary-file",
+        dest="summary_file",
+        metavar="<path>",
+        help="Output file path for a plain-text summary report"
+    )
+    output_group.add_argument(
+        "--report-link-file",
+        dest="report_link_file",
+        metavar="<path>",
+        help="Output file path for the Socket report link"
+    )
     output_group.add_argument(
         "--disable-overview",
         dest="disable_overview",
@@ -750,6 +807,19 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help="Disable SSL certificate verification for API requests"
     )
+    advanced_group.add_argument(
+        "--legal",
+        dest="legal",
+        action="store_true",
+        help="Enable legal/compliance-friendly defaults and file outputs"
+    )
+    advanced_group.add_argument(
+        "--legal-format",
+        dest="legal_format",
+        choices=["socket", "fossa"],
+        default="socket",
+        help="Select the legal artifact format. 'socket' keeps Socket-native outputs; 'fossa' emits compatibility-shaped JSON artifacts."
+    )
     config_group.add_argument(
         "--include-module-folders",
         dest="include_module_folders",
diff --git a/socketsecurity/fossa_compat.py b/socketsecurity/fossa_compat.py
new file mode 100644
index 0000000..0be11a9
--- /dev/null
+++ b/socketsecurity/fossa_compat.py
@@ -0,0 +1,459 @@
+"""FOSSA-compat output shaping for `--legal-format fossa`.
+
+Builds two artifacts whose top-level shapes mirror real FOSSA pipeline outputs:
+
+  fossa-analyze.json  — wrapper of {project, vulnerability, licensing, quality},
+                        where `project` is the raw `fossa analyze --json` shape and
+                        the three arrays are FOSSA /api/v2/issues-shaped items.
+  fossa-sbom.json     — `fossa report --json attribution` shape: 5 top-level keys
+                        (copyrightsByLicense, deepDependencies, directDependencies,
+                        licenses, project).
+
+Fields without a Socket data source are emitted as documented defaults:
+
+  vulnerability[]:
+    epss               -> {score: None, percentile: None}
+    cvssVector         -> None
+    exploitability     -> None
+    cveStatus          -> None
+    published          -> None
+    containerLayers    -> {base: 0, other: 0}
+    customRiskScore    -> None
+    remediation.partialFixDistance, completeFixDistance -> None  (semver-distance TBD)
+    remediation.partialFix, completeFix                 -> same Socket fix version
+                                                           (Socket has no partial/complete distinction)
+    projects[].scannedAt, analyzedAt, firstFoundAt      -> None
+
+  dependencies[] (SBOM):
+    description, downloadUrl, projectUrl -> ""
+    hash, isGolang                       -> None  (always null in real FOSSA samples)
+    notes, otherLicenses                 -> []
+
+  Top-level SBOM:
+    copyrightsByLicense -> {}  (would require parsing attribText for `Copyright (c)` lines)
+    licenses            -> {}  (would require bundling SPDX license body texts)
+"""
+from __future__ import annotations
+
+from typing import Any, Iterable, Optional
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core.classes import Diff, Issue, Package
+
+LICENSE_ALERT_TYPES = {"licenseSpdxDisj"}
+QUALITY_ALERT_PREFIXES = ("risk", "quality", "outdated", "unmaintained")
+
+
+def _ecosystem_to_package_manager(ecosystem: Optional[str]) -> str:
+    mapping = {
+        "pypi": "pip",
+        "npm": "npm",
+        "maven": "maven",
+        "nuget": "nuget",
+        "gem": "gem",
+        "golang": "go",
+        "cargo": "cargo",
+    }
+    if not ecosystem:
+        return "unknown"
+    return mapping.get(ecosystem, ecosystem)
+
+
+def _listify(value: Any) -> list[Any]:
+    if value is None:
+        return []
+    if isinstance(value, list):
+        return value
+    return [value]
+
+
+def _first_non_empty(*values: Any) -> Any:
+    for value in values:
+        if value not in (None, "", [], {}):
+            return value
+    return None
+
+
+def _build_project_metadata(diff_report: Diff, config: CliConfig) -> dict[str, Any]:
+    repo = getattr(config, "repo", None) or "socket-default-repo"
+    branch = getattr(config, "branch", None) or "socket-default-branch"
+    revision = getattr(diff_report, "id", None) or getattr(diff_report, "new_scan_id", None) or "unknown-revision"
+    report_url = getattr(diff_report, "report_url", None) or getattr(diff_report, "diff_url", None)
+    return {
+        "branch": branch,
+        "id": f"{repo}${revision}",
+        "project": repo,
+        "projectId": repo,
+        "revision": revision,
+        "url": report_url,
+    }
+
+
+def _build_source_metadata(issue: Issue, package: Optional[Package]) -> dict[str, Any]:
+    package_type = _ecosystem_to_package_manager(
+        getattr(package, "type", None) or getattr(issue, "pkg_type", None)
+    )
+    package_name = getattr(package, "name", None) or getattr(issue, "pkg_name", None)
+    package_version = getattr(package, "version", None) or getattr(issue, "pkg_version", None)
+    package_url = getattr(package, "url", None) or getattr(issue, "url", None)
+    return {
+        "id": f"{package_type}+{package_name}${package_version}",
+        "name": package_name,
+        "url": package_url,
+        "version": package_version,
+        "packageManager": package_type,
+    }
+
+
+def _build_depths(package: Optional[Package]) -> dict[str, int]:
+    is_direct = bool(getattr(package, "direct", False))
+    return {
+        "direct": 1 if is_direct else 0,
+        "deep": 0 if is_direct else 1,
+    }
+
+
+def _build_statuses(issue: Issue) -> dict[str, int]:
+    is_ignored = bool(getattr(issue, "ignore", False))
+    return {
+        "active": 0 if is_ignored else 1,
+        "ignored": 1 if is_ignored else 0,
+    }
+
+
+def _build_projects_entry(project: dict[str, Any], package: Optional[Package]) -> list[dict[str, Any]]:
+    is_direct = bool(getattr(package, "direct", False))
+    return [{
+        "id": project["projectId"],
+        "status": "active",
+        "depth": 1 if is_direct else 2,
+        "title": project["project"],
+        "scannedAt": None,
+        "analyzedAt": None,
+        "url": project["url"],
+        "firstFoundAt": None,
+        "defaultBranch": project["branch"],
+        "latest": True,
+        "revisionId": f"{project['projectId']}${project['revision']}",
+        "revisionScanId": project["revision"],
+    }]
+
+
+def _extract_cve(props: dict[str, Any]) -> Optional[str]:
+    cve = _first_non_empty(props.get("cveId"), props.get("cve"))
+    if isinstance(cve, list):
+        return cve[0] if cve else None
+    return cve
+
+
+def _extract_float(*values: Any) -> Optional[float]:
+    value = _first_non_empty(*values)
+    if value is None:
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _extract_string_list(*values: Any) -> list[str]:
+    items = _listify(_first_non_empty(*values))
+    output = []
+    for item in items:
+        if isinstance(item, str) and item:
+            output.append(item)
+    return output
+
+
+def _build_remediation(props: dict[str, Any]) -> dict[str, Any]:
+    fix = _first_non_empty(
+        props.get("firstPatchedVersionIdentifier"),
+        props.get("partialFix"),
+        props.get("completeFix"),
+        props.get("fixedVersion"),
+        props.get("fixed_version"),
+        props.get("patchedVersion"),
+        props.get("patched_version"),
+    )
+    return {
+        "partialFix": fix,
+        "partialFixDistance": props.get("partialFixDistance"),
+        "completeFix": fix,
+        "completeFixDistance": props.get("completeFixDistance"),
+    }
+
+
+def _build_epss(props: dict[str, Any]) -> dict[str, Any]:
+    score = _extract_float(props.get("epssScore"), props.get("epss_score"))
+    percentile = _extract_float(props.get("epssPercentile"), props.get("epss_percentile"))
+    return {
+        "score": score,
+        "percentile": percentile,
+    }
+
+
+def _build_metrics(props: dict[str, Any]) -> list[dict[str, Any]]:
+    metrics = props.get("metrics")
+    if isinstance(metrics, list):
+        return metrics
+
+    metric_map = [
+        ("Attack Vector", props.get("attackVector")),
+        ("Attack Complexity", props.get("attackComplexity")),
+        ("Privileges Required", props.get("privilegesRequired")),
+        ("User Interaction", props.get("userInteraction")),
+        ("Scope", props.get("scope")),
+        ("Confidentiality Impact", props.get("confidentialityImpact")),
+        ("Integrity Impact", props.get("integrityImpact")),
+        ("Availability Impact", props.get("availabilityImpact")),
+    ]
+    return [
+        {"name": name, "value": value}
+        for name, value in metric_map
+        if value not in (None, "")
+    ]
+
+
+def _extract_references(issue: Issue, props: dict[str, Any]) -> list[str]:
+    references = _listify(props.get("references"))
+    if props.get("url"):
+        references.append(props["url"])
+    if getattr(issue, "url", None):
+        references.append(issue.url)
+    deduped = []
+    seen = set()
+    for reference in references:
+        if not isinstance(reference, str) or not reference:
+            continue
+        if reference in seen:
+            continue
+        seen.add(reference)
+        deduped.append(reference)
+    return deduped
+
+
+def _build_vulnerability_entry(
+    issue: Issue, package: Optional[Package], project: dict[str, Any], index: int
+) -> dict[str, Any]:
+    props = getattr(issue, "props", {}) or {}
+    return {
+        "id": props.get("id") or f"socket-vulnerability-{index}",
+        "type": "vulnerability",
+        "createdAt": props.get("createdAt"),
+        "source": _build_source_metadata(issue, package),
+        "depths": _build_depths(package),
+        "containerLayers": {"base": 0, "other": 0},
+        "statuses": _build_statuses(issue),
+        "projects": _build_projects_entry(project, package),
+        "url": getattr(issue, "url", None) or project["url"],
+        "vulnId": _first_non_empty(props.get("ghsaId"), props.get("cveId"), issue.key, f"socket-vuln-{index}"),
+        "title": getattr(issue, "title", None),
+        "cve": _extract_cve(props),
+        "cvss": _extract_float(props.get("cvssScore"), props.get("cvss")),
+        "severity": getattr(issue, "severity", "unknown"),
+        "details": _first_non_empty(getattr(issue, "description", None), props.get("overview"), props.get("note")),
+        "remediation": _build_remediation(props),
+        "metrics": _build_metrics(props),
+        "cveStatus": props.get("cveStatus"),
+        "cwes": _extract_string_list(props.get("cwes"), props.get("cwe")),
+        "published": props.get("published"),
+        "affectedVersionRanges": _extract_string_list(
+            props.get("affectedVersionRanges"),
+            props.get("vulnerableVersionRange"),
+            props.get("affected_versions"),
+        ),
+        "patchedVersionRanges": _extract_string_list(
+            props.get("patchedVersionRanges"),
+            props.get("firstPatchedVersionIdentifier"),
+            props.get("patched_versions"),
+        ),
+        "references": _extract_references(issue, props),
+        "cvssVector": props.get("cvssVector"),
+        "exploitability": props.get("exploitability"),
+        "epss": _build_epss(props),
+        "cpes": _extract_string_list(props.get("cpes")),
+        "customRiskScore": None,
+    }
+
+
+def _build_licensing_entry(
+    issue: Issue, package: Optional[Package], project: dict[str, Any], index: int
+) -> dict[str, Any]:
+    props = getattr(issue, "props", {}) or {}
+    package_license = getattr(package, "license", None)
+    issue_type = "policy_conflict"
+    if not package_license:
+        issue_type = "unlicensed_dependency"
+    elif getattr(issue, "type", None) not in LICENSE_ALERT_TYPES:
+        issue_type = "policy_flag"
+    return {
+        "id": props.get("id") or f"socket-licensing-{index}",
+        "type": issue_type,
+        "createdAt": props.get("createdAt"),
+        "source": _build_source_metadata(issue, package),
+        "depths": _build_depths(package),
+        "statuses": _build_statuses(issue),
+        "projects": _build_projects_entry(project, package),
+        "url": getattr(issue, "url", None) or project["url"],
+        "title": getattr(issue, "title", None) or "License Policy Violation",
+        "details": _first_non_empty(getattr(issue, "description", None), props.get("note"), package_license),
+        "license": package_license,
+        "identifiedLicense": package_license,
+        "references": _extract_references(issue, props),
+    }
+
+
+def _build_quality_entry(
+    issue: Issue, package: Optional[Package], project: dict[str, Any], index: int
+) -> dict[str, Any]:
+    props = getattr(issue, "props", {}) or {}
+    return {
+        "id": props.get("id") or f"socket-quality-{index}",
+        "type": getattr(issue, "type", None) or "quality_issue",
+        "createdAt": props.get("createdAt"),
+        "source": _build_source_metadata(issue, package),
+        "depths": _build_depths(package),
+        "statuses": _build_statuses(issue),
+        "projects": _build_projects_entry(project, package),
+        "url": getattr(issue, "url", None) or project["url"],
+        "title": getattr(issue, "title", None),
+        "details": _first_non_empty(getattr(issue, "description", None), props.get("note")),
+        "references": _extract_references(issue, props),
+    }
+
+
+def _iter_selected_issues(diff_report: Diff, config: CliConfig) -> Iterable[Issue]:
+    """Yield all currently-present issues (new + unchanged) to match FOSSA's
+    /api/v2/issues behavior, which returns a point-in-time snapshot of all
+    issues at the scan revision, not only diff-new ones. The `config` argument
+    is retained for signature stability but no longer gates output.
+    """
+    yield from getattr(diff_report, "new_alerts", []) or []
+    yield from getattr(diff_report, "unchanged_alerts", []) or []
+
+
+def _classify_issue(issue: Issue) -> str:
+    issue_type = (getattr(issue, "type", "") or "").lower()
+    category = (getattr(issue, "category", "") or "").lower()
+    if issue_type in LICENSE_ALERT_TYPES or "license" in issue_type or category == "licensing":
+        return "licensing"
+    if category == "quality" or issue_type.startswith(QUALITY_ALERT_PREFIXES):
+        return "quality"
+    return "vulnerability"
+
+
+def build_fossa_report_payload(diff_report: Diff, config: CliConfig) -> dict[str, Any]:
+    project = _build_project_metadata(diff_report, config)
+    package_lookup = getattr(diff_report, "packages", {}) or {}
+    vulnerabilities = []
+    licensing = []
+    quality = []
+
+    for index, issue in enumerate(_iter_selected_issues(diff_report, config), start=1):
+        package = package_lookup.get(getattr(issue, "pkg_id", "")) if package_lookup else None
+        category = _classify_issue(issue)
+        if category == "licensing":
+            licensing.append(_build_licensing_entry(issue, package, project, index))
+        elif category == "quality":
+            quality.append(_build_quality_entry(issue, package, project, index))
+        else:
+            vulnerabilities.append(_build_vulnerability_entry(issue, package, project, index))
+
+    return {
+        "project": project,
+        "vulnerability": vulnerabilities,
+        "licensing": licensing,
+        "quality": quality,
+    }
+
+
+def _build_attribution_project(diff_report: Diff, config: CliConfig) -> dict[str, Any]:
+    repo = getattr(config, "repo", None) or "socket-default-repo"
+    revision = (
+        getattr(diff_report, "id", None)
+        or getattr(diff_report, "new_scan_id", None)
+        or "unknown-revision"
+    )
+    return {"name": repo, "revision": revision}
+
+
+def _build_dependency_licenses(package: Package) -> list[dict[str, str]]:
+    """Build the `licenses[]` array: prefer licenseAttrib entries (full attribution text),
+    fall back to a single name-only entry from declared license, else empty.
+    """
+    attribs = getattr(package, "licenseAttrib", None) or []
+    licenses = []
+    for attrib in attribs:
+        attrib_text = attrib.get("attribText", "") if isinstance(attrib, dict) else getattr(attrib, "attribText", "")
+        attrib_data = attrib.get("attribData", []) if isinstance(attrib, dict) else getattr(attrib, "attribData", [])
+        spdx = ""
+        if attrib_data:
+            first = attrib_data[0]
+            spdx = first.get("spdxExpr", "") if isinstance(first, dict) else getattr(first, "spdxExpr", "")
+        if attrib_text or spdx:
+            licenses.append({"attribution": attrib_text or "", "name": spdx or getattr(package, "license", "") or ""})
+    if licenses:
+        return licenses
+    declared = getattr(package, "license", None)
+    if declared:
+        return [{"attribution": "", "name": declared}]
+    return []
+
+
+def _build_dependency_entry(package: Package, dependency_paths: list[str]) -> dict[str, Any]:
+    return {
+        "authors": list(getattr(package, "author", []) or []),
+        "dependencyPaths": list(dependency_paths),
+        "description": "",
+        "downloadUrl": "",
+        "hash": None,
+        "isGolang": None,
+        "licenses": _build_dependency_licenses(package),
+        "notes": [],
+        "otherLicenses": [],
+        "package": package.name,
+        "projectUrl": "",
+        "source": _ecosystem_to_package_manager(package.type),
+        "title": package.name,
+        "version": package.version,
+    }
+
+
+def _compute_dependency_paths(package: Package, package_lookup: dict[str, Package]) -> list[str]:
+    if bool(getattr(package, "direct", False)):
+        return [package.name]
+    ancestors = getattr(package, "topLevelAncestors", None) or []
+    paths = []
+    for ancestor_id in ancestors:
+        ancestor = package_lookup.get(ancestor_id)
+        if ancestor and getattr(ancestor, "name", None):
+            paths.append(f"{ancestor.name} > {package.name}")
+    if not paths:
+        return [package.name]
+    return paths
+
+
+def _partition_dependencies(packages: list[Package]) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
+    direct: list[dict[str, Any]] = []
+    deep: list[dict[str, Any]] = []
+    package_lookup = {getattr(p, "id", None): p for p in packages if getattr(p, "id", None)}
+    for package in packages:
+        paths = _compute_dependency_paths(package, package_lookup)
+        entry = _build_dependency_entry(package, paths)
+        if bool(getattr(package, "direct", False)):
+            direct.append(entry)
+        else:
+            deep.append(entry)
+    return direct, deep
+
+
+def build_fossa_attribution_payload(diff_report: Diff, config: CliConfig) -> dict[str, Any]:
+    packages = list((getattr(diff_report, "packages", {}) or {}).values())
+    direct, deep = _partition_dependencies(packages)
+    return {
+        "copyrightsByLicense": {},
+        "deepDependencies": deep,
+        "directDependencies": direct,
+        "licenses": {},
+        "project": _build_attribution_project(diff_report, config),
+    }
diff --git a/socketsecurity/output.py b/socketsecurity/output.py
index 921ca79..63fe565 100644
--- a/socketsecurity/output.py
+++ b/socketsecurity/output.py
@@ -5,6 +5,7 @@
 from .core.messages import Messages
 from .core.classes import Diff, Issue
 from .config import CliConfig
+from .fossa_compat import build_fossa_report_payload
 from socketsecurity.plugins.manager import PluginManager
 from socketsecurity.core.alert_selection import (
     clone_diff_with_selected_alerts,
@@ -90,6 +91,9 @@ def handle_output(self, diff_report: Diff) -> None:
             plugin_mgr = PluginManager({"slack": slack_config})
             plugin_mgr.send(diff_report, config=self.config)
 
+        self.save_json_file(diff_report, getattr(self.config, "json_file", None))
+        self.save_summary_file(diff_report, getattr(self.config, "summary_file", None))
+        self.save_report_link_file(diff_report, getattr(self.config, "report_link_file", None))
         self.save_sbom_file(diff_report, self.config.sbom_file)
     
     def return_exit_code(self, diff_report: Diff) -> int:
@@ -107,50 +111,15 @@ def return_exit_code(self, diff_report: Diff) -> int:
 
     def output_console_comments(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Outputs formatted console comments"""
-        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
-        has_new_alerts = len(selected_alerts) > 0
-        has_unchanged_alerts = (
-            self.config.strict_blocking and
-            hasattr(diff_report, 'unchanged_alerts') and
-            len(diff_report.unchanged_alerts) > 0
-        )
-
-        if not has_new_alerts and not has_unchanged_alerts:
-            self.logger.info("No issues found")
-            return
-
-        # Count blocking vs warning alerts
-        new_blocking = sum(1 for issue in diff_report.new_alerts if issue.error)
-        new_warning = sum(1 for issue in diff_report.new_alerts if issue.warn)
-
-        unchanged_blocking = 0
-        unchanged_warning = 0
-        if has_unchanged_alerts:
-            unchanged_blocking = sum(1 for issue in diff_report.unchanged_alerts if issue.error)
-            unchanged_warning = sum(1 for issue in diff_report.unchanged_alerts if issue.warn)
-
-        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
-        console_security_comment = Messages.create_console_security_alert_table(selected_diff)
-
-        # Build status message
-        self.logger.info("Security issues detected by Socket Security:")
-        if new_blocking > 0:
-            self.logger.info(f"  - NEW blocking issues: {new_blocking}")
-        if new_warning > 0:
-            self.logger.info(f"  - NEW warning issues: {new_warning}")
-        if unchanged_blocking > 0:
-            self.logger.info(f"  - EXISTING blocking issues: {unchanged_blocking} (causing failure due to --strict-blocking)")
-        if unchanged_warning > 0:
-            self.logger.info(f"  - EXISTING warning issues: {unchanged_warning}")
-
-        self.logger.info(f"Diff Url: {diff_report.diff_url}")
-        self.logger.info(f"\n{console_security_comment}")
+        summary_text = self.build_summary_text(diff_report)
+        for line in summary_text.splitlines():
+            self.logger.info(line)
+        if not summary_text.strip():
+            self.logger.info("")
 
     def output_console_json(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Outputs JSON formatted results"""
-        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
-        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
-        console_security_comment = Messages.create_security_comment_json(selected_diff)
+        console_security_comment = self.build_json_report(diff_report)
         self.save_sbom_file(diff_report, sbom_file_name)
         self.logger.info(json.dumps(console_security_comment))
 
@@ -246,14 +215,106 @@ def report_pass(self, diff_report: Diff) -> bool:
 
     def save_sbom_file(self, diff_report: Diff, sbom_file_name: Optional[str] = None) -> None:
         """Saves SBOM file if filename is provided"""
-        if not sbom_file_name or not diff_report.sbom:
+        if not sbom_file_name:
             return
 
-        sbom_path = Path(sbom_file_name)
-        sbom_path.parent.mkdir(parents=True, exist_ok=True)
+        sbom_data = getattr(diff_report, "sbom", None)
+        if sbom_data is None:
+            sbom_data = []
+
+        self.write_json_file(sbom_file_name, sbom_data)
 
-        with open(sbom_path, "w") as f:
-            json.dump(diff_report.sbom, f, indent=2)
+    def build_summary_text(self, diff_report: Diff) -> str:
+        """Render the console summary text for stdout and file output."""
+        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
+        has_new_alerts = len(selected_alerts) > 0
+        has_unchanged_alerts = (
+            self.config.strict_blocking and
+            hasattr(diff_report, 'unchanged_alerts') and
+            len(diff_report.unchanged_alerts) > 0
+        )
+
+        if not has_new_alerts and not has_unchanged_alerts:
+            return "No issues found"
+
+        new_blocking = sum(1 for issue in diff_report.new_alerts if issue.error)
+        new_warning = sum(1 for issue in diff_report.new_alerts if issue.warn)
+
+        unchanged_blocking = 0
+        unchanged_warning = 0
+        if has_unchanged_alerts:
+            unchanged_blocking = sum(1 for issue in diff_report.unchanged_alerts if issue.error)
+            unchanged_warning = sum(1 for issue in diff_report.unchanged_alerts if issue.warn)
+
+        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
+        console_security_comment = Messages.create_console_security_alert_table(selected_diff)
+
+        lines = ["Security issues detected by Socket Security:"]
+        if new_blocking > 0:
+            lines.append(f"  - NEW blocking issues: {new_blocking}")
+        if new_warning > 0:
+            lines.append(f"  - NEW warning issues: {new_warning}")
+        if unchanged_blocking > 0:
+            lines.append(
+                f"  - EXISTING blocking issues: {unchanged_blocking} (causing failure due to --strict-blocking)"
+            )
+        if unchanged_warning > 0:
+            lines.append(f"  - EXISTING warning issues: {unchanged_warning}")
+
+        report_link = getattr(diff_report, "report_url", "") or getattr(diff_report, "diff_url", "")
+        lines.append(f"Diff Url: {report_link}")
+        lines.append("")
+        lines.append(str(console_security_comment))
+        return "\n".join(lines)
+
+    def build_json_report(self, diff_report: Diff) -> dict:
+        """Build the JSON report payload for stdout and file output."""
+        if getattr(self.config, "legal_format", "socket") == "fossa":
+            return build_fossa_report_payload(diff_report, self.config)
+
+        selected_alerts = select_diff_alerts(diff_report, strict_blocking=self.config.strict_blocking)
+        selected_diff = clone_diff_with_selected_alerts(diff_report, selected_alerts)
+        report = Messages.create_security_comment_json(selected_diff)
+        legal_flag = getattr(self.config, "legal", False)
+        repo = getattr(self.config, "repo", None)
+        branch = getattr(self.config, "branch", None)
+        commit_sha = getattr(self.config, "commit_sha", None)
+        report["report_url"] = getattr(diff_report, "report_url", None)
+        report["repo"] = repo if isinstance(repo, str) or repo is None else None
+        report["branch"] = branch if isinstance(branch, str) or branch is None else None
+        report["commit_sha"] = commit_sha if isinstance(commit_sha, str) or commit_sha is None else None
+        report["legal_mode"] = legal_flag if isinstance(legal_flag, bool) else False
+        return report
+
+    def save_json_file(self, diff_report: Diff, json_file_name: Optional[str] = None) -> None:
+        if not json_file_name:
+            return
+        self.write_json_file(json_file_name, self.build_json_report(diff_report))
+
+    def save_summary_file(self, diff_report: Diff, summary_file_name: Optional[str] = None) -> None:
+        if not summary_file_name:
+            return
+        self.write_text_file(summary_file_name, self.build_summary_text(diff_report) + "\n")
+
+    def save_report_link_file(self, diff_report: Diff, report_link_file_name: Optional[str] = None) -> None:
+        if not report_link_file_name:
+            return
+        report_link = getattr(diff_report, "report_url", "") or getattr(diff_report, "diff_url", "")
+        if not report_link:
+            return
+        self.write_text_file(report_link_file_name, report_link + "\n")
+
+    def write_json_file(self, file_name: str, content: Any) -> None:
+        file_path = Path(file_name)
+        file_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(file_path, "w") as f:
+            json.dump(content, f, indent=2)
+
+    def write_text_file(self, file_name: str, content: str) -> None:
+        file_path = Path(file_name)
+        file_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(file_path, "w") as f:
+            f.write(content)
 
     def output_gitlab_security(self, diff_report: Diff) -> None:
         """
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 1f2b166..26823cc 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -1,9 +1,8 @@
 import json
 import os
+import shutil
 import sys
 import traceback
-import shutil
-import warnings
 from datetime import datetime, timezone
 from uuid import uuid4
 
@@ -11,6 +10,7 @@
 from git import InvalidGitRepositoryError, NoSuchPathError
 from socketdev import socketdev
 from socketdev.fullscans import FullScanParams
+
 from socketsecurity.config import CliConfig
 from socketsecurity.core import Core
 from socketsecurity.core.classes import Diff
@@ -20,12 +20,48 @@
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
 from socketsecurity.core.socket_config import SocketConfig
+from socketsecurity.fossa_compat import build_fossa_attribution_payload
 from socketsecurity.output import OutputHandler
 
 socket_logger, log = initialize_logging()
 
 load_dotenv()
 
+
+def build_license_artifact_payload(
+    diff: Diff,
+    legal_format: str = "socket",
+    config: CliConfig | None = None,
+) -> dict:
+    """Build the license artifact payload from a diff, tolerating sparse scan paths."""
+    if legal_format == "fossa":
+        if config is None:
+            raise ValueError("config is required when building FOSSA-format legal artifacts")
+        return build_fossa_attribution_payload(diff, config)
+
+    all_packages = {}
+    packages = getattr(diff, "packages", {}) or {}
+    for purl in packages:
+        package = packages[purl]
+        output = {
+            "id": package.id,
+            "name": package.name,
+            "version": package.version,
+            "ecosystem": package.type,
+            "direct": package.direct,
+            "url": package.url,
+            "license": package.license,
+            "licenseDetails": package.licenseDetails,
+            "licenseAttrib": package.licenseAttrib,
+            "purl": package.purl,
+        }
+        all_packages[package.id] = output
+    return all_packages
+
+def _write_attribution_file(config, payload: dict) -> None:
+    Core.save_file(config.license_file_name, json.dumps(payload, indent=2))
+
+
 def cli():
     try:
         main_code()
@@ -125,7 +161,7 @@ def main_code():
             
             # Check if plan matches enterprise* pattern (enterprise, enterprise_trial, etc.)
             if not org_plan.startswith('enterprise'):
-                log.error(f"Reachability analysis is only available for enterprise plans.")
+                log.error("Reachability analysis is only available for enterprise plans.")
                 log.error(f"Your organization plan is: {org_plan}")
                 log.error("Please upgrade to an enterprise plan to use reachability analysis.")
                 sys.exit(3)
@@ -310,7 +346,7 @@ def main_code():
                     continue_on_no_source_files=config.reach_continue_on_no_source_files,
                 )
                 
-                log.info(f"Reachability analysis completed successfully")
+                log.info("Reachability analysis completed successfully")
                 log.info(f"Results written to: {result['report_path']}")
                 if result.get('scan_id'):
                     log.info(f"Reachability scan ID: {result['scan_id']}")
@@ -743,23 +779,12 @@ def _is_unprocessed(c):
 
     # Handle license generation
     if not should_skip_scan and diff.id != "NO_DIFF_RAN" and diff.id != "NO_SCAN_RAN" and config.generate_license:
-        all_packages = {}
-        for purl in diff.packages:
-            package = diff.packages[purl]
-            output = {
-                "id": package.id,
-                "name": package.name,
-                "version": package.version,
-                "ecosystem": package.type,
-                "direct": package.direct,
-                "url": package.url,
-                "license": package.license,
-                "licenseDetails": package.licenseDetails,
-                "licenseAttrib": package.licenseAttrib,
-                "purl": package.purl,
-            }
-            all_packages[package.id] = output
-        core.save_file(config.license_file_name, json.dumps(all_packages))
+        all_packages = build_license_artifact_payload(
+            diff,
+            legal_format=getattr(config, "legal_format", "socket"),
+            config=config,
+        )
+        _write_attribution_file(config, all_packages)
 
     # If we forced API mode due to no supported files, behave as if --disable-blocking was set
     if force_api_mode:
diff --git a/tests/fixtures/fossa/README.md b/tests/fixtures/fossa/README.md
new file mode 100644
index 0000000..853d716
--- /dev/null
+++ b/tests/fixtures/fossa/README.md
@@ -0,0 +1,18 @@
+# FOSSA reference fixtures
+
+Real `fossa analyze` and `fossa report --json attribution` artifacts captured
+from a representative Azure DevOps FOSSA pipeline run, used as the
+structural-parity baseline for `--legal-format fossa` output.
+
+Customer-identifying values (org IDs, project names) have been sanitized; the
+structural shape, key sets, value types, and per-field cardinality match the
+real artifacts byte-for-byte aside from those substitutions.
+
+- `fossa-analyze-populated.json` — composed FOSSA analyze artifact with
+  vulnerabilities present.
+- `fossa-analyze-empty.json` — composed FOSSA analyze artifact with zero
+  vulnerabilities.
+- `fossa-sbom-populated.json` — `fossa report --json attribution` output with
+  direct + deep dependencies.
+- `fossa-sbom-empty-deep.json` — attribution output with empty
+  `deepDependencies`.
diff --git a/tests/fixtures/fossa/fossa-analyze-empty.json b/tests/fixtures/fossa/fossa-analyze-empty.json
new file mode 100644
index 0000000..fd7efa3
--- /dev/null
+++ b/tests/fixtures/fossa/fossa-analyze-empty.json
@@ -0,0 +1,13 @@
+{
+  "project": {
+    "branch": "refs/heads/master",
+    "id": "custom+1234/example-validation-project-03cb9ead2f744dfa5506ec0c915423947ec2fe11-go-linux",
+    "project": "1234/example-validation-project",
+    "projectId": "custom+1234/example-validation-project",
+    "revision": "12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-go-linux",
+    "url": "https://app.fossa.com/account/saml/1234?next=/projects/custom%252b1234%252fexample-validation-project/refs/branch/refs%252fheads%252fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-go-linux"
+  },
+  "vulnerability": [],
+  "licensing": [],
+  "quality": []
+}
diff --git a/tests/fixtures/fossa/fossa-analyze-populated.json b/tests/fixtures/fossa/fossa-analyze-populated.json
new file mode 100644
index 0000000..515fed9
--- /dev/null
+++ b/tests/fixtures/fossa/fossa-analyze-populated.json
@@ -0,0 +1,1275 @@
+{
+  "project": {
+    "branch": "refs/heads/master",
+    "id": "custom+1234/example-validation-project-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+    "project": "1234/example-validation-project",
+    "projectId": "custom+1234/example-validation-project",
+    "revision": "12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+    "url": "https://app.fossa.com/account/saml/1234?next=/projects/custom%252b1234%252fexample-validation-project/refs/branch/refs%252fheads%252fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux"
+  },
+  "vulnerability": [
+    {
+      "id": 11088939,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+certifi$2023.11.17",
+        "name": "certifi",
+        "url": "https://github.com/certifi/python-certifi",
+        "version": "2023.11.17",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/11088939?revisionScanId=106820047",
+      "vulnId": "CVE-2024-39689_pip+certifi",
+      "title": "Insufficient Verification of Data Authenticity",
+      "cve": "CVE-2024-39689",
+      "cvss": 7.5,
+      "severity": "high",
+      "details": "Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified \"long-running and unresolved compliance issues.\"",
+      "remediation": {
+        "partialFix": "2024.7.4",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2024.7.4",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "Low"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "High"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-345"
+      ],
+      "published": "2024-07-05T19:15:10Z",
+      "affectedVersionRanges": [
+        ">=2021.5.30,<2024.7.4"
+      ],
+      "patchedVersionRanges": [
+        "2024.7.4"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-248v-346w-9cwc",
+        "https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463",
+        "https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc",
+        "https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml",
+        "https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI",
+        "https://pypi.org/project/certifi/",
+        "https://security.netapp.com/advisory/ntap-20241206-0001",
+        "https://security.netapp.com/advisory/ntap-20241206-0001/"
+      ],
+      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.21233,
+        "percentile": 0.95751
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 11088937,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+idna$3.6",
+        "name": "idna",
+        "url": "https://pypi.org/project/idna/",
+        "version": "3.6",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/11088937?revisionScanId=106820047",
+      "vulnId": "CVE-2024-3651_pip+idna",
+      "title": "Uncontrolled Resource Consumption",
+      "cve": "CVE-2024-3651",
+      "cvss": 7.5,
+      "severity": "high",
+      "details": "A vulnerability was identified in the kjd/idna library, specifically within the `idna.encode()` function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This vulnerability is triggered by a crafted input that causes the `idna.encode()` function to process the input with considerable computational load, significantly increasing the processing time in a quadratic manner relative to the input size.",
+      "remediation": {
+        "partialFix": "3.7",
+        "completeFix": "3.7"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "Low"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "High"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-400",
+        "CWE-1333"
+      ],
+      "published": "2024-07-07T18:15:00Z",
+      "affectedVersionRanges": [
+        "<3.7"
+      ],
+      "patchedVersionRanges": [
+        "3.7"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-jjg7-2v4v-x38h",
+        "https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d",
+        "https://github.com/kjd/idna/security/advisories/GHSA-jjg7-2v4v-x38h",
+        "https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2024-60.yaml",
+        "https://huntr.com/bounties/93d78d07-d791-4b39-a845-cbfabc44aadb",
+        "https://lists.debian.org/debian-lts-announce/2024/05/msg00006.html",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YQUPYH3SVZ5GFF2CDQ55FCM575AZTF2",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F2S5E23N6E52S46KGNYTDFB75LOC4N4D",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S5IDLLD2IKSIVRBSLB34WTSYGLMWUFWF",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULSC7HBJKXB3BZV367WM5BR6DFEC4Z43",
+        "https://pypi.org/project/idna/"
+      ],
+      "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.0067,
+        "percentile": 0.71572
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 15980738,
+      "type": "vulnerability",
+      "createdAt": "2026-05-20T14:40:25.221Z",
+      "source": {
+        "id": "pip+requests$2.27.1",
+        "name": "requests",
+        "url": "https://pypi.org/project/requests/",
+        "version": "2.27.1",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 1,
+        "deep": 0
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 1,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2026-05-20T14:40:25.221+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/15980738?revisionScanId=106820047",
+      "vulnId": "CVE-2026-25645_pip+requests",
+      "title": "Insecure Temporary File",
+      "cve": "CVE-2026-25645",
+      "cvss": 4.4,
+      "severity": "medium",
+      "details": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
+      "remediation": {
+        "partialFix": "2.33.0",
+        "partialFixDistance": "MINOR",
+        "completeFix": "2.33.0",
+        "completeFixDistance": "MINOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Local"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "Low"
+        },
+        {
+          "name": "User Interaction",
+          "value": "Required"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "High"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-377"
+      ],
+      "published": "2026-03-25T17:16:52Z",
+      "affectedVersionRanges": [
+        "<2.33.0"
+      ],
+      "patchedVersionRanges": [
+        "2.33.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-gc5v-m9x4-r6x2",
+        "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7",
+        "https://github.com/psf/requests/releases/tag/v2.33.0",
+        "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2",
+        "https://pypi.org/project/requests/"
+      ],
+      "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 5E-05,
+        "percentile": 0.00232
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 11088938,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+requests$2.27.1",
+        "name": "requests",
+        "url": "https://pypi.org/project/requests/",
+        "version": "2.27.1",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 1,
+        "deep": 0
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 1,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/11088938?revisionScanId=106820047",
+      "vulnId": "CVE-2024-47081_pip+requests",
+      "title": "Insufficiently Protected Credentials",
+      "cve": "CVE-2024-47081",
+      "cvss": 5.3,
+      "severity": "medium",
+      "details": "Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.",
+      "remediation": {
+        "partialFix": "2.32.4",
+        "partialFixDistance": "MINOR",
+        "completeFix": "2.33.0",
+        "completeFixDistance": "MINOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "Required"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "High"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-522"
+      ],
+      "published": "2025-06-09T19:06:08Z",
+      "affectedVersionRanges": [
+        "<2.32.4"
+      ],
+      "patchedVersionRanges": [
+        "2.32.4"
+      ],
+      "references": [
+        "http://seclists.org/fulldisclosure/2025/Jun/2",
+        "http://www.openwall.com/lists/oss-security/2025/06/03/11",
+        "http://www.openwall.com/lists/oss-security/2025/06/03/9",
+        "http://www.openwall.com/lists/oss-security/2025/06/04/1",
+        "http://www.openwall.com/lists/oss-security/2025/06/04/6",
+        "https://github.com/advisories/GHSA-9hjg-9r4m-mvj7",
+        "https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef",
+        "https://github.com/psf/requests/pull/6965",
+        "https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7",
+        "https://pypi.org/project/requests/",
+        "https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env",
+        "https://seclists.org/fulldisclosure/2025/Jun/2"
+      ],
+      "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00208,
+        "percentile": 0.43056
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 9643353,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+requests$2.27.1",
+        "name": "requests",
+        "url": "https://pypi.org/project/requests/",
+        "version": "2.27.1",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 1,
+        "deep": 0
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 1,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/9643353?revisionScanId=106820047",
+      "vulnId": "CVE-2024-35195_pip+requests",
+      "title": "Always-Incorrect Control Flow Implementation",
+      "cve": "CVE-2024-35195",
+      "cvss": 5.6,
+      "severity": "medium",
+      "details": "Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. This vulnerability is fixed in 2.32.0.",
+      "remediation": {
+        "partialFix": "2.32.0",
+        "partialFixDistance": "MINOR",
+        "completeFix": "2.33.0",
+        "completeFixDistance": "MINOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Local"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "High"
+        },
+        {
+          "name": "User Interaction",
+          "value": "Required"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "High"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "High"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-670"
+      ],
+      "published": "2024-05-20T20:15:00Z",
+      "affectedVersionRanges": [
+        "<2.32.0"
+      ],
+      "patchedVersionRanges": [
+        "2.32.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-9wx4-h78v-vm56",
+        "https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",
+        "https://github.com/psf/requests/pull/6655",
+        "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",
+        "https://pypi.org/project/requests/"
+      ],
+      "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00044,
+        "percentile": 0.13635
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 9643352,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+requests$2.27.1",
+        "name": "requests",
+        "url": "https://pypi.org/project/requests/",
+        "version": "2.27.1",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 1,
+        "deep": 0
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 1,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/9643352?revisionScanId=106820047",
+      "vulnId": "CVE-2023-32681_pip+requests",
+      "title": "Exposure of Sensitive Information to an Unauthorized Actor",
+      "cve": "CVE-2023-32681",
+      "cvss": 6.1,
+      "severity": "medium",
+      "details": "Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.",
+      "remediation": {
+        "partialFix": "2.31.0",
+        "partialFixDistance": "MINOR",
+        "completeFix": "2.33.0",
+        "completeFixDistance": "MINOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "Required"
+        },
+        {
+          "name": "Scope",
+          "value": "Changed"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "High"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-200"
+      ],
+      "published": "2023-05-26T18:15:00Z",
+      "affectedVersionRanges": [
+        ">=2.3.0,<2.31.0"
+      ],
+      "patchedVersionRanges": [
+        "2.31.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-j8r2-6x86-q33q",
+        "https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5",
+        "https://github.com/psf/requests/releases/tag/v2.31.0",
+        "https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q",
+        "https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2023-74.yaml",
+        "https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ",
+        "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/",
+        "https://pypi.org/project/requests/",
+        "https://security.gentoo.org/glsa/202309-08"
+      ],
+      "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.06121,
+        "percentile": 0.90893
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 17096816,
+      "type": "vulnerability",
+      "createdAt": "2026-05-20T14:40:25.221Z",
+      "source": {
+        "id": "pip+urllib3$1.26.20",
+        "name": "urllib3",
+        "url": "https://pypi.org/project/urllib3/",
+        "version": "1.26.20",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2026-05-20T14:40:25.221+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/17096816?revisionScanId=106820047",
+      "vulnId": "CVE-2026-44431_pip+urllib3",
+      "title": "Exposure of Sensitive Information to an Unauthorized Actor",
+      "cve": "CVE-2026-44431",
+      "cvss": 8.2,
+      "severity": "high",
+      "details": "urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.",
+      "remediation": {
+        "partialFix": "2.7.0",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2.7.0",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Attack Requirements",
+          "value": "Present"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Confidentiality Impact to the Vulnerable System",
+          "value": "High"
+        },
+        {
+          "name": "Integrity Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact to the Vulnerable System",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-200",
+        "NVD-CWE-noinfo"
+      ],
+      "published": "2026-05-13T16:16:57Z",
+      "affectedVersionRanges": [
+        ">=1.23,<2.7.0"
+      ],
+      "patchedVersionRanges": [],
+      "references": [
+        "https://github.com/advisories/GHSA-qccp-gfcp-xxvc",
+        "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
+      ],
+      "cvssVector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.0004,
+        "percentile": 0.12165
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 14594289,
+      "type": "vulnerability",
+      "createdAt": "2026-02-20T18:40:20.814Z",
+      "source": {
+        "id": "pip+urllib3$1.26.20",
+        "name": "urllib3",
+        "url": "https://pypi.org/project/urllib3/",
+        "version": "1.26.20",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2026-02-20T18:40:20.814+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/14594289?revisionScanId=106820047",
+      "vulnId": "CVE-2026-21441_pip+urllib3",
+      "title": "Improper Handling of Highly Compressed Data (Data Amplification)",
+      "cve": "CVE-2026-21441",
+      "cvss": 8.9,
+      "severity": "high",
+      "details": "urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
+      "remediation": {
+        "partialFix": "2.6.3",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2.7.0",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "Low"
+        },
+        {
+          "name": "Attack Requirements",
+          "value": "Present"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Confidentiality Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact to the Vulnerable System",
+          "value": "High"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-409"
+      ],
+      "published": "2026-01-07T22:15:44Z",
+      "affectedVersionRanges": [
+        ">=1.22,<2.6.3"
+      ],
+      "patchedVersionRanges": [
+        "2.6.3"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-38jv-5279-wg99",
+        "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
+        "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
+        "https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html",
+        "https://pypi.org/project/urllib3/"
+      ],
+      "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00032,
+        "percentile": 0.09194
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 14169171,
+      "type": "vulnerability",
+      "createdAt": "2026-02-20T18:40:20.814Z",
+      "source": {
+        "id": "pip+urllib3$1.26.20",
+        "name": "urllib3",
+        "url": "https://pypi.org/project/urllib3/",
+        "version": "1.26.20",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2026-02-20T18:40:20.814+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/14169171?revisionScanId=106820047",
+      "vulnId": "CVE-2025-66418_pip+urllib3",
+      "title": "Allocation of Resources Without Limits or Throttling",
+      "cve": "CVE-2025-66418",
+      "cvss": 8.9,
+      "severity": "high",
+      "details": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.",
+      "remediation": {
+        "partialFix": "2.6.0",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2.7.0",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "Low"
+        },
+        {
+          "name": "Attack Requirements",
+          "value": "Present"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Confidentiality Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact to the Vulnerable System",
+          "value": "High"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-770"
+      ],
+      "published": "2025-12-05T16:15:51Z",
+      "affectedVersionRanges": [
+        ">=1.24,<2.6.0"
+      ],
+      "patchedVersionRanges": [
+        "2.6.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-gm62-xv2j-4w53",
+        "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
+        "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
+        "https://pypi.org/project/urllib3/"
+      ],
+      "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00019,
+        "percentile": 0.05115
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 14169170,
+      "type": "vulnerability",
+      "createdAt": "2026-02-20T18:40:20.814Z",
+      "source": {
+        "id": "pip+urllib3$1.26.20",
+        "name": "urllib3",
+        "url": "https://pypi.org/project/urllib3/",
+        "version": "1.26.20",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2026-02-20T18:40:20.814+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/14169170?revisionScanId=106820047",
+      "vulnId": "CVE-2025-66471_pip+urllib3",
+      "title": "Improper Handling of Highly Compressed Data (Data Amplification)",
+      "cve": "CVE-2025-66471",
+      "cvss": 8.9,
+      "severity": "high",
+      "details": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.",
+      "remediation": {
+        "partialFix": "2.6.0",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2.7.0",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "Low"
+        },
+        {
+          "name": "Attack Requirements",
+          "value": "Present"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "None"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Confidentiality Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Integrity Impact to the Vulnerable System",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact to the Vulnerable System",
+          "value": "High"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-409"
+      ],
+      "published": "2025-12-05T17:16:04Z",
+      "affectedVersionRanges": [
+        ">=1.0,<2.6.0"
+      ],
+      "patchedVersionRanges": [
+        "2.6.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-2xpw-w6gg-jr37",
+        "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
+        "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
+        "https://pypi.org/project/urllib3/"
+      ],
+      "cvssVector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00017,
+        "percentile": 0.04227
+      },
+      "cpes": [],
+      "customRiskScore": null
+    },
+    {
+      "id": 10198614,
+      "type": "vulnerability",
+      "createdAt": "2025-10-08T10:41:05.933Z",
+      "source": {
+        "id": "pip+urllib3$1.26.20",
+        "name": "urllib3",
+        "url": "https://pypi.org/project/urllib3/",
+        "version": "1.26.20",
+        "packageManager": "pip"
+      },
+      "depths": {
+        "direct": 0,
+        "deep": 1
+      },
+      "containerLayers": {
+        "base": 0,
+        "other": 0
+      },
+      "statuses": {
+        "active": 1,
+        "ignored": 0
+      },
+      "projects": [
+        {
+          "id": "custom+1234/example-validation-project",
+          "status": "active",
+          "depth": 2,
+          "title": "example-validation-project",
+          "scannedAt": "2026-05-21T17:48:13.555+00:00",
+          "analyzedAt": "2026-05-21T17:48:02.821Z",
+          "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project",
+          "firstFoundAt": "2025-10-08T10:41:05.933+00:00",
+          "defaultBranch": "refs/heads/test-fossa-scans",
+          "latest": false,
+          "revisionId": "custom+1234/example-validation-project$12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux",
+          "revisionScanId": 106820047
+        }
+      ],
+      "url": "https://app.fossa.com/projects/custom%2B6060%2Fexample-validation-project/refs/branch/refs%2Fheads%2Fmaster/12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux/issues/vulnerability/10198614?revisionScanId=106820047",
+      "vulnId": "CVE-2025-50181_pip+urllib3",
+      "title": "URL Redirection to Untrusted Site ('Open Redirect')",
+      "cve": "CVE-2025-50181",
+      "cvss": 5.3,
+      "severity": "medium",
+      "details": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
+      "remediation": {
+        "partialFix": "2.5.0",
+        "partialFixDistance": "MAJOR",
+        "completeFix": "2.7.0",
+        "completeFixDistance": "MAJOR"
+      },
+      "metrics": [
+        {
+          "name": "Attack Vector",
+          "value": "Network"
+        },
+        {
+          "name": "Attack Complexity",
+          "value": "High"
+        },
+        {
+          "name": "Privileges Required",
+          "value": "Low"
+        },
+        {
+          "name": "User Interaction",
+          "value": "None"
+        },
+        {
+          "name": "Scope",
+          "value": "Unchanged"
+        },
+        {
+          "name": "Confidentiality Impact",
+          "value": "High"
+        },
+        {
+          "name": "Integrity Impact",
+          "value": "None"
+        },
+        {
+          "name": "Availability Impact",
+          "value": "None"
+        }
+      ],
+      "cveStatus": "COMPLETED",
+      "cwes": [
+        "CWE-601"
+      ],
+      "published": "2025-06-18T17:50:00Z",
+      "affectedVersionRanges": [
+        "<2.5.0"
+      ],
+      "patchedVersionRanges": [
+        "2.5.0"
+      ],
+      "references": [
+        "https://github.com/advisories/GHSA-pq67-6m6q-mj2v",
+        "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857",
+        "https://github.com/urllib3/urllib3/releases/tag/2.5.0",
+        "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v",
+        "https://pypi.org/project/urllib3/"
+      ],
+      "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+      "exploitability": "UNKNOWN",
+      "epss": {
+        "score": 0.00079,
+        "percentile": 0.23201
+      },
+      "cpes": [],
+      "customRiskScore": null
+    }
+  ],
+  "licensing": [],
+  "quality": []
+}
diff --git a/tests/fixtures/fossa/fossa-sbom-empty-deep.json b/tests/fixtures/fossa/fossa-sbom-empty-deep.json
new file mode 100644
index 0000000..f3cf63e
--- /dev/null
+++ b/tests/fixtures/fossa/fossa-sbom-empty-deep.json
@@ -0,0 +1 @@
+{"copyrightsByLicense":{"MIT":["2013 Fatih Arslan","2016 Yasuhiro Matsumoto","Yasuhiro MATSUMOTO <mattn.jp@gmail.com>"]},"deepDependencies":[{"authors":["mattn","hymkor","koron","alecrabbit","dolmen","tklauser","ikedam","toshimaru","mislav","ncw","aviau","cenkalti","whereswaldon","secDre4mer","alexandear","radeksimko","segrey","magicshui","filimonov","naoyukis","rbtnn","tyru","uji"],"dependencyPaths":["github.com/fatih/color > github.com/mattn/go-colorable"],"description":"Cached by the Go Module Proxy at Wed, 29 Sep 2021 16:02:39 GMT","downloadUrl":"https://proxy.golang.org/github.com/mattn/go-colorable/@v/v0.1.9.zip","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2016 Yasuhiro Matsumoto\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","name":"MIT"}],"notes":[],"otherLicenses":[],"package":"github.com/mattn/go-colorable","projectUrl":"http://godoc.org/github.com/mattn/go-colorable","source":"go","title":"github.com/mattn/go-colorable","version":"v0.1.9"},{"authors":["mattn","tklauser","thesyncim","dolmen","renovate[bot]","shogo82148","aeppert","grafov","carlosedp","mysqto","dkegel-fastly","dmgk","ddevault","Mischi","fatih","cookieY","lgonzalez-silen","mahdi-hm","marcauberer","martinlindhe","ncw","radeksimko","sthibaul","CaptainCodeman","tjni","stuartnelson3"],"dependencyPaths":["github.com/fatih/color > github.com/mattn/go-colorable > github.com/mattn/go-isatty","github.com/fatih/color > github.com/mattn/go-isatty"],"description":"Cached by the Go Module Proxy at Sun, 29 Aug 2021 14:41:14 GMT","downloadUrl":"https://proxy.golang.org/github.com/mattn/go-isatty/@v/v0.0.14.zip","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c)  Yasuhiro MATSUMOTO <mattn.jp@gmail.com>\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","name":"MIT"}],"notes":[],"otherLicenses":[],"package":"github.com/mattn/go-isatty","projectUrl":"http://godoc.org/github.com/mattn/go-isatty","source":"go","title":"github.com/mattn/go-isatty","version":"v0.0.14"}],"directDependencies":[{"authors":["fatih","dependabot[bot]","gregpoirson","pellared","n10v","sashamelentyev","bl-ue","zddhub","ataypamart","pattmax00","qualidafial","martinlindhe","msabramo","rhysd","Tonkpils","klauspost","jeffwillette","hackebrot","sinan","tliron","morfu","mattn","majiayu000","UnSubble","ilyabrin","hyunsooda","hermanschaaf","DrKhyz","EdwardBetts","dmitris","cenkalti","moorereason","andrewaustin","deining","AlekSi","klaidliadon","ahmetb","achilleas-k"],"dependencyPaths":["github.com/fatih/color"],"description":"Color package for Go (golang)","downloadUrl":"https://proxy.golang.org/github.com/fatih/color/@v/v1.13.0.zip","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2013 Fatih Arslan\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","name":"MIT"}],"notes":[],"otherLicenses":[],"package":"github.com/fatih/color","projectUrl":"https://pkg.go.dev/github.com/fatih/color","source":"go","title":"github.com/fatih/color","version":"v1.13.0"}],"licenses":{"MIT":"MIT License\nCopyright (c) <year> <copyright holders>\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."},"project":{"name":"example-validation-project","revision":"12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-go-windows"}}
\ No newline at end of file
diff --git a/tests/fixtures/fossa/fossa-sbom-populated.json b/tests/fixtures/fossa/fossa-sbom-populated.json
new file mode 100644
index 0000000..303f92c
--- /dev/null
+++ b/tests/fixtures/fossa/fossa-sbom-populated.json
@@ -0,0 +1 @@
+{"copyrightsByLicense":{"Apache-2.0":["Amazon.com, Inc. or its affiliates. All Rights Reserved."," Amazon.com, Inc. or its affiliates. All Rights Reserved.","2015 Google Inc. All rights reserved."],"BSD-3-Clause":["2013-2023 Kim Davies and contributors.","2022 Intel Corporation","2023 Intel Corporation","2019 Google LLC","2024 Arm Limited and/or its affiliates <open-source-office@arm.com>","2022-2023 Intel Corporation","2021 Serge Sans Paille","2010 Jonathan Hartley","2014 Bibek Kafle and Roland Shoemaker","2014 John MacFarlane","Individual contributors.","2015 The Go Authors. All rights reserved."," Individual contributors.","2005-2020 NumPy Developers."],"CC-BY-SA-4.0":[],"IETF":[],"MIT":["2020 Will McGugan"," Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com)","2012-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.","2012-2013 Mitch Garnaat http://garnaat.org/","2012-2013 Amazon.com, Inc. or its affiliates. All Rights Reserved.","2016 Amazon.com, Inc. or its affiliates. All Rights Reserved.","2013 Amazon.com, Inc. or its affiliates. All Rights Reserved.","2013 Kenneth Reitz","2008-2011 Andrey Petrov and contributors (see CONTRIBUTORS.txt),","2012 Kenneth Reitz.","2010-2020 Benjamin Peterson","2008-2020 Andrey Petrov and contributors (see CONTRIBUTORS.txt)","2015-2016 Will Bond <will@wbond.net>","2012 Senko Rasic <senko.rasic@dobarkod.hr>","2008-2020 Andrey Petrov and contributors.","2019 TAHRI Ahmed R."],"MPL-2.0":["2012-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.","2019-2022 Pyodide contributors and Mozilla","2013 Kenneth Reitz","2008-2011 Andrey Petrov and contributors (see CONTRIBUTORS.txt),","2012 Kenneth Reitz."]},"deepDependencies":[{"authors":["me@kennethreitz.com"],"dependencyPaths":["requests > certifi"],"description":"Python package for providing Mozilla's CA Bundle.","downloadUrl":"https://files.pythonhosted.org/packages/d4/91/c89518dd4fe1f3a4e3f6ab7ff23cb00ef2e8c9adf99dacc618ad5e068e28/certifi-2023.11.17.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"This package contains a modified version of ca-bundle.crt:\n\nca-bundle.crt -- Bundle of CA Root Certificates\n\nThis is a bundle of X.509 certificates of public Certificate Authorities\n(CA). These were automatically extracted from Mozilla's root certificates\nfile (certdata.txt).  This file can be found in the mozilla source tree:\nhttps://hg.mozilla.org/mozilla-central/file/tip/security/nss/lib/ckfw/builtins/certdata.txt\nIt contains the certificates in PEM format and therefore\ncan be directly used with curl / libcurl / php_curl, or with\nan Apache+mod_ssl webserver for SSL client authentication.\nJust configure this file as the SSLCACertificateFile.#\n\n***** BEGIN LICENSE BLOCK *****\nThis Source Code Form is subject to the terms of the Mozilla Public License,\nv. 2.0. If a copy of the MPL was not distributed with this file, You can obtain\none at http://mozilla.org/MPL/2.0/.\n\n***** END LICENSE BLOCK *****\n@(#) $RCSfile: certdata.txt,v $ $Revision: 1.80 $ $Date: 2011/11/03 15:11:58 $\n","name":"MPL-2.0"}],"notes":[],"otherLicenses":[],"package":"certifi","projectUrl":"https://github.com/certifi/python-certifi","source":"pip","title":"certifi","version":"2023.11.17"},{"authors":["\"Ahmed R. TAHRI\" <tahri.ahmed@proton.me>"],"dependencyPaths":["requests > charset-normalizer"],"description":"The Real First Universal Charset Detector. Open, modern and actively maintained alternative to Chardet.","downloadUrl":"https://files.pythonhosted.org/packages/56/31/7bcaf657fafb3c6db8c787a865434290b726653c912085fbd371e9b92e1c/charset-normalizer-2.0.12.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"MIT License\n\nCopyright (c) 2019 TAHRI Ahmed R.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","name":"MIT"}],"notes":[],"otherLicenses":[],"package":"charset-normalizer","projectUrl":"https://pypi.org/project/charset-normalizer/","source":"pip","title":"charset-normalizer","version":"2.0.12"},{"authors":["Jonathan Hartley <tartley@tartley.com>"],"dependencyPaths":["rich > colorama"],"description":"Cross-platform colored terminal text.","downloadUrl":"https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2010 Jonathan Hartley\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n* Redistributions of source code must retain the above copyright notice, this\n  list of conditions and the following disclaimer.\n\n* Redistributions in binary form must reproduce the above copyright notice,\n  this list of conditions and the following disclaimer in the documentation\n  and/or other materials provided with the distribution.\n\n* Neither the name of the copyright holders, nor those of its contributors\n  may be used to endorse or promote products derived from this software without\n  specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\nFOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\nDAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\nSERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\nCAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\nOR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n","name":"BSD-3-Clause"}],"notes":[],"otherLicenses":[],"package":"colorama","projectUrl":"https://pypi.org/project/colorama/","source":"pip","title":"colorama","version":"0.4.6"},{"authors":["rolandshoemaker@gmail.com"],"dependencyPaths":["rich > commonmark"],"description":"commonmark.py\n=============\n\ncommonmark.py is a pure Python port of `jgm <https://github.com/jgm>`__'s\n`commonmark.js <https://github.com/jgm/commonmark.js>`__, a\nMarkdown parser and renderer for the\n`CommonMark <http://commonmark.org>`__ specification, using only native\nmodules. Once both this project and the CommonMark specification are\nstable we will release the first ``1.0`` version and attempt to keep up\nto date with changes in ``commonmark.js``.\n\ncommonmark.py is tested against the CommonMark spec with Python versions\n2.7, 3.4, 3.5, 3.6, and 3.7.\n\n**Current version:** 0.9.1\n\n|Pypi Link| |Build Status| |Doc Link|\n\nInstallation\n------------\n\n::\n\n    $ pip install commonmark\n\nUsage\n-----\n\n::\n\n    >>> import commonmark\n    >>> commonmark.commonmark('*hello!*')\n    '<p><em>hello!</em></p>\\n'\n\nOr, without the syntactic sugar:\n\n.. code:: python\n\n    import commonmark\n    parser = commonmark.Parser()\n    ast = parser.parse(\"Hello *World*\")\n\n    renderer = commonmark.HtmlRenderer()\n    html = renderer.render(ast)\n    print(html) # <p>Hello <em>World</em><p/>\n\n    # inspecting the abstract syntax tree\n    json = commonmark.dumpJSON(ast)\n    commonmark.dumpAST(ast) # pretty print generated AST structure\n\nThere is also a CLI:\n\n::\n\n    $ cmark README.md -o README.html\n    $ cmark README.md -o README.json -aj # output AST as JSON\n    $ cmark README.md -a # pretty print generated AST structure\n    $ cmark -h\n    usage: cmark [-h] [-o [O]] [-a] [-aj] [infile]\n\n    Process Markdown according to the CommonMark specification.\n\n    positional arguments:\n      infile      Input Markdown file to parse, defaults to stdin\n\n    optional arguments:\n      -h, --help  show this help message and exit\n      -o [O]      Output HTML/JSON file, defaults to stdout\n      -a          Print formatted AST\n      -aj         Output JSON AST\n\n\nContributing\n------------\n\nIf you would like to offer suggestions/optimizations/bugfixes through\npull requests please do! Also if you find an error in the\nparser/renderer that isn't caught by the current test suite please open\na new issue and I would also suggest you send the\n`commonmark.js <https://github.com/jgm/commonmark.js>`__ project\na pull request adding your test to the existing test suite.\n\nTests\n-----\n\nTo work on commonmark.py, you will need to be able to run the test suite to\nmake sure your changes don't break anything. To run the tests, you can do\nsomething like this:\n\n::\n\n   $ pyvenv venv\n   $ ./venv/bin/python setup.py develop test\n\nThe tests script, ``commonmark/tests/run_spec_tests.py``, is pretty much a devtool. As\nwell as running all the tests embedded in ``spec.txt`` it also allows you\nto run specific tests using the ``-t`` argument, provide information\nabout passed tests with ``-p``, percentage passed by category of test\nwith ``-s``, and enter markdown interactively with ``-i`` (In\ninteractive mode end a block by inputting a line with just ``end``, to\nquit do the same but with ``quit``). ``-d`` can be used to print call\ntracing.\n\n::\n\n    $ ./venv/bin/python commonmark/tests/run_spec_tests.py -h\n    usage: run_spec_tests.py [-h] [-t T] [-p] [-f] [-i] [-d] [-np] [-s]\n\n    script to run the CommonMark specification tests against the commonmark.py\n    parser.\n\n    optional arguments:\n      -h, --help  show this help message and exit\n      -t T        Single test to run or comma separated list of tests (-t 10 or -t 10,11,12,13)\n      -p          Print passed test information\n      -f          Print failed tests (during -np...)\n      -i          Interactive Markdown input mode\n      -d          Debug, trace calls\n      -np         Only print section header, tick, or cross\n      -s          Print percent of tests passed by category\n\nAuthors\n-------\n\n-  `Bibek Kafle <https://github.com/kafle>`__\n-  `Roland Shoemaker <https://github.com/rolandshoemaker>`__\n-  `Nikolas Nyby <https://github.com/nikolas>`__\n\n.. |Pypi Link| image:: https://img.shields.io/pypi/v/commonmark.svg\n   :target: https://pypi.org/project/commonmark/\n\n.. |Build Status| image:: https://travis-ci.org/rtfd/commonmark.py.svg?branch=master\n   :target: https://travis-ci.org/rtfd/commonmark.py\n\n.. |Doc Link| image:: https://readthedocs.org/projects/commonmarkpy/badge/?version=latest\n   :target: https://commonmarkpy.readthedocs.io/en/latest/?badge=latest\n   :alt: Documentation Status\n\n\n","downloadUrl":"https://files.pythonhosted.org/packages/60/48/a60f593447e8f0894ebb7f6e6c1f25dafc5e89c5879fdc9360ae93ff83f0/commonmark-0.9.1.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2014, Bibek Kafle and Roland Shoemaker\r\n\r\nBased on stmd.js: Copyright (c) 2014, John MacFarlane\r\n\r\nAll rights reserved.\r\n\r\nRedistribution and use in source and binary forms, with or without\r\nmodification, are permitted provided that the following conditions are met:\r\n\r\n    * Redistributions of source code must retain the above copyright\r\n      notice, this list of conditions and the following disclaimer.\r\n\r\n    * Redistributions in binary form must reproduce the above\r\n      copyright notice, this list of conditions and the following\r\n      disclaimer in the documentation and/or other materials provided\r\n      with the distribution.\r\n\r\n    * Neither the names of Bibek Kafle, Roland Shoemaker nor the names of other\r\n      contributors may be used to endorse or promote products derived\r\n      from this software without specific prior written permission.\r\n\r\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\r\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\r\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\r\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\r\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\r\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\r\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\r\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\r\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\r\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\r\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.","name":"BSD-3-Clause"}],"notes":[],"otherLicenses":[{"attribution":"Attribution-ShareAlike 4.0 International<<endOptional>>\nUsing Creative Commons Public Licenses\nCreative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.\nConsiderations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors : wiki.creativecommons.org/Considerations_for_licensors\nConsiderations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor's permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described.\nAlthough not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public : wiki.creativecommons.org/Considerations_for_licensees\nCreative Commons Attribution-ShareAlike 4.0 International Public License\nBy exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License (\"Public License\"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.\nSection 1 – Definitions.\n   a. Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.\n   b. Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.\n   c. BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License.\n   d. Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.\n   e. Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.\n   f. Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.\n   g. License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike.\n   h. Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.\n   i. Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.\n   j. Licensor means the individual(s) or entity(ies) granting rights under this Public License.\n   k. Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.\n   l. Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.\n   m. You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.\nSection 2 – Scope.\n   a. License grant.\n      1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:\n         A. reproduce and Share the Licensed Material, in whole or in part; and\n         B. produce, reproduce, and Share Adapted Material.\n      2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.\n      3. Term. The term of this Public License is specified in Section 6(a).\n      4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.\n      5. Downstream recipients.\n         A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.\n         B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter's License You apply.\n         C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.\n      6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).\n   b. Other rights.\n      1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.\n      2. Patent and trademark rights are not licensed under this Public License.\n      3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.\nSection 3 – License Conditions.\nYour exercise of the Licensed Rights is expressly made subject to the following conditions.\n   a. Attribution.\n      1. If You Share the Licensed Material (including in modified form), You must:\n         A. retain the following if it is supplied by the Licensor with the Licensed Material:\n            i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);\n            ii. a copyright notice;\n            iii. a notice that refers to this Public License;\n            iv. a notice that refers to the disclaimer of warranties;\n            v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable;\n         B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and\n         C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.\n      2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.\n      3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.\n   b. ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply.\n      1. The Adapter's License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License.\n      2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material.\n      3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply.\nSection 4 – Sui Generis Database Rights.\nWhere the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:\n   a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;\n   b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and\n   c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.\n   For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.\nSection 5 – Disclaimer of Warranties and Limitation of Liability.\n   a. Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.\n   b. To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.\n   c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.\nSection 6 – Term and Termination.\n   a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.\n   b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:\n      1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or\n      2. upon express reinstatement by the Licensor.\n   c. For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.\n   d. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.\n   e. Sections 1, 5, 6, 7, and 8 survive termination of this Public License.\nSection 7 – Other Terms and Conditions.\n   a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.\n   b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.\nSection 8 – Interpretation.\n   a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.\n   b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.\n   c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.\n   d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.\nCreative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the \"Licensor.\" Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark \"Creative Commons\" or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.\nCreative Commons may be contacted at creativecommons.org.","name":"CC-BY-SA-4.0"}],"package":"commonmark","projectUrl":"https://github.com/rtfd/commonmark.py","source":"pip","title":"commonmark","version":"0.9.1"},{"authors":["Kim Davies <kim+pypi@gumleaf.org>"],"dependencyPaths":["requests > idna"],"description":"Internationalized Domain Names in Applications (IDNA)","downloadUrl":"https://files.pythonhosted.org/packages/bf/3f/ea4b9117521a1e9c50344b909be7886dd00a519552724809bb1f486986c2/idna-3.6.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"BSD 3-Clause License\n\nCopyright (c) 2013-2023, Kim Davies and contributors.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n1. Redistributions of source code must retain the above copyright\n   notice, this list of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright\n   notice, this list of conditions and the following disclaimer in the\n   documentation and/or other materials provided with the distribution.\n\n3. Neither the name of the copyright holder nor the names of its\n   contributors may be used to endorse or promote products derived from\n   this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nHOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED\nTO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR\nPROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF\nLIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\nNEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n","name":"BSD-3-Clause"}],"notes":[],"otherLicenses":[],"package":"idna","projectUrl":"https://pypi.org/project/idna/","source":"pip","title":"idna","version":"3.6"},{"authors":["Andrey Petrov <andrey.petrov@shazow.net>"],"dependencyPaths":["requests > urllib3"],"description":"HTTP library with thread-safe connection pooling, file post, and more.","downloadUrl":"https://files.pythonhosted.org/packages/e4/e8/6ff5e6bc22095cfc59b6ea711b687e2b7ed4bdb373f7eeec370a97d7392f/urllib3-1.26.20.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"MIT License\n\nCopyright (c) 2008-2020 Andrey Petrov and contributors (see CONTRIBUTORS.txt)\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n","name":"MIT"}],"notes":[],"otherLicenses":[{"attribution":"Copyright 2015 Google Inc. All rights reserved.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n\nSee the License for the specific language governing permissions and limitations under the License.","name":"Apache-2.0"}],"package":"urllib3","projectUrl":"https://pypi.org/project/urllib3/","source":"pip","title":"urllib3","version":"1.26.20"}],"directDependencies":[{"authors":["Amazon Web Services"],"dependencyPaths":["botocore"],"description":"Low-level, data-driven core of boto 3.","downloadUrl":"https://files.pythonhosted.org/packages/6d/a1/95ec376c2300e605225998619c46f7093c515710b9d6d65f891f126f32b6/botocore-1.43.12.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n\n   END OF TERMS AND CONDITIONS\n","name":"Apache-2.0"}],"notes":[],"otherLicenses":[{"attribution":"Copyright (c) 2012-2022 Amazon.com, Inc. or its affiliates. All Rights Reserved.\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","name":"MIT"},{"attribution":"1. Definitions\n      1.1. \"Contributor\" means each individual or legal entity that creates, contributes to the creation of, or owns Covered Software.\n      1.2. \"Contributor Version\" means the combination of the Contributions of others (if any) used by a Contributor and that particular Contributor's Contribution.\n      1.3. \"Contribution\" means Covered Software of a particular Contributor.\n      1.4. \"Covered Software\" means Source Code Form to which the initial Contributor has attached the notice in Exhibit A, the Executable Form of such Source Code Form, and Modifications of such Source Code Form, in each case including portions thereof.\n      1.5. \"Incompatible With Secondary Licenses\" means\n         (a) that the initial Contributor has attached the notice described in Exhibit B to the Covered Software; or\n         (b) that the Covered Software was made available under the terms of version 1.1 or earlier of the License, but not also under the terms of a Secondary License.\n      1.6. \"Executable Form\" means any form of the work other than Source Code Form.\n      1.7. \"Larger Work\" means a work that combines Covered Software with other material, in a separate file or files, that is not Covered Software.\n      1.8. \"License\" means this document.\n      1.9. \"Licensable\" means having the right to grant, to the maximum extent possible, whether at the time of the initial grant or subsequently, any and all of the rights conveyed by this License.\n      1.10. \"Modifications\" means any of the following:\n         (a) any file in Source Code Form that results from an addition to, deletion from, or modification of the contents of Covered Software; or\n         (b) any new file in Source Code Form that contains any Covered Software.\n      1.11. \"Patent Claims\" of a Contributor means any patent claim(s), including without limitation, method, process, and apparatus claims, in any patent Licensable by such Contributor that would be infringed, but for the grant of the License, by the making, using, selling, offering for sale, having made, import, or transfer of either its Contributions or its Contributor Version.\n      1.12. \"Secondary License\" means either the GNU General Public License, Version 2.0, the GNU Lesser General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any later versions of those licenses.\n      1.13. \"Source Code Form\" means the form of the work preferred for making modifications.\n      1.14. \"You\" (or \"Your\") means an individual or a legal entity exercising rights under this License. For legal entities, \"You\" includes any entity that controls, is controlled by, or is under common control with You. For purposes of this definition, \"control\" means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.\n   2. License Grants and Conditions\n      2.1. Grants\n      Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:\n         (a) under intellectual property rights (other than patent or trademark) Licensable by such Contributor to use, reproduce, make available, modify, display, perform, distribute, and otherwise exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger Work; and\n         (b) under Patent Claims of such Contributor to make, use, sell, offer for sale, have made, import, and otherwise transfer either its Contributions or its Contributor Version.\n      2.2. Effective Date\n      The licenses granted in Section 2.1 with respect to any Contribution become effective for each Contribution on the date the Contributor first distributes such Contribution.\n      2.3. Limitations on Grant Scope\n      The licenses granted in this Section 2 are the only rights granted under this License. No additional rights or licenses will be implied from the distribution or licensing of Covered Software under this License. Notwithstanding Section 2.1(b) above, no patent license is granted by a Contributor:\n         (a) for any code that a Contributor has removed from Covered Software; or\n         (b) for infringements caused by: (i) Your and any other third party's modifications of Covered Software, or (ii) the combination of its Contributions with other software (except as part of its Contributor Version); or\n         (c) under Patent Claims infringed by Covered Software in the absence of its Contributions.\n      This License does not grant any rights in the trademarks, service marks, or logos of any Contributor (except as may be necessary to comply with the notice requirements in Section 3.4).\n      2.4. Subsequent Licenses\n      No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this License (see Section 10.2) or under the terms of a Secondary License (if permitted under the terms of Section 3.3).\n      2.5. Representation\n      Each Contributor represents that the Contributor believes its Contributions are its original creation(s) or it has sufficient rights to grant the rights to its Contributions conveyed by this License.\n      2.6. Fair Use\n      This License is not intended to limit any rights You have under applicable copyright doctrines of fair use, fair dealing, or other equivalents.\n      2.7. Conditions\n      Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in Section 2.1.\n   3. Responsibilities\n      3.1. Distribution of Source Form\n      All distribution of Covered Software in Source Code Form, including any Modifications that You create or to which You contribute, must be under the terms of this License. You must inform recipients that the Source Code Form of the Covered Software is governed by the terms of this License, and how they can obtain a copy of this License. You may not attempt to alter or restrict the recipients' rights in the Source Code Form.\n      3.2. Distribution of Executable Form\n      If You distribute Covered Software in Executable Form then:\n         (a) such Covered Software must also be made available in Source Code Form, as described in Section 3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution to the recipient; and\n         (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the license for the Executable Form does not attempt to limit or alter the recipients' rights in the Source Code Form under this License.\n      3.3. Distribution of a Larger Work\n      You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered Software with a work governed by one or more Secondary Licenses, and the Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered Software under the terms of either this License or such Secondary License(s).\n      3.4. Notices\n      You may not remove or alter the substance of any license notices (including copyright notices, patent notices, disclaimers of warranty, or limitations of liability) contained within the Source Code Form of the Covered Software, except that You may alter any license notices to the extent required to remedy known factual inaccuracies.\n      3.5. Application of Additional Terms\n      You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, You may do so only on Your own behalf, and not on behalf of any Contributor. You must make it absolutely clear that any such warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree to indemnify every Contributor for any liability incurred by such Contributor as a result of warranty, support, indemnity or liability terms You offer. You may include additional disclaimers of warranty and limitations of liability specific to any jurisdiction.\n   4. Inability to Comply Due to Statute or Regulation\n   If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be placed in a text file included with all distributions of the Covered Software under this License. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it.\n   5. Termination\n      5.1. The rights granted under this License will terminate automatically if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such Contributor explicitly and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor notifies You of the non-compliance by some reasonable means, this is the first time You have received notice of non-compliance with this License from such Contributor, and You become compliant prior to 30 days after Your receipt of the notice.\n      5.2. If You initiate litigation against any entity by asserting a patent infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate.\n      5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user license agreements (excluding distributors and resellers) which have been validly granted by You or Your distributors under this License prior to termination shall survive termination.\n   6. Disclaimer of Warranty\n   Covered Software is provided under this License on an \"as is\" basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the Covered Software is free of defects, merchantable, fit for a particular purpose or non-infringing. The entire risk as to the quality and performance of the Covered Software is with You. Should any Covered Software prove defective in any respect, You (not any Contributor) assume the cost of any necessary servicing, repair, or correction. This disclaimer of warranty constitutes an essential part of this License. No use of any Covered Software is authorized under this License except under this disclaimer.\n   7. Limitation of Liability\n   Under no circumstances and under no legal theory, whether tort (including negligence), contract, or otherwise, shall any Contributor, or anyone who distributes Covered Software as permitted above, be liable to You for any direct, indirect, special, incidental, or consequential damages of any character including, without limitation, damages for lost profits, loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses, even if such party shall have been informed of the possibility of such damages. This limitation of liability shall not apply to liability for death or personal injury resulting from such party's negligence to the extent applicable law prohibits such limitation. Some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so this exclusion and limitation may not apply to You.\n   8. Litigation\n   Any litigation relating to this License may be brought only in the courts of a jurisdiction where the defendant maintains its principal place of business and such litigation shall be governed by laws of that jurisdiction, without reference to its conflict-of-law provisions. Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims.\n   9. Miscellaneous\n   This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor.\n   10. Versions of the License\n      10.1. New Versions\n      Mozilla Foundation is the license steward. Except as provided in Section 10.3, no one other than the license steward has the right to modify or publish new versions of this License. Each version will be given a distinguishing version number.\n      10.2. Effect of New Versions\n      You may distribute the Covered Software under the terms of the version of the License under which You originally received the Covered Software, or under the terms of any subsequent version published by the license steward.\n      10.3. Modified Versions\n      If you create software not governed by this License, and you want to create a new license for such software, you may create and use a modified version of this License if you rename the license and remove any references to the name of the license steward (except to note that such modified license differs from this License).\n      10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses\n      If You choose to distribute Source Code Form that is Incompatible With Secondary Licenses under the terms of this version of the License, the notice described in Exhibit B of this License must be attached.","name":"MPL-2.0"}],"package":"botocore","projectUrl":"https://github.com/boto/botocore","source":"pip","title":"botocore","version":"1.43.12"},{"authors":["The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>"],"dependencyPaths":["cryptography"],"description":"cryptography is a package which provides cryptographic recipes and primitives to Python developers.","downloadUrl":"https://files.pythonhosted.org/packages/9f/a9/db8f313fdcd85d767d4973515e1db101f9c71f95fced83233de224673757/cryptography-48.0.0.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) Individual contributors.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n    1. Redistributions of source code must retain the above copyright notice,\n       this list of conditions and the following disclaimer.\n\n    2. Redistributions in binary form must reproduce the above copyright\n       notice, this list of conditions and the following disclaimer in the\n       documentation and/or other materials provided with the distribution.\n\n    3. Neither the name of PyCA Cryptography nor the names of its contributors\n       may be used to endorse or promote products derived from this software\n       without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n","name":"BSD-3-Clause"},{"attribution":"This software is made available under the terms of *either* of the licenses\nfound in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made\nunder the terms of *both* these licenses.\n","name":"Apache-2.0"}],"notes":[],"otherLicenses":[{"attribution":"This repository relates to activities in the Internet Engineering Task Force (IETF). All material in this repository is considered Contributions to the IETF Standards Process, as defined in the intellectual property policies of IETF currently designated as BCP 78, BCP 79 and the IETF Trust Legal Provisions (TLP) Relating to IETF Documents.\n\nAny edit, commit, pull request, issue, comment or other change made to this repository constitutes Contributions to the IETF Standards Process (https://www.ietf.org/).\n\nYou agree to comply with all applicable IETF policies and procedures, including, BCP 78, 79, the TLP, and the TLP rules regarding code components (e.g. being subject to a Simplified BSD License) in Contributions.","name":"IETF"}],"package":"cryptography","projectUrl":"https://pypi.org/project/cryptography/","source":"pip","title":"cryptography","version":"48.0.0"},{"authors":[],"dependencyPaths":["numpy"],"description":null,"downloadUrl":"https://files.pythonhosted.org/packages/d0/ad/fed0499ce6a338d2a03ebae59cd15093910c8875328855781952abf6c2fe/numpy-2.4.6.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2005-2020, NumPy Developers.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are\nmet:\n\n    * Redistributions of source code must retain the above copyright\n       notice, this list of conditions and the following disclaimer.\n\n    * Redistributions in binary form must reproduce the above\n       copyright notice, this list of conditions and the following\n       disclaimer in the documentation and/or other materials provided\n       with the distribution.\n\n    * Neither the name of the NumPy Developers nor the names of any\n       contributors may be used to endorse or promote products derived\n       from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS\n\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT\nLIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\nA PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT\nOWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\nSPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT\nLIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\nDATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY\nTHEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\nOF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.","name":"BSD-3-Clause"}],"notes":[],"otherLicenses":[],"package":"numpy","projectUrl":null,"source":"pip","title":"numpy","version":"2.4.6"},{"authors":["Kenneth Reitz <me@kennethreitz.org>"],"dependencyPaths":["requests"],"description":"Python HTTP for Humans.","downloadUrl":"https://files.pythonhosted.org/packages/60/f3/26ff3767f099b73e0efa138a9998da67890793bfa475d8278f84a30fec77/requests-2.27.1.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"\n                                 Apache License\n                           Version 2.0, January 2004\n                        http://www.apache.org/licenses/\n\n   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION\n\n   1. Definitions.\n\n      \"License\" shall mean the terms and conditions for use, reproduction,\n      and distribution as defined by Sections 1 through 9 of this document.\n\n      \"Licensor\" shall mean the copyright owner or entity authorized by\n      the copyright owner that is granting the License.\n\n      \"Legal Entity\" shall mean the union of the acting entity and all\n      other entities that control, are controlled by, or are under common\n      control with that entity. For the purposes of this definition,\n      \"control\" means (i) the power, direct or indirect, to cause the\n      direction or management of such entity, whether by contract or\n      otherwise, or (ii) ownership of fifty percent (50%) or more of the\n      outstanding shares, or (iii) beneficial ownership of such entity.\n\n      \"You\" (or \"Your\") shall mean an individual or Legal Entity\n      exercising permissions granted by this License.\n\n      \"Source\" form shall mean the preferred form for making modifications,\n      including but not limited to software source code, documentation\n      source, and configuration files.\n\n      \"Object\" form shall mean any form resulting from mechanical\n      transformation or translation of a Source form, including but\n      not limited to compiled object code, generated documentation,\n      and conversions to other media types.\n\n      \"Work\" shall mean the work of authorship, whether in Source or\n      Object form, made available under the License, as indicated by a\n      copyright notice that is included in or attached to the work\n      (an example is provided in the Appendix below).\n\n      \"Derivative Works\" shall mean any work, whether in Source or Object\n      form, that is based on (or derived from) the Work and for which the\n      editorial revisions, annotations, elaborations, or other modifications\n      represent, as a whole, an original work of authorship. For the purposes\n      of this License, Derivative Works shall not include works that remain\n      separable from, or merely link (or bind by name) to the interfaces of,\n      the Work and Derivative Works thereof.\n\n      \"Contribution\" shall mean any work of authorship, including\n      the original version of the Work and any modifications or additions\n      to that Work or Derivative Works thereof, that is intentionally\n      submitted to Licensor for inclusion in the Work by the copyright owner\n      or by an individual or Legal Entity authorized to submit on behalf of\n      the copyright owner. For the purposes of this definition, \"submitted\"\n      means any form of electronic, verbal, or written communication sent\n      to the Licensor or its representatives, including but not limited to\n      communication on electronic mailing lists, source code control systems,\n      and issue tracking systems that are managed by, or on behalf of, the\n      Licensor for the purpose of discussing and improving the Work, but\n      excluding communication that is conspicuously marked or otherwise\n      designated in writing by the copyright owner as \"Not a Contribution.\"\n\n      \"Contributor\" shall mean Licensor and any individual or Legal Entity\n      on behalf of whom a Contribution has been received by Licensor and\n      subsequently incorporated within the Work.\n\n   2. Grant of Copyright License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      copyright license to reproduce, prepare Derivative Works of,\n      publicly display, publicly perform, sublicense, and distribute the\n      Work and such Derivative Works in Source or Object form.\n\n   3. Grant of Patent License. Subject to the terms and conditions of\n      this License, each Contributor hereby grants to You a perpetual,\n      worldwide, non-exclusive, no-charge, royalty-free, irrevocable\n      (except as stated in this section) patent license to make, have made,\n      use, offer to sell, sell, import, and otherwise transfer the Work,\n      where such license applies only to those patent claims licensable\n      by such Contributor that are necessarily infringed by their\n      Contribution(s) alone or by combination of their Contribution(s)\n      with the Work to which such Contribution(s) was submitted. If You\n      institute patent litigation against any entity (including a\n      cross-claim or counterclaim in a lawsuit) alleging that the Work\n      or a Contribution incorporated within the Work constitutes direct\n      or contributory patent infringement, then any patent licenses\n      granted to You under this License for that Work shall terminate\n      as of the date such litigation is filed.\n\n   4. Redistribution. You may reproduce and distribute copies of the\n      Work or Derivative Works thereof in any medium, with or without\n      modifications, and in Source or Object form, provided that You\n      meet the following conditions:\n\n      (a) You must give any other recipients of the Work or\n          Derivative Works a copy of this License; and\n\n      (b) You must cause any modified files to carry prominent notices\n          stating that You changed the files; and\n\n      (c) You must retain, in the Source form of any Derivative Works\n          that You distribute, all copyright, patent, trademark, and\n          attribution notices from the Source form of the Work,\n          excluding those notices that do not pertain to any part of\n          the Derivative Works; and\n\n      (d) If the Work includes a \"NOTICE\" text file as part of its\n          distribution, then any Derivative Works that You distribute must\n          include a readable copy of the attribution notices contained\n          within such NOTICE file, excluding those notices that do not\n          pertain to any part of the Derivative Works, in at least one\n          of the following places: within a NOTICE text file distributed\n          as part of the Derivative Works; within the Source form or\n          documentation, if provided along with the Derivative Works; or,\n          within a display generated by the Derivative Works, if and\n          wherever such third-party notices normally appear. The contents\n          of the NOTICE file are for informational purposes only and\n          do not modify the License. You may add Your own attribution\n          notices within Derivative Works that You distribute, alongside\n          or as an addendum to the NOTICE text from the Work, provided\n          that such additional attribution notices cannot be construed\n          as modifying the License.\n\n      You may add Your own copyright statement to Your modifications and\n      may provide additional or different license terms and conditions\n      for use, reproduction, or distribution of Your modifications, or\n      for any such Derivative Works as a whole, provided Your use,\n      reproduction, and distribution of the Work otherwise complies with\n      the conditions stated in this License.\n\n   5. Submission of Contributions. Unless You explicitly state otherwise,\n      any Contribution intentionally submitted for inclusion in the Work\n      by You to the Licensor shall be under the terms and conditions of\n      this License, without any additional terms or conditions.\n      Notwithstanding the above, nothing herein shall supersede or modify\n      the terms of any separate license agreement you may have executed\n      with Licensor regarding such Contributions.\n\n   6. Trademarks. This License does not grant permission to use the trade\n      names, trademarks, service marks, or product names of the Licensor,\n      except as required for reasonable and customary use in describing the\n      origin of the Work and reproducing the content of the NOTICE file.\n\n   7. Disclaimer of Warranty. Unless required by applicable law or\n      agreed to in writing, Licensor provides the Work (and each\n      Contributor provides its Contributions) on an \"AS IS\" BASIS,\n      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or\n      implied, including, without limitation, any warranties or conditions\n      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A\n      PARTICULAR PURPOSE. You are solely responsible for determining the\n      appropriateness of using or redistributing the Work and assume any\n      risks associated with Your exercise of permissions under this License.\n\n   8. Limitation of Liability. In no event and under no legal theory,\n      whether in tort (including negligence), contract, or otherwise,\n      unless required by applicable law (such as deliberate and grossly\n      negligent acts) or agreed to in writing, shall any Contributor be\n      liable to You for damages, including any direct, indirect, special,\n      incidental, or consequential damages of any character arising as a\n      result of this License or out of the use or inability to use the\n      Work (including but not limited to damages for loss of goodwill,\n      work stoppage, computer failure or malfunction, or any and all\n      other commercial damages or losses), even if such Contributor\n      has been advised of the possibility of such damages.\n\n   9. Accepting Warranty or Additional Liability. While redistributing\n      the Work or Derivative Works thereof, You may choose to offer,\n      and charge a fee for, acceptance of support, warranty, indemnity,\n      or other liability obligations and/or rights consistent with this\n      License. However, in accepting such obligations, You may act only\n      on Your own behalf and on Your sole responsibility, not on behalf\n      of any other Contributor, and only if You agree to indemnify,\n      defend, and hold each Contributor harmless for any liability\n      incurred by, or claims asserted against, such Contributor by reason\n      of your accepting any such warranty or additional liability.\n","name":"Apache-2.0"}],"notes":[],"otherLicenses":[],"package":"requests","projectUrl":"https://pypi.org/project/requests/","source":"pip","title":"requests","version":"2.27.1"},{"authors":["willmcgugan@gmail.com"],"dependencyPaths":["rich"],"description":"Render rich text, tables, progress bars, syntax highlighting, markdown and more to the terminal","downloadUrl":"https://files.pythonhosted.org/packages/eb/be/bd5d6c37f5de55f31cb9432e0d926ceeab1b2ee774bd696557b53bc15012/rich-11.0.0.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"Copyright (c) 2020 Will McGugan\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n","name":"MIT"}],"notes":[],"otherLicenses":[],"package":"rich","projectUrl":"https://pypi.org/project/rich/","source":"pip","title":"rich","version":"11.0.0"},{"authors":["Andrey Petrov <andrey.petrov@shazow.net>"],"dependencyPaths":["urllib3"],"description":"HTTP library with thread-safe connection pooling, file post, and more.","downloadUrl":"https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz","hash":null,"isGolang":null,"licenses":[{"attribution":"MIT License\n\nCopyright (c) 2008-2020 Andrey Petrov and contributors.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n","name":"MIT"}],"notes":[],"otherLicenses":[{"attribution":"1. Definitions\n      1.1. \"Contributor\" means each individual or legal entity that creates, contributes to the creation of, or owns Covered Software.\n      1.2. \"Contributor Version\" means the combination of the Contributions of others (if any) used by a Contributor and that particular Contributor's Contribution.\n      1.3. \"Contribution\" means Covered Software of a particular Contributor.\n      1.4. \"Covered Software\" means Source Code Form to which the initial Contributor has attached the notice in Exhibit A, the Executable Form of such Source Code Form, and Modifications of such Source Code Form, in each case including portions thereof.\n      1.5. \"Incompatible With Secondary Licenses\" means\n         (a) that the initial Contributor has attached the notice described in Exhibit B to the Covered Software; or\n         (b) that the Covered Software was made available under the terms of version 1.1 or earlier of the License, but not also under the terms of a Secondary License.\n      1.6. \"Executable Form\" means any form of the work other than Source Code Form.\n      1.7. \"Larger Work\" means a work that combines Covered Software with other material, in a separate file or files, that is not Covered Software.\n      1.8. \"License\" means this document.\n      1.9. \"Licensable\" means having the right to grant, to the maximum extent possible, whether at the time of the initial grant or subsequently, any and all of the rights conveyed by this License.\n      1.10. \"Modifications\" means any of the following:\n         (a) any file in Source Code Form that results from an addition to, deletion from, or modification of the contents of Covered Software; or\n         (b) any new file in Source Code Form that contains any Covered Software.\n      1.11. \"Patent Claims\" of a Contributor means any patent claim(s), including without limitation, method, process, and apparatus claims, in any patent Licensable by such Contributor that would be infringed, but for the grant of the License, by the making, using, selling, offering for sale, having made, import, or transfer of either its Contributions or its Contributor Version.\n      1.12. \"Secondary License\" means either the GNU General Public License, Version 2.0, the GNU Lesser General Public License, Version 2.1, the GNU Affero General Public License, Version 3.0, or any later versions of those licenses.\n      1.13. \"Source Code Form\" means the form of the work preferred for making modifications.\n      1.14. \"You\" (or \"Your\") means an individual or a legal entity exercising rights under this License. For legal entities, \"You\" includes any entity that controls, is controlled by, or is under common control with You. For purposes of this definition, \"control\" means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of more than fifty percent (50%) of the outstanding shares or beneficial ownership of such entity.\n   2. License Grants and Conditions\n      2.1. Grants\n      Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license:\n         (a) under intellectual property rights (other than patent or trademark) Licensable by such Contributor to use, reproduce, make available, modify, display, perform, distribute, and otherwise exploit its Contributions, either on an unmodified basis, with Modifications, or as part of a Larger Work; and\n         (b) under Patent Claims of such Contributor to make, use, sell, offer for sale, have made, import, and otherwise transfer either its Contributions or its Contributor Version.\n      2.2. Effective Date\n      The licenses granted in Section 2.1 with respect to any Contribution become effective for each Contribution on the date the Contributor first distributes such Contribution.\n      2.3. Limitations on Grant Scope\n      The licenses granted in this Section 2 are the only rights granted under this License. No additional rights or licenses will be implied from the distribution or licensing of Covered Software under this License. Notwithstanding Section 2.1(b) above, no patent license is granted by a Contributor:\n         (a) for any code that a Contributor has removed from Covered Software; or\n         (b) for infringements caused by: (i) Your and any other third party's modifications of Covered Software, or (ii) the combination of its Contributions with other software (except as part of its Contributor Version); or\n         (c) under Patent Claims infringed by Covered Software in the absence of its Contributions.\n      This License does not grant any rights in the trademarks, service marks, or logos of any Contributor (except as may be necessary to comply with the notice requirements in Section 3.4).\n      2.4. Subsequent Licenses\n      No Contributor makes additional grants as a result of Your choice to distribute the Covered Software under a subsequent version of this License (see Section 10.2) or under the terms of a Secondary License (if permitted under the terms of Section 3.3).\n      2.5. Representation\n      Each Contributor represents that the Contributor believes its Contributions are its original creation(s) or it has sufficient rights to grant the rights to its Contributions conveyed by this License.\n      2.6. Fair Use\n      This License is not intended to limit any rights You have under applicable copyright doctrines of fair use, fair dealing, or other equivalents.\n      2.7. Conditions\n      Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in Section 2.1.\n   3. Responsibilities\n      3.1. Distribution of Source Form\n      All distribution of Covered Software in Source Code Form, including any Modifications that You create or to which You contribute, must be under the terms of this License. You must inform recipients that the Source Code Form of the Covered Software is governed by the terms of this License, and how they can obtain a copy of this License. You may not attempt to alter or restrict the recipients' rights in the Source Code Form.\n      3.2. Distribution of Executable Form\n      If You distribute Covered Software in Executable Form then:\n         (a) such Covered Software must also be made available in Source Code Form, as described in Section 3.1, and You must inform recipients of the Executable Form how they can obtain a copy of such Source Code Form by reasonable means in a timely manner, at a charge no more than the cost of distribution to the recipient; and\n         (b) You may distribute such Executable Form under the terms of this License, or sublicense it under different terms, provided that the license for the Executable Form does not attempt to limit or alter the recipients' rights in the Source Code Form under this License.\n      3.3. Distribution of a Larger Work\n      You may create and distribute a Larger Work under terms of Your choice, provided that You also comply with the requirements of this License for the Covered Software. If the Larger Work is a combination of Covered Software with a work governed by one or more Secondary Licenses, and the Covered Software is not Incompatible With Secondary Licenses, this License permits You to additionally distribute such Covered Software under the terms of such Secondary License(s), so that the recipient of the Larger Work may, at their option, further distribute the Covered Software under the terms of either this License or such Secondary License(s).\n      3.4. Notices\n      You may not remove or alter the substance of any license notices (including copyright notices, patent notices, disclaimers of warranty, or limitations of liability) contained within the Source Code Form of the Covered Software, except that You may alter any license notices to the extent required to remedy known factual inaccuracies.\n      3.5. Application of Additional Terms\n      You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations to one or more recipients of Covered Software. However, You may do so only on Your own behalf, and not on behalf of any Contributor. You must make it absolutely clear that any such warranty, support, indemnity, or liability obligation is offered by You alone, and You hereby agree to indemnify every Contributor for any liability incurred by such Contributor as a result of warranty, support, indemnity or liability terms You offer. You may include additional disclaimers of warranty and limitations of liability specific to any jurisdiction.\n   4. Inability to Comply Due to Statute or Regulation\n   If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Covered Software due to statute, judicial order, or regulation then You must: (a) comply with the terms of this License to the maximum extent possible; and (b) describe the limitations and the code they affect. Such description must be placed in a text file included with all distributions of the Covered Software under this License. Except to the extent prohibited by statute or regulation, such description must be sufficiently detailed for a recipient of ordinary skill to be able to understand it.\n   5. Termination\n      5.1. The rights granted under this License will terminate automatically if You fail to comply with any of its terms. However, if You become compliant, then the rights granted under this License from a particular Contributor are reinstated (a) provisionally, unless and until such Contributor explicitly and finally terminates Your grants, and (b) on an ongoing basis, if such Contributor fails to notify You of the non-compliance by some reasonable means prior to 60 days after You have come back into compliance. Moreover, Your grants from a particular Contributor are reinstated on an ongoing basis if such Contributor notifies You of the non-compliance by some reasonable means, this is the first time You have received notice of non-compliance with this License from such Contributor, and You become compliant prior to 30 days after Your receipt of the notice.\n      5.2. If You initiate litigation against any entity by asserting a patent infringement claim (excluding declaratory judgment actions, counter-claims, and cross-claims) alleging that a Contributor Version directly or indirectly infringes any patent, then the rights granted to You by any and all Contributors for the Covered Software under Section 2.1 of this License shall terminate.\n      5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user license agreements (excluding distributors and resellers) which have been validly granted by You or Your distributors under this License prior to termination shall survive termination.\n   6. Disclaimer of Warranty\n   Covered Software is provided under this License on an \"as is\" basis, without warranty of any kind, either expressed, implied, or statutory, including, without limitation, warranties that the Covered Software is free of defects, merchantable, fit for a particular purpose or non-infringing. The entire risk as to the quality and performance of the Covered Software is with You. Should any Covered Software prove defective in any respect, You (not any Contributor) assume the cost of any necessary servicing, repair, or correction. This disclaimer of warranty constitutes an essential part of this License. No use of any Covered Software is authorized under this License except under this disclaimer.\n   7. Limitation of Liability\n   Under no circumstances and under no legal theory, whether tort (including negligence), contract, or otherwise, shall any Contributor, or anyone who distributes Covered Software as permitted above, be liable to You for any direct, indirect, special, incidental, or consequential damages of any character including, without limitation, damages for lost profits, loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses, even if such party shall have been informed of the possibility of such damages. This limitation of liability shall not apply to liability for death or personal injury resulting from such party's negligence to the extent applicable law prohibits such limitation. Some jurisdictions do not allow the exclusion or limitation of incidental or consequential damages, so this exclusion and limitation may not apply to You.\n   8. Litigation\n   Any litigation relating to this License may be brought only in the courts of a jurisdiction where the defendant maintains its principal place of business and such litigation shall be governed by laws of that jurisdiction, without reference to its conflict-of-law provisions. Nothing in this Section shall prevent a party's ability to bring cross-claims or counter-claims.\n   9. Miscellaneous\n   This License represents the complete agreement concerning the subject matter hereof. If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable. Any law or regulation which provides that the language of a contract shall be construed against the drafter shall not be used to construe this License against a Contributor.\n   10. Versions of the License\n      10.1. New Versions\n      Mozilla Foundation is the license steward. Except as provided in Section 10.3, no one other than the license steward has the right to modify or publish new versions of this License. Each version will be given a distinguishing version number.\n      10.2. Effect of New Versions\n      You may distribute the Covered Software under the terms of the version of the License under which You originally received the Covered Software, or under the terms of any subsequent version published by the license steward.\n      10.3. Modified Versions\n      If you create software not governed by this License, and you want to create a new license for such software, you may create and use a modified version of this License if you rename the license and remove any references to the name of the license steward (except to note that such modified license differs from this License).\n      10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses\n      If You choose to distribute Source Code Form that is Incompatible With Secondary Licenses under the terms of this version of the License, the notice described in Exhibit B of this License must be attached.","name":"MPL-2.0"}],"package":"urllib3","projectUrl":"https://pypi.org/project/urllib3/","source":"pip","title":"urllib3","version":"2.7.0"}],"licenses":{"Apache-2.0":"This software is made available under the terms of *either* of the licenses\nfound in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made\nunder the terms of *both* these licenses.\n","BSD-3-Clause":"Copyright (c) Individual contributors.\nAll rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n    1. Redistributions of source code must retain the above copyright notice,\n       this list of conditions and the following disclaimer.\n\n    2. Redistributions in binary form must reproduce the above copyright\n       notice, this list of conditions and the following disclaimer in the\n       documentation and/or other materials provided with the distribution.\n\n    3. Neither the name of PyCA Cryptography nor the names of its contributors\n       may be used to endorse or promote products derived from this software\n       without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\nANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\nWARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\nANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\nLOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\nANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\nSOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n","CC-BY-SA-4.0":"Creative Commons Attribution-ShareAlike 4.0 International Creative Commons Corporation (\"Creative Commons\") is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an \"as-is\" basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.\nUsing Creative Commons Public Licenses\nCreative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.\nConsiderations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors : wiki.creativecommons.org/Considerations_for_licensors\nConsiderations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor's permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described.\nAlthough not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public : wiki.creativecommons.org/Considerations_for_licensees\nCreative Commons Attribution-ShareAlike 4.0 International Public License\nBy exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-ShareAlike 4.0 International Public License (\"Public License\"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.\nSection 1 – Definitions.\n   a. Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.\n   b. Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.\n   c. BY-SA Compatible License means a license listed at creativecommons.org/compatiblelicenses, approved by Creative Commons as essentially the equivalent of this Public License.\n   d. Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.\n   e. Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.\n   f. Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.\n   g. License Elements means the license attributes listed in the name of a Creative Commons Public License. The License Elements of this Public License are Attribution and ShareAlike.\n   h. Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.\n   i. Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.\n   j. Licensor means the individual(s) or entity(ies) granting rights under this Public License.\n   k. Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.\n   l. Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.\n   m. You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.\nSection 2 – Scope.\n   a. License grant.\n      1. Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:\n         A. reproduce and Share the Licensed Material, in whole or in part; and\n         B. produce, reproduce, and Share Adapted Material.\n      2. Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.\n      3. Term. The term of this Public License is specified in Section 6(a).\n      4. Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.\n      5. Downstream recipients.\n         A. Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.\n         B. Additional offer from the Licensor – Adapted Material. Every recipient of Adapted Material from You automatically receives an offer from the Licensor to exercise the Licensed Rights in the Adapted Material under the conditions of the Adapter's License You apply.\n         C. No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.\n      6. No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).\n   b. Other rights.\n      1. Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.\n      2. Patent and trademark rights are not licensed under this Public License.\n      3. To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties.\nSection 3 – License Conditions.\nYour exercise of the Licensed Rights is expressly made subject to the following conditions.\n   a. Attribution.\n      1. If You Share the Licensed Material (including in modified form), You must:\n         A. retain the following if it is supplied by the Licensor with the Licensed Material:\n            i. identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);\n            ii. a copyright notice;\n            iii. a notice that refers to this Public License;\n            iv. a notice that refers to the disclaimer of warranties;\n            v. a URI or hyperlink to the Licensed Material to the extent reasonably practicable;\n         B. indicate if You modified the Licensed Material and retain an indication of any previous modifications; and\n         C. indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.\n      2. You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.\n      3. If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.\n   b. ShareAlike.In addition to the conditions in Section 3(a), if You Share Adapted Material You produce, the following conditions also apply.\n      1. The Adapter's License You apply must be a Creative Commons license with the same License Elements, this version or later, or a BY-SA Compatible License.\n      2. You must include the text of, or the URI or hyperlink to, the Adapter's License You apply. You may satisfy this condition in any reasonable manner based on the medium, means, and context in which You Share Adapted Material.\n      3. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, Adapted Material that restrict exercise of the rights granted under the Adapter's License You apply.\nSection 4 – Sui Generis Database Rights.\nWhere the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:\n   a. for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database;\n   b. if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material, including for purposes of Section 3(b); and\n   c. You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.\n   For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.\nSection 5 – Disclaimer of Warranties and Limitation of Liability.\n   a. Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.\n   b. To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.\n   c. The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.\nSection 6 – Term and Termination.\n   a. This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.\n   b. Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:\n      1. automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or\n      2. upon express reinstatement by the Licensor.\n   c. For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.\n   d. For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.\n   e. Sections 1, 5, 6, 7, and 8 survive termination of this Public License.\nSection 7 – Other Terms and Conditions.\n   a. The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.\n   b. Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.\nSection 8 – Interpretation.\n   a. For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.\n   b. To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.\n   c. No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.\n   d. Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.\nCreative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the \"Licensor.\" The text of the Creative Commons public licenses is dedicated to the public domain under the CC0 Public Domain Dedication. Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark \"Creative Commons\" or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.\nCreative Commons may be contacted at creativecommons.org.","IETF":"This repository relates to activities in the Internet Engineering Task Force (IETF). All material in this repository is considered Contributions to the IETF Standards Process, as defined in the intellectual property policies of IETF currently designated as BCP 78, BCP 79 and the IETF Trust Legal Provisions (TLP) Relating to IETF Documents.\n\nAny edit, commit, pull request, issue, comment or other change made to this repository constitutes Contributions to the IETF Standards Process (https://www.ietf.org/).\n\nYou agree to comply with all applicable IETF policies and procedures, including, BCP 78, 79, the TLP, and the TLP rules regarding code components (e.g. being subject to a Simplified BSD License) in Contributions.","MIT":"MIT License\n\nCopyright (c) 2019 TAHRI Ahmed R.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.","MPL-2.0":"This package contains a modified version of ca-bundle.crt:\n\nca-bundle.crt -- Bundle of CA Root Certificates\n\nThis is a bundle of X.509 certificates of public Certificate Authorities\n(CA). These were automatically extracted from Mozilla's root certificates\nfile (certdata.txt).  This file can be found in the mozilla source tree:\nhttps://hg.mozilla.org/mozilla-central/file/tip/security/nss/lib/ckfw/builtins/certdata.txt\nIt contains the certificates in PEM format and therefore\ncan be directly used with curl / libcurl / php_curl, or with\nan Apache+mod_ssl webserver for SSL client authentication.\nJust configure this file as the SSLCACertificateFile.#\n\n***** BEGIN LICENSE BLOCK *****\nThis Source Code Form is subject to the terms of the Mozilla Public License,\nv. 2.0. If a copy of the MPL was not distributed with this file, You can obtain\none at http://mozilla.org/MPL/2.0/.\n\n***** END LICENSE BLOCK *****\n@(#) $RCSfile: certdata.txt,v $ $Revision: 1.80 $ $Date: 2011/11/03 15:11:58 $\n"},"project":{"name":"example-validation-project","revision":"12109922-03cb9ead2f744dfa5506ec0c915423947ec2fe11-python-linux"}}
diff --git a/tests/unit/test_cli_config.py b/tests/unit/test_cli_config.py
index 045f0e4..27801ec 100644
--- a/tests/unit/test_cli_config.py
+++ b/tests/unit/test_cli_config.py
@@ -7,8 +7,15 @@ def test_api_token_from_env(self, monkeypatch):
         config = CliConfig.from_args([])  # Empty args list
         assert config.api_token == "test-token"
 
-    def test_required_args(self):
+    def test_required_args(self, monkeypatch):
         """Test that api token is required if not in environment"""
+        for env_var in (
+            "SOCKET_SECURITY_API_KEY",
+            "SOCKET_SECURITY_API_TOKEN",
+            "SOCKET_API_KEY",
+            "SOCKET_API_TOKEN",
+        ):
+            monkeypatch.delenv(env_var, raising=False)
         with pytest.raises(ValueError, match="API token is required"):
             config = CliConfig.from_args([])
             if not config.api_token:
@@ -81,4 +88,42 @@ def test_workspace_is_independent_of_workspace_name(self):
             "--workspace-name", "monorepo-suffix",
         ])
         assert config.workspace == "my-workspace"
-        assert config.workspace_name == "monorepo-suffix"
\ No newline at end of file
+        assert config.workspace_name == "monorepo-suffix"
+
+    def test_legal_flag_sets_default_artifact_files(self):
+        config = CliConfig.from_args(["--api-token", "test", "--legal"])
+        assert config.legal is True
+        assert config.legal_format == "socket"
+        assert config.generate_license is True
+        assert config.json_file == "socket-report.json"
+        assert config.summary_file == "socket-summary.txt"
+        assert config.report_link_file == "socket-report-link.txt"
+        assert config.sbom_file == "socket-sbom.json"
+        assert config.license_file_name == "socket-license.json"
+
+    def test_legal_flag_preserves_explicit_file_paths(self):
+        config = CliConfig.from_args([
+            "--api-token", "test",
+            "--legal",
+            "--json-file", "custom-report.json",
+            "--summary-file", "custom-summary.txt",
+            "--report-link-file", "custom-link.txt",
+            "--sbom-file", "custom-sbom.json",
+            "--license-file-name", "custom-license.json",
+        ])
+        assert config.json_file == "custom-report.json"
+        assert config.summary_file == "custom-summary.txt"
+        assert config.report_link_file == "custom-link.txt"
+        assert config.sbom_file == "custom-sbom.json"
+        assert config.license_file_name == "custom-license.json"
+
+    def test_fossa_legal_format_enables_legal_defaults(self):
+        config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+        assert config.legal is True
+        assert config.legal_format == "fossa"
+        assert config.generate_license is True
+        assert config.json_file == "fossa-analyze.json"
+        assert config.summary_file == "fossa-test.txt"
+        assert config.report_link_file == "fossa-link.txt"
+        assert config.sbom_file is None
+        assert config.license_file_name == "fossa-sbom.json"
diff --git a/tests/unit/test_fossa_compat.py b/tests/unit/test_fossa_compat.py
new file mode 100644
index 0000000..fadaf03
--- /dev/null
+++ b/tests/unit/test_fossa_compat.py
@@ -0,0 +1,470 @@
+from socketsecurity.config import CliConfig
+from socketsecurity.core.classes import Diff, Issue, Package
+from socketsecurity.fossa_compat import (
+    build_fossa_attribution_payload,
+    build_fossa_report_payload,
+)
+
+EXPECTED_TOP_LEVEL_KEYS = ["project", "vulnerability", "licensing", "quality"]
+EXPECTED_PROJECT_KEYS = ["branch", "id", "project", "projectId", "revision", "url"]
+EXPECTED_VULNERABILITY_KEYS = [
+    "affectedVersionRanges",
+    "containerLayers",
+    "cpes",
+    "createdAt",
+    "customRiskScore",
+    "cve",
+    "cveStatus",
+    "cwes",
+    "cvss",
+    "cvssVector",
+    "depths",
+    "details",
+    "epss",
+    "exploitability",
+    "id",
+    "metrics",
+    "patchedVersionRanges",
+    "projects",
+    "published",
+    "references",
+    "remediation",
+    "severity",
+    "source",
+    "statuses",
+    "title",
+    "type",
+    "url",
+    "vulnId",
+]
+EXPECTED_SOURCE_KEYS = ["id", "name", "packageManager", "url", "version"]
+EXPECTED_DEPTH_KEYS = ["deep", "direct"]
+EXPECTED_STATUS_KEYS = ["active", "ignored"]
+EXPECTED_REMEDIATION_KEYS = [
+    "completeFix",
+    "completeFixDistance",
+    "partialFix",
+    "partialFixDistance",
+]
+EXPECTED_EPSS_KEYS = ["percentile", "score"]
+
+
+def test_fossa_report_payload_uses_expected_top_level_shape():
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    diff = Diff(id="scan-123", report_url="https://socket.dev/report/123")
+
+    payload = build_fossa_report_payload(diff, config)
+
+    assert list(payload.keys()) == EXPECTED_TOP_LEVEL_KEYS
+    assert sorted(payload["project"].keys()) == sorted(EXPECTED_PROJECT_KEYS)
+    assert payload["vulnerability"] == []
+    assert payload["licensing"] == []
+    assert payload["quality"] == []
+
+
+def test_fossa_report_payload_vulnerability_shape_is_stable():
+    config = CliConfig.from_args([
+        "--api-token", "test",
+        "--legal-format", "fossa",
+        "--repo", "owner/repo",
+        "--branch", "refs/heads/main",
+    ])
+    diff = Diff(id="scan-123", report_url="https://socket.dev/report/123")
+    diff.packages = {
+        "pkg-1": Package(
+            id="pkg-1",
+            name="requests",
+            version="2.31.0",
+            type="pypi",
+            score={},
+            alerts=[],
+            direct=True,
+            url="https://requests.readthedocs.io/",
+            license="Apache-2.0",
+            purl="pkg:pypi/requests@2.31.0",
+        )
+    }
+    diff.new_alerts = [
+        Issue(
+            title="Insufficiently Protected Credentials",
+            severity="medium",
+            description="Requests may leak credentials for crafted URLs.",
+            error=True,
+            key="GHSA-9hjg-9r4m-mvj7",
+            type="vulnerability",
+            pkg_type="pypi",
+            pkg_name="requests",
+            pkg_version="2.31.0",
+            pkg_id="pkg-1",
+            purl="pkg:pypi/requests@2.31.0",
+            url="https://socket.dev/pypi/package/requests/alerts/2.31.0",
+            props={
+                "id": 11088938,
+                "createdAt": "2025-10-08T10:41:05.933Z",
+                "ghsaId": "GHSA-9hjg-9r4m-mvj7",
+                "cveId": "CVE-2024-47081",
+                "cvssScore": 5.3,
+                "fixedVersion": "2.32.4",
+                "partialFixDistance": "MINOR",
+                "completeFixDistance": "MINOR",
+                "attackVector": "Network",
+                "attackComplexity": "High",
+                "privilegesRequired": "None",
+                "userInteraction": "Required",
+                "scope": "Unchanged",
+                "confidentialityImpact": "High",
+                "integrityImpact": "None",
+                "availabilityImpact": "None",
+                "cveStatus": "COMPLETED",
+                "cwes": ["CWE-522"],
+                "published": "2025-06-09T19:06:08Z",
+                "affectedVersionRanges": ["<2.32.4"],
+                "patchedVersionRanges": ["2.32.4"],
+                "references": ["https://github.com/advisories/GHSA-9hjg-9r4m-mvj7"],
+                "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
+                "exploitability": "UNKNOWN",
+                "epssScore": 0.00154,
+                "epssPercentile": 0.35957,
+                "cpes": [],
+            },
+        )
+    ]
+
+    payload = build_fossa_report_payload(diff, config)
+    generated_vulnerability = payload["vulnerability"][0]
+
+    assert sorted(generated_vulnerability.keys()) == sorted(EXPECTED_VULNERABILITY_KEYS)
+    assert sorted(generated_vulnerability["source"].keys()) == sorted(EXPECTED_SOURCE_KEYS)
+    assert sorted(generated_vulnerability["depths"].keys()) == sorted(EXPECTED_DEPTH_KEYS)
+    assert sorted(generated_vulnerability["statuses"].keys()) == sorted(EXPECTED_STATUS_KEYS)
+    assert sorted(generated_vulnerability["remediation"].keys()) == sorted(EXPECTED_REMEDIATION_KEYS)
+    assert sorted(generated_vulnerability["epss"].keys()) == sorted(EXPECTED_EPSS_KEYS)
+    assert generated_vulnerability["source"]["packageManager"] == "pip"
+    assert generated_vulnerability["vulnId"] == "GHSA-9hjg-9r4m-mvj7"
+    assert generated_vulnerability["cve"] == "CVE-2024-47081"
+
+
+def test_project_metadata_uses_dollar_revision_separator():
+    """The composed FOSSA `project.id` is `<projectLocator>$<revision>`."""
+    from socketsecurity.fossa_compat import _build_project_metadata
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa", "--repo", "acme/widgets", "--branch", "refs/heads/main"])
+    diff = Diff(id="scan-abc123", report_url="https://socket.dev/x")
+    project = _build_project_metadata(diff, config)
+    assert project == {
+        "branch": "refs/heads/main",
+        "id": "acme/widgets$scan-abc123",
+        "project": "acme/widgets",
+        "projectId": "acme/widgets",
+        "revision": "scan-abc123",
+        "url": "https://socket.dev/x",
+    }
+
+
+def test_project_metadata_fallbacks_when_missing_fields():
+    """Falls back to literal placeholders when config/diff are sparse."""
+    from socketsecurity.fossa_compat import _build_project_metadata
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    # Force absent repo/branch:
+    config.repo = None
+    config.branch = None
+    diff = Diff()
+    project = _build_project_metadata(diff, config)
+    assert project["branch"] == "socket-default-branch"
+    assert project["project"] == "socket-default-repo"
+    assert project["revision"] == "unknown-revision"
+    assert project["id"] == "socket-default-repo$unknown-revision"
+    assert project["url"] is None
+
+
+def test_dependency_entry_full_shape():
+    """Per-dependency dict has the exact 14-key FOSSA attribution shape."""
+    from socketsecurity.fossa_compat import _build_dependency_entry
+    package = Package(
+        type="pypi",
+        name="requests",
+        version="2.31.0",
+        id="pip+requests$2.31.0",
+        score={},
+        alerts=[],
+        direct=True,
+        author=["Kenneth Reitz <me@kennethreitz.com>"],
+        license="Apache-2.0",
+        licenseAttrib=[{"attribText": "Apache License 2.0\n\nCopyright 2023 Kenneth Reitz",
+                         "attribData": [{"spdxExpr": "Apache-2.0"}]}],
+    )
+    entry = _build_dependency_entry(package, dependency_paths=["requests"])
+    assert set(entry.keys()) == {
+        "authors", "dependencyPaths", "description", "downloadUrl", "hash",
+        "isGolang", "licenses", "notes", "otherLicenses", "package",
+        "projectUrl", "source", "title", "version",
+    }
+    assert entry["authors"] == ["Kenneth Reitz <me@kennethreitz.com>"]
+    assert entry["dependencyPaths"] == ["requests"]
+    assert entry["description"] == ""
+    assert entry["downloadUrl"] == ""
+    assert entry["hash"] is None
+    assert entry["isGolang"] is None
+    assert entry["licenses"] == [{
+        "attribution": "Apache License 2.0\n\nCopyright 2023 Kenneth Reitz",
+        "name": "Apache-2.0",
+    }]
+    assert entry["notes"] == []
+    assert entry["otherLicenses"] == []
+    assert entry["package"] == "requests"
+    assert entry["projectUrl"] == ""
+    assert entry["source"] == "pip"
+    assert entry["title"] == "requests"
+    assert entry["version"] == "2.31.0"
+
+
+def test_dependency_entry_falls_back_to_declared_license_when_no_attrib():
+    """When licenseAttrib is empty, `licenses[]` falls back to a single name-only entry from Package.license."""
+    from socketsecurity.fossa_compat import _build_dependency_entry
+    package = Package(
+        type="pypi", name="x", version="1.0", id="pip+x$1.0",
+        score={}, alerts=[], license="MIT",
+    )
+    entry = _build_dependency_entry(package, dependency_paths=["x"])
+    assert entry["licenses"] == [{"attribution": "", "name": "MIT"}]
+
+
+def test_dependency_entry_unlicensed_package_emits_empty_licenses():
+    from socketsecurity.fossa_compat import _build_dependency_entry
+    package = Package(
+        type="pypi", name="x", version="1.0", id="pip+x$1.0",
+        score={}, alerts=[], license=None,
+    )
+    entry = _build_dependency_entry(package, dependency_paths=["x"])
+    assert entry["licenses"] == []
+
+
+def test_analyze_payload_top_level_keys_exactly_four():
+    """The composed FOSSA analyze artifact has exactly project/vulnerability/licensing/quality."""
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    diff = Diff()  # empty alerts
+    payload = build_fossa_report_payload(diff, config)
+    assert set(payload.keys()) == {"project", "vulnerability", "licensing", "quality"}
+    assert "risk" not in payload
+
+
+def test_analyze_payload_empty_diff_yields_empty_arrays():
+    """An empty diff still emits all 4 keys with `[]` arrays."""
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    payload = build_fossa_report_payload(Diff(), config)
+    assert payload["vulnerability"] == []
+    assert payload["licensing"] == []
+    assert payload["quality"] == []
+
+
+def test_vulnerability_gap_fields_emit_known_defaults():
+    """Fields with no Socket data source emit documented null/empty defaults."""
+    from socketsecurity.fossa_compat import _build_vulnerability_entry
+    issue = Issue(
+        type="criticalCVE",
+        severity="high",
+        key="x",
+        pkg_type="pypi",
+        pkg_name="x",
+        pkg_version="1.0",
+        props={},
+    )
+    package = Package(
+        type="pypi",
+        name="x",
+        version="1.0",
+        id="pip+x$1.0",
+        score={},
+        alerts=[],
+        direct=True,
+    )
+    project = {"branch": "m", "id": "a$x", "project": "a", "projectId": "a", "revision": "x", "url": "u"}
+    entry = _build_vulnerability_entry(issue, package, project, index=1)
+    # Documented gap fields:
+    assert entry["epss"] == {"score": None, "percentile": None}
+    assert entry["cvssVector"] is None
+    assert entry["exploitability"] is None
+    assert entry["cveStatus"] is None
+    assert entry["published"] is None
+    assert entry["containerLayers"] == {"base": 0, "other": 0}
+    assert entry["remediation"]["partialFixDistance"] is None
+    assert entry["remediation"]["completeFixDistance"] is None
+    assert "customRiskScore" in entry
+    assert entry["customRiskScore"] is None
+    proj_entry = entry["projects"][0]
+    assert proj_entry["scannedAt"] is None
+    assert proj_entry["analyzedAt"] is None
+    assert proj_entry["firstFoundAt"] is None
+
+
+def test_attribution_payload_top_level_is_5_keys():
+    """fossa-sbom.json has exactly the 5 keys from `fossa report --json attribution`."""
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    payload = build_fossa_attribution_payload(Diff(), config)
+    assert set(payload.keys()) == {
+        "copyrightsByLicense",
+        "deepDependencies",
+        "directDependencies",
+        "licenses",
+        "project",
+    }
+
+
+def test_attribution_project_has_only_name_and_revision():
+    """SBOM `project` is the 2-key subset, not the 6-key analyze project."""
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa", "--repo", "acme/widgets"])
+    diff = Diff(id="rev-x")
+    payload = build_fossa_attribution_payload(diff, config)
+    assert payload["project"] == {"name": "acme/widgets", "revision": "rev-x"}
+
+
+def test_attribution_empty_diff_yields_empty_collections():
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    payload = build_fossa_attribution_payload(Diff(), config)
+    assert payload["copyrightsByLicense"] == {}
+    assert payload["licenses"] == {}
+    assert payload["directDependencies"] == []
+    assert payload["deepDependencies"] == []
+
+
+def test_attribution_partitions_direct_vs_deep():
+    pkg_a = Package(
+        type="pypi", name="a", version="1.0", id="pip+a$1.0",
+        score={}, alerts=[], direct=True,
+    )
+    pkg_b = Package(
+        type="pypi", name="b", version="1.0", id="pip+b$1.0",
+        score={}, alerts=[], direct=False,
+    )
+    pkg_c = Package(
+        type="pypi", name="c", version="1.0", id="pip+c$1.0",
+        score={}, alerts=[], direct=True,
+    )
+    diff = Diff(packages={"id-a": pkg_a, "id-b": pkg_b, "id-c": pkg_c})
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    payload = build_fossa_attribution_payload(diff, config)
+    direct_names = sorted(d["package"] for d in payload["directDependencies"])
+    deep_names = sorted(d["package"] for d in payload["deepDependencies"])
+    assert direct_names == ["a", "c"]
+    assert deep_names == ["b"]
+
+
+def test_dependency_paths_direct_package_is_name_only():
+    from socketsecurity.fossa_compat import _compute_dependency_paths
+    pkg = Package(
+        type="pypi", name="requests", version="2.31.0",
+        id="pip+requests$2.31.0", score={}, alerts=[], direct=True,
+    )
+    paths = _compute_dependency_paths(pkg, {"pip+requests$2.31.0": pkg})
+    assert paths == ["requests"]
+
+
+def test_dependency_paths_transitive_chains_through_ancestor_name():
+    from socketsecurity.fossa_compat import _compute_dependency_paths
+    parent = Package(
+        type="pypi", name="requests", version="2.31.0",
+        id="parent-id", score={}, alerts=[], direct=True,
+    )
+    child = Package(
+        type="pypi", name="certifi", version="2024.7.4",
+        id="child-id", score={}, alerts=[], direct=False,
+        topLevelAncestors=["parent-id"],
+    )
+    lookup = {"parent-id": parent, "child-id": child}
+    assert _compute_dependency_paths(child, lookup) == ["requests > certifi"]
+
+
+def test_dependency_paths_multi_ancestor_emits_one_per_root():
+    from socketsecurity.fossa_compat import _compute_dependency_paths
+    p1 = Package(type="pypi", name="boto3", version="1.0", id="p1",
+                 score={}, alerts=[], direct=True)
+    p2 = Package(type="pypi", name="botocore", version="1.0", id="p2",
+                 score={}, alerts=[], direct=True)
+    child = Package(
+        type="pypi", name="jmespath", version="1.0", id="c",
+        score={}, alerts=[], direct=False,
+        topLevelAncestors=["p1", "p2"],
+    )
+    lookup = {"p1": p1, "p2": p2, "c": child}
+    assert sorted(_compute_dependency_paths(child, lookup)) == [
+        "boto3 > jmespath",
+        "botocore > jmespath",
+    ]
+
+
+def test_dependency_paths_missing_ancestor_falls_back_to_name():
+    from socketsecurity.fossa_compat import _compute_dependency_paths
+    pkg = Package(
+        type="pypi", name="orphan", version="1.0", id="o",
+        score={}, alerts=[], direct=False,
+        topLevelAncestors=["missing-id"],
+    )
+    assert _compute_dependency_paths(pkg, {"o": pkg}) == ["orphan"]
+
+
+def test_vulnerability_version_ranges_sourced_from_socket_fields():
+    """affectedVersionRanges/patchedVersionRanges come from Socket's singular fields, wrapped."""
+    from socketsecurity.fossa_compat import _build_vulnerability_entry
+    issue = Issue(
+        type="criticalCVE",
+        severity="high",
+        key="CVE-2024-12345_pip+requests",
+        pkg_type="pypi",
+        pkg_name="requests",
+        pkg_version="2.30.0",
+        props={
+            "ghsaId": "GHSA-aaaa-bbbb-cccc",
+            "cveId": "CVE-2024-12345",
+            "cvss": 7.5,
+            "vulnerableVersionRange": ">=2.0.0,<2.31.1",
+            "firstPatchedVersionIdentifier": "2.31.1",
+            "cwes": ["CWE-200"],
+        },
+    )
+    package = Package(
+        type="pypi",
+        name="requests",
+        version="2.30.0",
+        id="pip+requests$2.30.0",
+        score={},
+        alerts=[],
+        direct=True,
+    )
+    project = {"branch": "main", "id": "acme$x", "project": "acme", "projectId": "acme", "revision": "x", "url": "u"}
+    entry = _build_vulnerability_entry(issue, package, project, index=1)
+    assert entry["affectedVersionRanges"] == [">=2.0.0,<2.31.1"]
+    assert entry["patchedVersionRanges"] == ["2.31.1"]
+    assert entry["remediation"]["partialFix"] == "2.31.1"
+    assert entry["remediation"]["completeFix"] == "2.31.1"
+
+
+def test_fossa_payload_includes_unchanged_alerts_regardless_of_strict_blocking():
+    """FOSSA emits all currently-present issues at the scan revision, not just
+    diff-new ones. So `unchanged_alerts` must always flow into the payload,
+    independent of the --strict-blocking flag."""
+    new_issue = Issue(
+        type="criticalCVE", severity="high", key="NEW",
+        pkg_type="pypi", pkg_name="a", pkg_version="1.0",
+        props={"cveId": "CVE-2024-NEW", "ghsaId": "GHSA-new"},
+    )
+    unchanged_issue = Issue(
+        type="criticalCVE", severity="high", key="OLD",
+        pkg_type="pypi", pkg_name="b", pkg_version="1.0",
+        props={"cveId": "CVE-2024-OLD", "ghsaId": "GHSA-old"},
+    )
+    diff = Diff(new_alerts=[new_issue], unchanged_alerts=[unchanged_issue])
+
+    # strict_blocking off (default):
+    config_loose = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    payload_loose = build_fossa_report_payload(diff, config_loose)
+    loose_cves = sorted(v["cve"] for v in payload_loose["vulnerability"])
+    assert loose_cves == ["CVE-2024-NEW", "CVE-2024-OLD"], (
+        "FOSSA mode must include unchanged_alerts even without --strict-blocking"
+    )
+
+    # strict_blocking on — same result (always include both):
+    config_strict = CliConfig.from_args(
+        ["--api-token", "test", "--legal-format", "fossa", "--strict-blocking"]
+    )
+    payload_strict = build_fossa_report_payload(diff, config_strict)
+    strict_cves = sorted(v["cve"] for v in payload_strict["vulnerability"])
+    assert strict_cves == loose_cves
diff --git a/tests/unit/test_fossa_parity.py b/tests/unit/test_fossa_parity.py
new file mode 100644
index 0000000..2a408d8
--- /dev/null
+++ b/tests/unit/test_fossa_parity.py
@@ -0,0 +1,106 @@
+"""Structural parity tests: assert our FOSSA-shaped output matches real FOSSA artifact shapes.
+
+These tests load real FOSSA artifacts captured from a customer pipeline and compare them
+against our --legal-format fossa output by shape (key sets + value types), not by value.
+A value-level golden test would be too brittle; the goal is to catch structural drift.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+FIXTURE_DIR = Path(__file__).parent.parent / "fixtures" / "fossa"
+
+
+def _load(name: str) -> dict:
+    return json.loads((FIXTURE_DIR / name).read_text())
+
+
+def test_fixtures_present_and_parseable():
+    """Sanity: all four FOSSA reference fixtures load as JSON objects."""
+    for name in (
+        "fossa-analyze-populated.json",
+        "fossa-analyze-empty.json",
+        "fossa-sbom-populated.json",
+        "fossa-sbom-empty-deep.json",
+    ):
+        data = _load(name)
+        assert isinstance(data, dict), f"{name} should be a JSON object at the top level"
+
+
+def test_analyze_fixture_top_level_shape():
+    """The real FOSSA analyze artifact has exactly these top-level keys."""
+    data = _load("fossa-analyze-populated.json")
+    assert set(data.keys()) == {"project", "vulnerability", "licensing", "quality"}
+    assert "risk" not in data  # FOSSA API 400s on risk category; key never appears
+
+
+def test_sbom_fixture_top_level_shape():
+    """The real FOSSA attribution artifact has exactly these 5 top-level keys."""
+    data = _load("fossa-sbom-populated.json")
+    assert set(data.keys()) == {
+        "copyrightsByLicense",
+        "deepDependencies",
+        "directDependencies",
+        "licenses",
+        "project",
+    }
+
+
+def test_our_analyze_matches_fossa_analyze_top_level_keys():
+    """Our build_fossa_report_payload top-level keyset matches the real fixture."""
+    from socketsecurity.config import CliConfig
+    from socketsecurity.core.classes import Diff
+    from socketsecurity.fossa_compat import build_fossa_report_payload
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    ours = build_fossa_report_payload(Diff(), config)
+    theirs = _load("fossa-analyze-empty.json")
+    assert set(ours.keys()) == set(theirs.keys())
+
+
+def test_our_analyze_project_keys_match():
+    from socketsecurity.config import CliConfig
+    from socketsecurity.core.classes import Diff
+    from socketsecurity.fossa_compat import build_fossa_report_payload
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    ours = build_fossa_report_payload(Diff(), config)
+    theirs = _load("fossa-analyze-empty.json")
+    assert set(ours["project"].keys()) == set(theirs["project"].keys())
+
+
+def test_our_sbom_matches_fossa_sbom_top_level_keys():
+    from socketsecurity.config import CliConfig
+    from socketsecurity.core.classes import Diff
+    from socketsecurity.fossa_compat import build_fossa_attribution_payload
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    ours = build_fossa_attribution_payload(Diff(), config)
+    theirs = _load("fossa-sbom-populated.json")
+    assert set(ours.keys()) == set(theirs.keys())
+
+
+def test_our_sbom_project_keys_match():
+    from socketsecurity.config import CliConfig
+    from socketsecurity.core.classes import Diff
+    from socketsecurity.fossa_compat import build_fossa_attribution_payload
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    ours = build_fossa_attribution_payload(Diff(), config)
+    theirs = _load("fossa-sbom-populated.json")
+    assert set(ours["project"].keys()) == set(theirs["project"].keys())
+
+
+def test_our_sbom_dependency_keys_match_when_populated():
+    """When we have at least one dependency, its keyset matches a real FOSSA dependency entry."""
+    from socketsecurity.config import CliConfig
+    from socketsecurity.core.classes import Diff, Package
+    from socketsecurity.fossa_compat import build_fossa_attribution_payload
+    pkg = Package(
+        type="pypi", name="x", version="1.0", id="pid",
+        score={}, alerts=[], direct=True,
+    )
+    diff = Diff(packages={"pid": pkg})
+    config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
+    ours = build_fossa_attribution_payload(diff, config)
+    theirs = _load("fossa-sbom-populated.json")
+    our_dep = ours["directDependencies"][0]
+    their_dep = theirs["directDependencies"][0]
+    assert set(our_dep.keys()) == set(their_dep.keys())
diff --git a/tests/unit/test_output.py b/tests/unit/test_output.py
index 0fe007e..c4271e7 100644
--- a/tests/unit/test_output.py
+++ b/tests/unit/test_output.py
@@ -1,13 +1,17 @@
+import json
+
 import pytest
+
+from socketsecurity.core.classes import Diff, Issue, Package
 from socketsecurity.output import OutputHandler
-from socketsecurity.core.classes import Diff, Issue
-import json
+
 
 class TestOutputHandler:
     @pytest.fixture
     def handler(self):
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
+
+        from socketsecurity.config import CliConfig
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = False
@@ -25,8 +29,9 @@ def test_report_pass_with_blocking_issues(self, handler):
         assert not handler.report_pass(diff)
 
     def test_report_pass_with_blocking_disabled(self):
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
+
+        from socketsecurity.config import CliConfig
         config = Mock(spec=CliConfig)
         config.disable_blocking = True
         config.strict_blocking = False
@@ -65,9 +70,10 @@ def test_json_output_format(self, handler, caplog):
 
     def test_json_output_includes_unchanged_alerts_with_strict_blocking(self, caplog):
         import logging
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = True
@@ -123,11 +129,228 @@ def test_sbom_file_saving(self, handler, tmp_path):
         handler.save_sbom_file(diff, str(sbom_path))
         assert sbom_path.exists()
 
+    def test_sbom_file_saving_without_sbom_writes_empty_array(self, handler, tmp_path):
+        diff = Diff()
+        sbom_path = tmp_path / "empty.json"
+        handler.save_sbom_file(diff, str(sbom_path))
+        assert sbom_path.exists()
+        assert json.loads(sbom_path.read_text()) == []
+
+    def test_json_file_saving(self, tmp_path):
+        from unittest.mock import Mock
+
+        from socketsecurity.config import CliConfig
+
+        json_path = tmp_path / "report.json"
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = False
+        config.json_file = str(json_path)
+        config.summary_file = None
+        config.report_link_file = None
+        config.sbom_file = None
+        config.legal = True
+        config.legal_format = "socket"
+        config.repo = "owner/repo"
+        config.branch = "main"
+        config.commit_sha = "abc123"
+        config.enable_json = False
+        config.enable_sarif = False
+        config.enable_gitlab_security = False
+        config.enable_debug = False
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "scan-123"
+        diff.diff_url = "https://socket.dev/diff/123"
+        diff.report_url = "https://socket.dev/report/123"
+        diff.new_alerts = [
+            Issue(
+                title="Test",
+                severity="high",
+                description="desc",
+                error=True,
+                key="test-key",
+                type="vulnerability",
+                pkg_type="npm",
+                pkg_name="test-package",
+                pkg_version="1.0.0",
+                purl="pkg:npm/test-package@1.0.0",
+                url="https://socket.dev/npm/package/test-package/alerts/1.0.0",
+            )
+        ]
+
+        handler.save_json_file(diff, str(json_path))
+
+        saved = json.loads(json_path.read_text())
+        assert saved["full_scan_id"] == "scan-123"
+        assert saved["report_url"] == "https://socket.dev/report/123"
+        assert saved["repo"] == "owner/repo"
+        assert saved["branch"] == "main"
+        assert saved["commit_sha"] == "abc123"
+        assert saved["legal_mode"] is True
+
+    def test_summary_and_report_link_files_are_written(self, tmp_path):
+        from unittest.mock import Mock
+
+        from socketsecurity.config import CliConfig
+
+        summary_path = tmp_path / "summary.txt"
+        report_link_path = tmp_path / "report-link.txt"
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = False
+        config.json_file = None
+        config.summary_file = str(summary_path)
+        config.report_link_file = str(report_link_path)
+        config.sbom_file = None
+        config.legal = False
+        config.legal_format = "socket"
+        config.repo = None
+        config.branch = ""
+        config.commit_sha = ""
+        config.enable_json = False
+        config.enable_sarif = False
+        config.enable_gitlab_security = False
+        config.enable_debug = False
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "scan-123"
+        diff.diff_url = "https://socket.dev/diff/123"
+        diff.report_url = "https://socket.dev/report/123"
+        diff.new_alerts = [
+            Issue(
+                title="Test",
+                severity="high",
+                description="desc",
+                error=True,
+                key="test-key",
+                type="vulnerability",
+                pkg_type="npm",
+                pkg_name="test-package",
+                pkg_version="1.0.0",
+                purl="pkg:npm/test-package@1.0.0",
+                url="https://socket.dev/npm/package/test-package/alerts/1.0.0",
+            )
+        ]
+
+        handler.save_summary_file(diff, str(summary_path))
+        handler.save_report_link_file(diff, str(report_link_path))
+
+        assert "Security issues detected by Socket Security:" in summary_path.read_text()
+        assert report_link_path.read_text().strip() == "https://socket.dev/report/123"
+
+    def test_json_file_saving_in_fossa_format(self, tmp_path):
+        from unittest.mock import Mock
+
+        from socketsecurity.config import CliConfig
+
+        json_path = tmp_path / "fossa-report.json"
+
+        config = Mock(spec=CliConfig)
+        config.disable_blocking = False
+        config.strict_blocking = False
+        config.json_file = str(json_path)
+        config.summary_file = None
+        config.report_link_file = None
+        config.sbom_file = None
+        config.legal = True
+        config.legal_format = "fossa"
+        config.repo = "owner/repo"
+        config.branch = "refs/heads/main"
+        config.commit_sha = "abc123"
+        config.enable_json = False
+        config.enable_sarif = False
+        config.enable_gitlab_security = False
+        config.enable_debug = False
+
+        handler = OutputHandler(config, Mock())
+
+        diff = Diff()
+        diff.id = "scan-123"
+        diff.report_url = "https://socket.dev/report/123"
+        diff.packages = {
+            "pkg-1": Package(
+                id="pkg-1",
+                name="requests",
+                version="2.31.0",
+                type="pypi",
+                score={},
+                alerts=[],
+                direct=True,
+                url="https://socket.dev/pypi/package/requests/overview/2.31.0",
+                license="Apache-2.0",
+                purl="pkg:pypi/requests@2.31.0",
+            )
+        }
+        diff.new_alerts = [
+            Issue(
+                title="Prototype Pollution",
+                severity="high",
+                description="Upgrade to a fixed version.",
+                error=True,
+                key="alert-1",
+                type="vulnerability",
+                pkg_type="pypi",
+                pkg_name="requests",
+                pkg_version="2.31.0",
+                pkg_id="pkg-1",
+                purl="pkg:pypi/requests@2.31.0",
+                url="https://socket.dev/npm/package/requests/alerts/2.31.0",
+                props={
+                    "ghsaId": "GHSA-1234",
+                    "cveId": "CVE-2026-1234",
+                    "cvssScore": 8.2,
+                    "fixedVersion": "2.31.1",
+                    "references": ["https://github.com/advisories/GHSA-1234"],
+                },
+            ),
+            Issue(
+                title="License Policy Violation",
+                severity="medium",
+                description="Package license violates policy.",
+                warn=True,
+                key="license-1",
+                type="licenseSpdxDisj",
+                pkg_type="pypi",
+                pkg_name="requests",
+                pkg_version="2.31.0",
+                pkg_id="pkg-1",
+                purl="pkg:pypi/requests@2.31.0",
+                url="https://socket.dev/pypi/package/requests/license/2.31.0",
+            ),
+        ]
+
+        handler.save_json_file(diff, str(json_path))
+
+        saved = json.loads(json_path.read_text())
+        assert saved["project"] == {
+            "branch": "refs/heads/main",
+            "id": "owner/repo$scan-123",
+            "project": "owner/repo",
+            "projectId": "owner/repo",
+            "revision": "scan-123",
+            "url": "https://socket.dev/report/123",
+        }
+        assert len(saved["vulnerability"]) == 1
+        assert saved["vulnerability"][0]["vulnId"] == "GHSA-1234"
+        assert saved["vulnerability"][0]["cve"] == "CVE-2026-1234"
+        assert saved["vulnerability"][0]["source"]["packageManager"] == "pip"
+        assert saved["vulnerability"][0]["remediation"]["completeFix"] == "2.31.1"
+        assert saved["licensing"][0]["type"] == "policy_conflict"
+        assert saved["quality"] == []
+
     def test_report_pass_with_strict_blocking_new_alerts(self):
         """Test that strict-blocking fails on new blocking alerts"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         # Create config with strict_blocking
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
@@ -143,9 +366,10 @@ def test_report_pass_with_strict_blocking_new_alerts(self):
 
     def test_report_pass_with_strict_blocking_unchanged_alerts(self):
         """Test that strict-blocking fails on unchanged blocking alerts"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = True
@@ -160,9 +384,10 @@ def test_report_pass_with_strict_blocking_unchanged_alerts(self):
 
     def test_report_pass_with_strict_blocking_both_alerts(self):
         """Test that strict-blocking fails when both new and unchanged alerts exist"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = True
@@ -177,9 +402,10 @@ def test_report_pass_with_strict_blocking_both_alerts(self):
 
     def test_report_pass_with_strict_blocking_only_warnings(self):
         """Test that strict-blocking passes when only warnings (not errors) exist"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = True
@@ -194,9 +420,10 @@ def test_report_pass_with_strict_blocking_only_warnings(self):
 
     def test_report_pass_strict_blocking_disabled(self):
         """Test that strict-blocking without the flag passes with unchanged alerts"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = False
         config.strict_blocking = False  # Flag not set
@@ -212,9 +439,10 @@ def test_report_pass_strict_blocking_disabled(self):
 
     def test_disable_blocking_overrides_strict_blocking(self):
         """Test that disable-blocking takes precedence over strict-blocking"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.disable_blocking = True
         config.strict_blocking = True
@@ -230,9 +458,10 @@ def test_disable_blocking_overrides_strict_blocking(self):
 
     def test_sarif_file_output(self, tmp_path):
         """Test that --sarif-file writes SARIF report to a file"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path = tmp_path / "report.sarif"
 
         config = Mock(spec=CliConfig)
@@ -268,9 +497,10 @@ def test_sarif_file_output(self, tmp_path):
 
     def test_sarif_reachability_reachable_filters_non_reachable(self, tmp_path):
         """Test that --sarif-reachability reachable uses .socket.facts.json reachability."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path = tmp_path / "report.sarif"
         facts_path = tmp_path / ".socket.facts.json"
 
@@ -343,9 +573,10 @@ def make_issue(name, error, ghsa_id):
 
     def test_sarif_reachability_reachable_falls_back_to_blocking_when_facts_missing(self, tmp_path):
         """Test that missing facts file falls back to historical blocking filter."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path = tmp_path / "report.sarif"
 
         config = Mock(spec=CliConfig)
@@ -382,9 +613,10 @@ def test_sarif_reachability_reachable_falls_back_to_blocking_when_facts_missing(
 
     def test_sarif_output_includes_unchanged_with_strict_blocking(self, tmp_path):
         """Strict blocking should include unchanged alerts in diff-scope SARIF output."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path_strict_false = tmp_path / "strict-false.sarif"
         sarif_path_strict_true = tmp_path / "strict-true.sarif"
 
@@ -437,9 +669,10 @@ def build_diff():
 
     def test_sarif_reachability_all_includes_all(self, tmp_path):
         """Test that --sarif-reachability all includes all alerts."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path = tmp_path / "report.sarif"
 
         config = Mock(spec=CliConfig)
@@ -476,9 +709,10 @@ def test_sarif_reachability_all_includes_all(self, tmp_path):
 
     def test_sarif_no_file_when_not_configured(self, tmp_path):
         """Test that no file is written when --sarif-file is not set"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         config = Mock(spec=CliConfig)
         config.sarif_file = None
         config.sarif_scope = "diff"
@@ -497,9 +731,10 @@ def test_sarif_no_file_when_not_configured(self, tmp_path):
 
     def test_sarif_file_nested_directory(self, tmp_path):
         """Test that --sarif-file creates parent directories if needed"""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         sarif_path = tmp_path / "nested" / "dir" / "report.sarif"
 
         config = Mock(spec=CliConfig)
@@ -522,9 +757,10 @@ def test_sarif_file_nested_directory(self, tmp_path):
 
     def test_sarif_scope_full_before_after_reachable_filtering_snapshot(self, tmp_path):
         """Full-scope SARIF should show before/after changes with reachable-only filtering."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         facts_path = tmp_path / ".socket.facts.json"
         all_path = tmp_path / "full-all.sarif"
         reachable_path = tmp_path / "full-reachable.sarif"
@@ -591,9 +827,10 @@ def build_handler(output_path, reachable_only):
 
     def test_sarif_scope_full_works_when_diff_not_run(self, tmp_path):
         """Full scope should still emit SARIF when diff id is NO_DIFF_RAN."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         facts_path = tmp_path / ".socket.facts.json"
         out_path = tmp_path / "full-no-diff.sarif"
 
@@ -636,9 +873,10 @@ def test_sarif_scope_full_works_when_diff_not_run(self, tmp_path):
 
     def test_sarif_scope_full_dedupes_duplicate_manifest_uris(self, tmp_path):
         """Full scope should not emit duplicate results for duplicate manifest entries."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         facts_path = tmp_path / ".socket.facts.json"
         out_path = tmp_path / "full-dedup.sarif"
 
@@ -678,9 +916,10 @@ def test_sarif_scope_full_dedupes_duplicate_manifest_uris(self, tmp_path):
 
     def test_sarif_scope_full_with_sarif_file_suppresses_stdout(self, tmp_path, capsys):
         """Full scope + --sarif-file should avoid printing massive SARIF JSON to stdout."""
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         facts_path = tmp_path / ".socket.facts.json"
         out_path = tmp_path / "full-suppressed.sarif"
 
@@ -718,9 +957,10 @@ def test_sarif_scope_full_with_sarif_file_suppresses_stdout(self, tmp_path, caps
         assert out_path.exists()
 
     def test_sarif_scope_full_alert_grouping_dedupes_versions(self, tmp_path):
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         out_path = tmp_path / "full-alert-grouping.sarif"
         facts_path = tmp_path / ".socket.facts.json"
         facts_path.write_text(json.dumps({
@@ -768,9 +1008,10 @@ def test_sarif_scope_full_alert_grouping_dedupes_versions(self, tmp_path):
         assert props["reachability"] == "reachable"
 
     def test_sarif_scope_full_potentially_filter(self, tmp_path):
-        from socketsecurity.config import CliConfig
         from unittest.mock import Mock
 
+        from socketsecurity.config import CliConfig
+
         out_path = tmp_path / "full-potentially.sarif"
         facts_path = tmp_path / ".socket.facts.json"
         facts_path.write_text(json.dumps({
diff --git a/tests/unit/test_socketcli.py b/tests/unit/test_socketcli.py
new file mode 100644
index 0000000..e48788a
--- /dev/null
+++ b/tests/unit/test_socketcli.py
@@ -0,0 +1,134 @@
+from socketsecurity.core.classes import Diff, Package
+from socketsecurity.socketcli import build_license_artifact_payload
+
+
+def test_build_license_artifact_payload_without_packages_returns_empty_dict():
+    diff = Diff()
+
+    payload = build_license_artifact_payload(diff)
+
+    assert payload == {}
+
+
+def test_build_license_artifact_payload_serializes_package_fields():
+    diff = Diff()
+    diff.packages = {
+        "pypi/requests@2.31.0": Package(
+            id="pkg-1",
+            name="requests",
+            version="2.31.0",
+            type="pypi",
+            score={},
+            alerts=[],
+            direct=True,
+            url="https://socket.dev/pypi/package/requests/overview/2.31.0",
+            license="Apache-2.0",
+            licenseDetails=[{"id": "Apache-2.0"}],
+            licenseAttrib=[{"id": "Apache-2.0"}],
+            purl="requests@2.31.0",
+        )
+    }
+
+    payload = build_license_artifact_payload(diff)
+
+    assert payload == {
+        "pkg-1": {
+            "id": "pkg-1",
+            "name": "requests",
+            "version": "2.31.0",
+            "ecosystem": "pypi",
+            "direct": True,
+            "url": "https://socket.dev/pypi/package/requests/overview/2.31.0",
+            "license": "Apache-2.0",
+            "licenseDetails": [{"id": "Apache-2.0"}],
+            "licenseAttrib": [{"id": "Apache-2.0"}],
+            "purl": "requests@2.31.0",
+        }
+    }
+
+
+def test_build_license_artifact_payload_fossa_format_without_packages():
+    class Config:
+        repo = "owner/repo"
+        branch = "main"
+
+    diff = Diff(id="scan-1", report_url="https://socket.dev/report/1")
+
+    payload = build_license_artifact_payload(diff, legal_format="fossa", config=Config())
+
+    assert payload == {
+        "copyrightsByLicense": {},
+        "deepDependencies": [],
+        "directDependencies": [],
+        "licenses": {},
+        "project": {"name": "owner/repo", "revision": "scan-1"},
+    }
+
+
+def test_fossa_attribution_file_is_written_indented(tmp_path):
+    """fossa-sbom.json should be written with indent=2, matching fossa-analyze.json."""
+    import json
+    from types import SimpleNamespace
+
+    from socketsecurity import socketcli
+
+    target = tmp_path / "fossa-sbom.json"
+    config = SimpleNamespace(license_file_name=str(target))
+    payload = {
+        "copyrightsByLicense": {},
+        "deepDependencies": [],
+        "directDependencies": [],
+        "licenses": {},
+        "project": {"name": "x", "revision": "y"},
+    }
+    socketcli._write_attribution_file(config, payload)
+    content = target.read_text()
+    assert "\n  " in content, f"Expected indented JSON, got: {content!r}"
+    assert json.loads(content) == payload
+
+
+def test_build_license_artifact_payload_fossa_format_serializes_dependencies():
+    class Config:
+        repo = "owner/repo"
+        branch = "main"
+
+    diff = Diff(id="scan-1", report_url="https://socket.dev/report/1")
+    diff.packages = {
+        "pkg:pypi/requests@2.31.0": Package(
+            id="pkg-1",
+            name="requests",
+            version="2.31.0",
+            type="pypi",
+            score={},
+            alerts=[],
+            direct=True,
+            url="https://socket.dev/pypi/package/requests/overview/2.31.0",
+            license="Apache-2.0",
+            licenseDetails=[{"id": "Apache-2.0"}],
+            licenseAttrib=[{"id": "Apache-2.0"}],
+            purl="pkg:pypi/requests@2.31.0",
+        )
+    }
+
+    payload = build_license_artifact_payload(diff, legal_format="fossa", config=Config())
+
+    assert payload["project"] == {"name": "owner/repo", "revision": "scan-1"}
+    assert payload["directDependencies"] == [{
+        "authors": [],
+        "dependencyPaths": ["requests"],
+        "description": "",
+        "downloadUrl": "",
+        "hash": None,
+        "isGolang": None,
+        "licenses": [{"attribution": "", "name": "Apache-2.0"}],
+        "notes": [],
+        "otherLicenses": [],
+        "package": "requests",
+        "projectUrl": "",
+        "source": "pip",
+        "title": "requests",
+        "version": "2.31.0",
+    }]
+    assert payload["deepDependencies"] == []
+    assert payload["copyrightsByLicense"] == {}
+    assert payload["licenses"] == {}
diff --git a/uv.lock b/uv.lock
index ec4b94f..e47a62c 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.90"
+version = "2.2.91"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1221,7 +1221,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.1.0,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.0.33,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From cc246822dd2e72cf67004acc867d05a2bee50a55 Mon Sep 17 00:00:00 2001
From: Eric Hibbs <eric@socket.dev>
Date: Fri, 29 May 2026 14:11:18 -0700
Subject: [PATCH 50/80] fix(core): fall back to humanized title for unmapped
 alert types (#208)

* test: failing repro for empty title on gptDidYouMean alerts

* test: failing repro for empty title on unknown alert types

* test: lock in licenseSpdxDisj title fallback

* feat(core): add alert-type humanizer and override-map plumbing

* fix(core): fall back to humanized title for unmapped alert types

Resolves CUS2-2: gptDidYouMean and any future alert type without SDK
metadata previously rendered as a blank Alert column in the CLI output
table, SARIF report, and PR/security comments. Title resolution now
falls back through an explicit override map and a generic humanizer.

* test: hoist _humanize_alert_type import to module scope

* chore(release): bump to 2.2.92 to clear main collision

#199 landed on main between the original 2.2.91 bump and this PR opening,
so 2.2.91 ties main and fails check_version. Bump to 2.2.92.
---
 pyproject.toml                        |  2 +-
 socketsecurity/__init__.py            |  2 +-
 socketsecurity/core/__init__.py       | 35 ++++++++++--
 tests/core/test_package_and_alerts.py | 77 ++++++++++++++++++++++++++-
 uv.lock                               |  2 +-
 5 files changed, 111 insertions(+), 7 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 137b98d..b661dc7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.91"
+version = "2.2.92"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 7fdf737..9f58d90 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.91'
+__version__ = '2.2.92'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 0a6b827..1f488b2 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1,5 +1,6 @@
 import logging
 import os
+import re
 import sys
 import tarfile
 import tempfile
@@ -44,6 +45,26 @@
 version = __version__
 log = logging.getLogger("socketdev")
 
+_ALERT_TYPE_TITLE_OVERRIDES = {
+    "gptDidYouMean": "Possible typosquat attack (GPT)",
+}
+
+_HUMANIZE_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])")
+
+
+def _humanize_alert_type(alert_type: str) -> str:
+    """Convert a camelCase/PascalCase alert type into a Title-Cased label.
+
+    Used as a last-resort fallback when the SDK does not have metadata for an
+    alert type and there is no explicit override. Adjacent capitals are kept
+    together so acronyms like 'SQL' survive ('SQLInjection' -> 'SQL Injection').
+    """
+    if not alert_type:
+        return ""
+    parts = _HUMANIZE_BOUNDARY.split(alert_type)
+    return " ".join(part[:1].upper() + part[1:] for part in parts if part)
+
+
 class Core:
     """Main class for interacting with Socket Security API and processing scan results."""
 
@@ -1402,11 +1423,19 @@ def add_package_alerts_to_collection(self, package: Package, alerts_collection:
             alert = Alert(**alert_item)
             props = getattr(self.config.all_issues, alert.type, default_props)
             introduced_by = self.get_source_data(package, packages)
-            
-            # Handle special case for license policy violations
+
+            # Title resolution order:
+            #   1. SDK-provided title (props.title) if non-empty
+            #   2. Explicit override for known-but-unmapped alert types (e.g. gptDidYouMean)
+            #   3. Hard-coded special cases (e.g. licenseSpdxDisj)
+            #   4. Humanized alert.type as last-resort fallback
             title = props.title
-            if alert.type == "licenseSpdxDisj" and not title:
+            if not title:
+                title = _ALERT_TYPE_TITLE_OVERRIDES.get(alert.type, "")
+            if not title and alert.type == "licenseSpdxDisj":
                 title = "License Policy Violation"
+            if not title:
+                title = _humanize_alert_type(alert.type)
             
             issue_alert = Issue(
                 pkg_type=package.type,
diff --git a/tests/core/test_package_and_alerts.py b/tests/core/test_package_and_alerts.py
index f616479..171eae7 100644
--- a/tests/core/test_package_and_alerts.py
+++ b/tests/core/test_package_and_alerts.py
@@ -4,7 +4,7 @@
 import pytest
 from socketdev import socketdev
 
-from socketsecurity.core import Core
+from socketsecurity.core import Core, _humanize_alert_type
 from socketsecurity.core.classes import Issue, Package
 from socketsecurity.core.socket_config import SocketConfig
 
@@ -166,6 +166,62 @@ def test_add_package_alerts_basic(self, core):
         assert alert.type == "networkAccess"
         assert alert.severity == "high"
 
+    def test_gpt_did_you_mean_gets_typosquat_title(self, core):
+        """gptDidYouMean alerts must render a non-empty title (CUS2-2)."""
+        package = self.make_package(
+            alerts=[{
+                "type": "gptDidYouMean",
+                "key": "gpt-did-you-mean-alert",
+                "severity": "middle",
+            }],
+            topLevelAncestors=[],
+        )
+
+        result = core.add_package_alerts_to_collection(
+            package, alerts_collection={}, packages={package.id: package}
+        )
+
+        alert = result["gpt-did-you-mean-alert"][0]
+        assert alert.type == "gptDidYouMean"
+        assert alert.title, "title should not be empty for gptDidYouMean"
+        assert "typosquat" in alert.title.lower()
+
+    def test_unknown_alert_type_falls_back_to_humanized_title(self, core):
+        """Any alert type not present in the SDK should still render a non-empty title."""
+        package = self.make_package(
+            alerts=[{
+                "type": "someBrandNewAlertType",
+                "key": "future-alert",
+                "severity": "low",
+            }],
+            topLevelAncestors=[],
+        )
+
+        result = core.add_package_alerts_to_collection(
+            package, alerts_collection={}, packages={package.id: package}
+        )
+
+        alert = result["future-alert"][0]
+        assert alert.title == "Some Brand New Alert Type"
+
+    def test_license_spdx_disj_keeps_explicit_title(self, core):
+        """licenseSpdxDisj must keep its hard-coded fallback (regression guard for CUS2-2 fix)."""
+        package = self.make_package(
+            alerts=[{
+                "type": "licenseSpdxDisj",
+                "key": "license-alert",
+                "severity": "high",
+            }],
+            topLevelAncestors=[],
+        )
+
+        result = core.add_package_alerts_to_collection(
+            package, alerts_collection={}, packages={package.id: package}
+        )
+
+        alert = result["license-alert"][0]
+        assert alert.title == "License Policy Violation"
+
 
 
     def test_get_capabilities_for_added_packages(self, core):
@@ -266,3 +322,22 @@ def test_get_license_text_via_purl_uses_org_scoped_endpoint(self, core, mock_sdk
         )
         assert result["npm/lodash@4.18.1"].licenseAttrib == [{"name": "MIT"}]
         assert result["npm/lodash@4.18.1"].licenseDetails == [{"license": "MIT"}]
+
+
+class TestHumanizeAlertType:
+    def test_humanizes_camel_case(self):
+        assert _humanize_alert_type("gptDidYouMean") == "Gpt Did You Mean"
+
+    def test_humanizes_single_word(self):
+        assert _humanize_alert_type("malware") == "Malware"
+
+    def test_humanizes_pascal_case(self):
+        assert _humanize_alert_type("UnsafeShellAccess") == "Unsafe Shell Access"
+
+    def test_empty_input_returns_empty_string(self):
+        assert _humanize_alert_type("") == ""
+
+    def test_handles_acronyms_conservatively(self):
+        """Adjacent capitals are kept together: SQLInjection -> 'SQL Injection'."""
+        assert _humanize_alert_type("SQLInjection") == "SQL Injection"
+
diff --git a/uv.lock b/uv.lock
index e47a62c..88ccbd5 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.91"
+version = "2.2.92"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 6969361deead6802ca593d70f98377799f554947 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 29 May 2026 18:01:20 -0400
Subject: [PATCH 51/80] Bundle dependency updates, harden Dependabot reviews
 (#207)

* chore: prettify, sort, and round out .gitignore

Reorganizes .gitignore into labeled sections (Python cache, venvs, build
artifacts, IDE, OS, logs, env files, generated output, project scratch,
Conductor) with sorted entries within each group and trailing slashes on
directory patterns for clarity.

Folds in three smaller intents that would otherwise be separate commits:
- Add .context/ for Conductor workspaces (collaboration scratch)
- Add coverage.xml + .pytest_cache/ to fully cover pytest-cov outputs
  (.coverage.* and htmlcov/ were already on main from prior work)
- Add *.swp / *.swo for vim swap files

Drops the stale `*.cpython-312.pyc\`` line with a literal-backtick typo;
it wasn't matching anything and `*.pyc` already covers the case.

No behavior changes anyone would notice from the resulting rule set.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: add .github/dependabot.yml to tame Dependabot PR noise

The repo had no explicit Dependabot config, so Dependabot ran on full
defaults: one PR per package per manifest, across every manifest in
the tree -- including the e2e test fixtures that are intentionally
crafted to exercise Socket's scanner. The cumulative result was the
"PR pileup" this PR is consolidating.

New config:
- uv ecosystem (main app): grouped weekly into ONE minor/patch PR and
  one major PR; matches the existing python:uv labeling
- github-actions: grouped weekly into ONE minor/patch PR
- docker: separate weekly PR per Dockerfile change
- 7-day cooldown across all ecosystems to give upstream time to pull
  bad releases
- e2e fixtures (tests/e2e/fixtures/{simple-npm,simple-pypi}) are
  INTENTIONALLY excluded -- their pins should be chosen for supply-
  chain signal, not auto-bumped (this is why we had three fixture
  PRs in the cleanup)

Pattern adapted from SocketDev/socket-basics.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: add dependabot-review workflow with Socket Firewall smoke jobs

For every Dependabot-authored PR, inspect what changed and conditionally
run Socket Firewall (sfw) install smoke jobs against the affected
manifests. Because sfw uses the anonymous Socket public-data API it
needs NO secret, so this runs cleanly under the standard `pull_request`
context -- no pull_request_target, no token-leak surface.

Jobs (all conditional on file diff):
- python-sfw-smoke:      pyproject.toml / uv.lock -> `sfw uv sync` plus
                         an import smoke on the modules that depend on
                         the upgraded packages (cryptography, gitpython,
                         requests, ...). Catches API-removal breaks
                         from minor/patch deprecations.
- fixture-npm-sfw-smoke: tests/e2e/fixtures/simple-npm/** -> `sfw npm
                         install` in a clean cwd.
- fixture-pypi-sfw-smoke: tests/e2e/fixtures/simple-pypi/** -> `sfw pip
                         install -r requirements.txt` in a clean venv.
- dockerfile-smoke:      `docker build --pull` (no push) when the
                         Dockerfile changes.
- workflow-notice:       Flag Dependabot PRs that touch workflow or
                         dependabot config files for explicit human
                         review (anti-supply-chain-confusion guardrail).

Pattern adapted from SocketDev/socket-basics dependabot-review.yml.
Action SHAs match the pins already in python-tests.yml and e2e-test.yml
so zizmor stays happy.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: add lock-drift, import-smoke, and pip-audit; skip e2e on dependabot

python-tests.yml:
- `uv lock --locked` -- fails if uv.lock has drifted from pyproject.toml.
  Prevents the "forgot to commit the lockfile" class of mistake.
- Import smoke step that loads every top-level module touching the
  upgraded packages (cryptography, gitpython, requests, urllib3, ...).
  Catches API-removal breaks from minor/patch deprecations that the
  unit suite alone wouldn't surface.
- `uvx pip-audit --strict` against the synced env -- light CVE check
  on the resolved transitive tree. Runs in seconds via uv's caching.

e2e-test.yml:
- Skip e2e on Dependabot PRs. They don't have access to the Socket API
  secret so e2e would always fail on them, polluting the PR check UI.
  Supply-chain risk for dep bumps is covered by dependabot-review.yml's
  Socket Firewall smoke jobs, which need no secrets.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: fix pip-audit invocation to scan exported requirements

`uvx pip-audit --disable-pip` requires `-r` plus either hashed
requirements or `--no-deps`. The previous invocation crashed at start.

Now: export the locked deps via `uv export --no-hashes --no-emit-project`
into a tmp requirements file (skipping the local editable install of
the project itself), then feed that to pip-audit with `--disable-pip
--no-deps`. Verified locally -- no known vulnerabilities found across
the 85 locked transitive deps.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(deps): bump 9 main-app dependencies to latest

Bundles the nine open Dependabot PRs against the main app into a single
uv.lock regeneration. Where Dependabot's target trailed the latest published
release, we went to the current latest and re-verified through sfw:

- urllib3       2.6.3   -> 2.7.0     (closes #200)
- gitpython     3.1.46  -> 3.1.50    (closes #198)
- python-dotenv 1.2.1   -> 1.2.2     (closes #190)
- pytest        9.0.2   -> 9.0.3     (closes #188)
- uv            0.9.21  -> 0.11.17   (closes #210; Dependabot targeted 0.11.15)
- cryptography  46.0.5  -> 46.0.7    (closes #181)
- pygments      2.19.2  -> 2.20.0    (closes #177)
- requests      2.32.5  -> 2.33.0    (closes #175)
- idna          3.11    -> 3.15      (closes #205, CVE-2026-45409)

idna 3.14 fixed CVE-2026-45409 -- a quadratic-time DoS via oversized inputs
that bypassed the earlier CVE-2024-3651 mitigation. The rest are hygiene.

All nine final versions verified clean through Socket Firewall (sfw) on the
full transitive tree.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(deps): bump e2e fixture manifests

Closes the open Dependabot PRs against the e2e test fixtures. axios went to
the current latest (1.16.1) rather than Dependabot's 1.16.0 target:

- tests/e2e/fixtures/simple-npm:  axios    1.15.0 -> 1.16.1  (closes #209)
- tests/e2e/fixtures/simple-pypi: requests 2.31.0 -> 2.33.0  (closes #187)
- tests/e2e/fixtures/simple-pypi: flask    3.0.0  -> 3.1.3   (closes #186)

These fixtures were stale rather than intentionally pinned. Socket Firewall
verified the install paths. The new .github/dependabot.yml intentionally
excludes tests/e2e/fixtures/** from future auto-bumps.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): 2.2.93 with CHANGELOG backfill

Patch release. Scope is maintenance only: dependency bundle + Dependabot
review hardening + housekeeping + CHANGELOG backfill. No behavior changes.

Targets 2.2.93 (not 2.2.92) to stay ahead of an in-flight 2.2.92 bug-fix
release landing separately.

CHANGELOG: 2.2.93 entry for this PR, plus backfilled entries for 2.2.81,
2.2.85, 2.2.86, 2.2.88, 2.2.89, and 2.2.91 (the #180 backfill covered
2.2.74-2.2.80; main reached 2.2.91 via #199 without a CHANGELOG note).

Version refs synced across pyproject.toml, socketsecurity/__init__.py, and
uv.lock per the version-incrementation CI check.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 .github/dependabot.yml                        |  74 +++++++
 .github/workflows/dependabot-review.yml       | 205 ++++++++++++++++++
 .github/workflows/e2e-test.yml                |   9 +-
 .github/workflows/python-tests.yml            |  16 ++
 .gitignore                                    |  70 ++++--
 CHANGELOG.md                                  |  59 +++++
 pyproject.toml                                |   2 +-
 socketsecurity/__init__.py                    |   2 +-
 tests/e2e/fixtures/simple-npm/package.json    |   2 +-
 .../e2e/fixtures/simple-pypi/requirements.txt |   4 +-
 uv.lock                                       | 168 +++++++-------
 11 files changed, 498 insertions(+), 113 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/dependabot-review.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7c05ee5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,74 @@
+# Dependabot configuration for socket-python-cli.
+#
+# Design notes:
+# - Python deps are grouped into a weekly PR (minor/patch).
+# - GitHub Actions are grouped similarly into one weekly PR.
+# - Docker (the project Dockerfile) is tracked separately.
+# - 7-day cooldown enforced across all ecosystems.
+
+version: 2
+updates:
+
+  # Main app Python deps (uv-tracked)
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    groups:
+      python-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      python-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+    labels:
+      - "dependencies"
+      - "python:uv"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    cooldown:
+      default-days: 7
+
+  # GitHub Actions used in workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    groups:
+      github-actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+    cooldown:
+      default-days: 7
+
+  # Project Dockerfile base images and pinned binaries
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 2
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/dependabot-review.yml b/.github/workflows/dependabot-review.yml
new file mode 100644
index 0000000..486ccb3
--- /dev/null
+++ b/.github/workflows/dependabot-review.yml
@@ -0,0 +1,205 @@
+name: dependabot-review
+
+# Dependency-update PR guardrails for Dependabot-authored PRs.
+#
+# Runs only on PRs opened by dependabot[bot]. Inspects which files
+# changed, then conditionally runs Socket Firewall (sfw) install smoke
+# jobs for the affected manifests. Because sfw uses the free, anonymous
+# Socket public-data path it needs NO API key, so we can run it from
+# the unprivileged `pull_request` context without pull_request_target
+# or any of its security tradeoffs.
+#
+# Pattern adapted from SocketDev/socket-basics.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependabot-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  inspect:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      python_deps_changed: ${{ steps.diff.outputs.python_deps_changed }}
+      fixture_npm_changed: ${{ steps.diff.outputs.fixture_npm_changed }}
+      fixture_pypi_changed: ${{ steps.diff.outputs.fixture_pypi_changed }}
+      dockerfile_changed: ${{ steps.diff.outputs.dockerfile_changed }}
+      workflow_or_action_changed: ${{ steps.diff.outputs.workflow_or_action_changed }}
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Inspect changed files
+        id: diff
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          CHANGED_FILES="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
+
+          {
+            echo "## Changed files"
+            echo '```'
+            printf '%s\n' "$CHANGED_FILES"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          has_file() {
+            local pattern="$1"
+            if printf '%s\n' "$CHANGED_FILES" | grep -Eq "$pattern"; then
+              echo "true"
+            else
+              echo "false"
+            fi
+          }
+
+          {
+            echo "python_deps_changed=$(has_file '^(pyproject\.toml|uv\.lock)$')"
+            echo "fixture_npm_changed=$(has_file '^tests/e2e/fixtures/simple-npm/')"
+            echo "fixture_pypi_changed=$(has_file '^tests/e2e/fixtures/simple-pypi/')"
+            echo "dockerfile_changed=$(has_file '^Dockerfile$')"
+            echo "workflow_or_action_changed=$(has_file '^\.github/workflows/|^\.github/dependabot\.yml$')"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Summarize review expectations
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          {
+            echo "## Dependabot Review Checklist"
+            echo "- PR: $PR_URL"
+            echo "- Confirm upstream release notes before merge"
+            echo "- Do not treat a Dependabot PR as trusted solely because of the actor"
+            echo "- This workflow runs in pull_request context only; no publish secrets are exposed"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  python-sfw-smoke:
+    needs: inspect
+    if: needs.inspect.outputs.python_deps_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: "3.12"
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        with:
+          node-version: "20"
+
+      - name: Install Socket Firewall
+        run: npm install -g sfw
+
+      - name: Install uv
+        run: python -m pip install --upgrade pip uv
+
+      - name: Sync project through Socket Firewall
+        run: sfw uv sync --extra test --extra dev
+
+      - name: Import smoke test
+        run: |
+          uv run python -c "
+          from socketsecurity.socketcli import cli, build_socket_sdk
+          from socketsecurity.core import Core
+          from socketsecurity.core.exceptions import (
+              APIFailure, RequestTimeoutExceeded, APIResourceNotFound,
+          )
+          from socketsecurity.core.git_interface import Git
+          from socketsecurity.config import CliConfig
+          print('import smoke OK')
+          "
+
+  fixture-npm-sfw-smoke:
+    needs: inspect
+    if: needs.inspect.outputs.fixture_npm_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        with:
+          node-version: "20"
+
+      - name: Install Socket Firewall
+        run: npm install -g sfw
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-npm
+        run: sfw npm install --no-audit --no-fund --ignore-scripts
+
+  fixture-pypi-sfw-smoke:
+    needs: inspect
+    if: needs.inspect.outputs.fixture_pypi_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        with:
+          python-version: "3.12"
+
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+        with:
+          node-version: "20"
+
+      - name: Install Socket Firewall
+        run: npm install -g sfw
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-pypi
+        run: |
+          python -m venv .venv
+          # shellcheck disable=SC1091
+          source .venv/bin/activate
+          sfw pip install -r requirements.txt
+
+  dockerfile-smoke:
+    needs: inspect
+    if: needs.inspect.outputs.dockerfile_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Build the Dockerfile (no push)
+        run: docker build --pull -t socket-python-cli:dependabot-smoke .
+
+  workflow-notice:
+    needs: inspect
+    if: needs.inspect.outputs.workflow_or_action_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Flag workflow-sensitive updates
+        run: |
+          {
+            echo "## Sensitive File Notice"
+            echo "This Dependabot PR changes workflow or dependabot config files."
+            echo "Require explicit human review before merge."
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 95e93c9..83a6fa4 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -11,7 +11,14 @@ permissions:
 
 jobs:
   e2e:
-    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    # Skip e2e on:
+    #  - PRs from forks (no secrets)
+    #  - Dependabot PRs (no secrets, and dependency-bump risk is already
+    #    covered by dependabot-review.yml's Socket Firewall smoke jobs)
+    if: >-
+      (github.event_name != 'pull_request' ||
+        github.event.pull_request.head.repo.full_name == github.repository) &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index d30e67a..94f4f82 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -48,8 +48,24 @@ jobs:
           python -m pip install --upgrade pip
           pip install uv
           uv sync --extra test
+      - name: 🔒 verify uv.lock is in sync with pyproject.toml
+        run: uv lock --locked
       - name: 🧪 run tests
         run: uv run pytest -q tests/unit/ tests/core/
+      - name: 💨 import smoke (catches API-removal breaks from upgraded deps)
+        run: |
+          uv run python -c "
+          from socketsecurity.socketcli import cli
+          from socketsecurity.core import Core
+          from socketsecurity.core.exceptions import APIFailure, APIResourceNotFound
+          from socketsecurity.core.git_interface import Git
+          from socketsecurity.config import CliConfig
+          print('import smoke OK')
+          "
+      - name: 🛡️ pip-audit (known CVEs in the locked deps)
+        run: |
+          uv export --no-hashes --no-emit-project --format requirements-txt > /tmp/req-audit.txt
+          uvx pip-audit --strict --progress-spinner off --disable-pip --no-deps -r /tmp/req-audit.txt
 
   unsupported-python-install:
     runs-on: ubuntu-latest
diff --git a/.gitignore b/.gitignore
index 990cbcc..10615ef 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,34 +1,58 @@
-.idea
-venv
-.venv
-.venv-test
-build
-dist
+# --- Python bytecode / cache ---
+*.pyc
+__pycache__/
+.coverage
+.coverage.*
+coverage.xml
+htmlcov/
+.pytest_cache/
+
+# --- Virtual environments ---
+venv/
+.venv/
+.venv-test/
+Pipfile
+
+# --- Build / packaging ---
 *.build
 *.dist
-*.egg-info
-*.env
-run_container.sh
+*.egg-info/
+bin/
+build/
+dist/
 *.zip
-bin
-scripts/*.py
+
+# --- Editor / IDE ---
+.idea/
+*.swp
+*.swo
+
+# --- OS ---
+.DS_Store
+
+# --- Logs ---
+logs/
+
+# --- Env files ---
+*.env
+.env.local
+
+# --- Generated output ---
 *.json
-*.sarif
 !tests/**/*.json
 !examples/config/*.json
+*.sarif
 markdown_overview_temp.md
 markdown_security_temp.md
-.DS_Store
-*.pyc
-test.py
-*.cpython-312.pyc`
+
+# --- Project-specific scratch ---
+ai_testing/
 file_generator.py
-.coverage
-.coverage.*
-htmlcov/
-.env.local
-Pipfile
+run_container.sh
+scripts/*.py
 test/
-logs
-ai_testing/
+test.py
 verify_find_files_lazy_loading.py
+
+# --- Conductor workspace ---
+.context/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8ab4d97..e917ffa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,13 +1,72 @@
 # Changelog
 
+## 2.2.93
+
+- Bundled twelve Dependabot dependency updates: `urllib3`, `gitpython`, `python-dotenv`, `pytest`, `uv`, `cryptography`, `pygments`, `requests`, and `idna` (main app), plus `axios`, `requests`, and `flask` (e2e fixtures). `idna` 3.11 → 3.15 includes the fix for CVE-2026-45409.
+- Added `.github/dependabot.yml` with grouped weekly updates, a 7-day cooldown, and e2e fixtures excluded.
+- Added a `dependabot-review` workflow that runs Socket Firewall (`sfw`) install checks on Dependabot PRs with no API token required.
+- Added a `uv.lock` drift check, an import smoke test, and `pip-audit` to the test workflow; skipped e2e tests on Dependabot PRs.
+- Tidied `.gitignore` and backfilled missing CHANGELOG entries for `2.2.81`, `2.2.85`, `2.2.86`, `2.2.88`, `2.2.89`, `2.2.91`, and `2.2.92`.
+
+## 2.2.92
+
+- Fixed dependency-overview rendering for unmapped alert types: alert types the SDK
+  has no metadata for now fall back to a humanized Title-Cased label (e.g.
+  `gptDidYouMean` -> "Possible typosquat attack (GPT)", `SQLInjection` -> "SQL
+  Injection") instead of surfacing the raw camelCase identifier.
+
+## 2.2.91
+
+- Added legal/compliance artifact presets (`--legal`) and FOSSA-compatible output
+  shapes (`--legal-format fossa`) for license and SBOM reporting.
+
 ## 2.2.90
 
 - Migrated license enrichment PURL lookup to the org-scoped endpoint (`POST /v0/orgs/{slug}/purl`) from the deprecated global endpoint (`POST /v0/purl`).
 
+## 2.2.89
+
+- Added `uv.lock` to the version-incrementation CI check so a `pyproject.toml` /
+  `__init__.py` version bump without a matching lockfile sync no longer slips through.
+- Updated the local Python pre-commit hook to keep `uv.lock` in sync with
+  `pyproject.toml` and `socketsecurity/__init__.py` version changes automatically.
+
+## 2.2.88
+
+- Added `bun.lock`, `bun.lockb`, and `vlt-lock.json` to the recognized manifest files
+  for Socket scanning, with matching unit-test coverage.
+
+## 2.2.86
+
+- Bumped `socketdev` to `>=3.0.33,<4.0.0` to pick up the SDK fix for unknown alert
+  categories (the SDK previously crashed while deserializing diff alerts when the API
+  returned a category like `"other"`).
+- Normalized diff artifacts with `score=None` to an empty score map in the CLI model
+  layer; PR-comment dependency-overview rendering no longer crashes on missing or
+  partial score data.
+- Defaulted missing badge values to a valid `100%` fallback rather than producing
+  invalid badge URLs.
+
+## 2.2.85
+
+- Added four hidden `--reach-continue-on-*` flags in preparation for Coana CLI v15:
+  `--reach-continue-on-analysis-errors`, `--reach-continue-on-install-errors`,
+  `--reach-continue-on-missing-lock-files`, `--reach-continue-on-no-source-files`.
+  Each forwards to the matching Coana flag and opts out of one of Coana v15's new
+  halt-by-default behaviors. No-op against today's default Coana version; will take
+  effect automatically once Coana v15 becomes the default.
+
 ## 2.2.83
 
 - Fixed branch detection in detached-HEAD CI checkouts. When `git name-rev --name-only HEAD` returned an output with a suffix operator (e.g. `remotes/origin/master~1`, `master^0`), the `~N`/`^N` was previously passed through as the branch name and rejected by the Socket API as an invalid Git ref. The suffix is now stripped before the prefix split, producing the bare branch name.
 
+## 2.2.81
+
+- Fixed GitLab security report schema compliance: corrected schema validation errors so
+  Socket-produced reports parse cleanly under GitLab's dependency-scanning ingestion.
+- Populated scan alert data in the GitLab security report so previously-empty alert
+  sections now carry the expected findings.
+
 ## 2.2.80
 
 - Hardened GitHub Actions workflows.
diff --git a/pyproject.toml b/pyproject.toml
index b661dc7..7a7577e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.92"
+version = "2.2.93"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 9f58d90..f5930c6 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.92'
+__version__ = '2.2.93'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/tests/e2e/fixtures/simple-npm/package.json b/tests/e2e/fixtures/simple-npm/package.json
index 8a7e8ec..3454c5b 100644
--- a/tests/e2e/fixtures/simple-npm/package.json
+++ b/tests/e2e/fixtures/simple-npm/package.json
@@ -6,7 +6,7 @@
   "dependencies": {
     "lodash": "4.18.1",
     "express": "4.22.0",
-    "axios": "1.15.0"
+    "axios": "1.16.1"
   },
   "devDependencies": {
     "typescript": "5.0.4",
diff --git a/tests/e2e/fixtures/simple-pypi/requirements.txt b/tests/e2e/fixtures/simple-pypi/requirements.txt
index acce997..28271a8 100644
--- a/tests/e2e/fixtures/simple-pypi/requirements.txt
+++ b/tests/e2e/fixtures/simple-pypi/requirements.txt
@@ -1,3 +1,3 @@
-requests==2.31.0
-flask==3.0.0
+requests==2.33.0
+flask==3.1.3
 pyyaml==6.0.1
diff --git a/uv.lock b/uv.lock
index 88ccbd5..facecef 100644
--- a/uv.lock
+++ b/uv.lock
@@ -382,50 +382,50 @@ toml = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.5"
+version = "46.0.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/60/04/ee2a9e8542e4fa2773b81771ff8349ff19cdd56b7258a0cc442639052edb/cryptography-46.0.5.tar.gz", hash = "sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d", size = 750064, upload-time = "2026-02-10T19:18:38.255Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/ff/9e/6b4397a3e3d15123de3b1806ef342522393d50736c13b20ec4c9ea6693a6/cryptography-46.0.5-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c18ff11e86df2e28854939acde2d003f7984f721eba450b56a200ad90eeb0e6b", size = 4275637, upload-time = "2026-02-10T19:17:10.53Z" },
-    { url = "https://files.pythonhosted.org/packages/63/e7/471ab61099a3920b0c77852ea3f0ea611c9702f651600397ac567848b897/cryptography-46.0.5-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4d7e3d356b8cd4ea5aff04f129d5f66ebdc7b6f8eae802b93739ed520c47c79b", size = 4424742, upload-time = "2026-02-10T19:17:12.388Z" },
-    { url = "https://files.pythonhosted.org/packages/37/53/a18500f270342d66bf7e4d9f091114e31e5ee9e7375a5aba2e85a91e0044/cryptography-46.0.5-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:50bfb6925eff619c9c023b967d5b77a54e04256c4281b0e21336a130cd7fc263", size = 4277528, upload-time = "2026-02-10T19:17:13.853Z" },
-    { url = "https://files.pythonhosted.org/packages/22/29/c2e812ebc38c57b40e7c583895e73c8c5adb4d1e4a0cc4c5a4fdab2b1acc/cryptography-46.0.5-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:803812e111e75d1aa73690d2facc295eaefd4439be1023fefc4995eaea2af90d", size = 4947993, upload-time = "2026-02-10T19:17:15.618Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/e7/237155ae19a9023de7e30ec64e5d99a9431a567407ac21170a046d22a5a3/cryptography-46.0.5-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ee190460e2fbe447175cda91b88b84ae8322a104fc27766ad09428754a618ed", size = 4456855, upload-time = "2026-02-10T19:17:17.221Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/87/fc628a7ad85b81206738abbd213b07702bcbdada1dd43f72236ef3cffbb5/cryptography-46.0.5-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:f145bba11b878005c496e93e257c1e88f154d278d2638e6450d17e0f31e558d2", size = 3984635, upload-time = "2026-02-10T19:17:18.792Z" },
-    { url = "https://files.pythonhosted.org/packages/84/29/65b55622bde135aedf4565dc509d99b560ee4095e56989e815f8fd2aa910/cryptography-46.0.5-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:e9251e3be159d1020c4030bd2e5f84d6a43fe54b6c19c12f51cde9542a2817b2", size = 4277038, upload-time = "2026-02-10T19:17:20.256Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/36/45e76c68d7311432741faf1fbf7fac8a196a0a735ca21f504c75d37e2558/cryptography-46.0.5-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:47fb8a66058b80e509c47118ef8a75d14c455e81ac369050f20ba0d23e77fee0", size = 4912181, upload-time = "2026-02-10T19:17:21.825Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/1a/c1ba8fead184d6e3d5afcf03d569acac5ad063f3ac9fb7258af158f7e378/cryptography-46.0.5-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:4c3341037c136030cb46e4b1e17b7418ea4cbd9dd207e4a6f3b2b24e0d4ac731", size = 4456482, upload-time = "2026-02-10T19:17:25.133Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/e5/3fb22e37f66827ced3b902cf895e6a6bc1d095b5b26be26bd13c441fdf19/cryptography-46.0.5-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:890bcb4abd5a2d3f852196437129eb3667d62630333aacc13dfd470fad3aaa82", size = 4405497, upload-time = "2026-02-10T19:17:26.66Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/df/9d58bb32b1121a8a2f27383fabae4d63080c7ca60b9b5c88be742be04ee7/cryptography-46.0.5-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:80a8d7bfdf38f87ca30a5391c0c9ce4ed2926918e017c29ddf643d0ed2778ea1", size = 4667819, upload-time = "2026-02-10T19:17:28.569Z" },
-    { url = "https://files.pythonhosted.org/packages/67/c8/581a6702e14f0898a0848105cbefd20c058099e2c2d22ef4e476dfec75d7/cryptography-46.0.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5be7bf2fb40769e05739dd0046e7b26f9d4670badc7b032d6ce4db64dddc0678", size = 4265728, upload-time = "2026-02-10T19:17:35.569Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/4a/ba1a65ce8fc65435e5a849558379896c957870dd64fecea97b1ad5f46a37/cryptography-46.0.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe346b143ff9685e40192a4960938545c699054ba11d4f9029f94751e3f71d87", size = 4408287, upload-time = "2026-02-10T19:17:36.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/67/8ffdbf7b65ed1ac224d1c2df3943553766914a8ca718747ee3871da6107e/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:c69fd885df7d089548a42d5ec05be26050ebcd2283d89b3d30676eb32ff87dee", size = 4270291, upload-time = "2026-02-10T19:17:38.748Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/e5/f52377ee93bc2f2bba55a41a886fd208c15276ffbd2569f2ddc89d50e2c5/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:8293f3dea7fc929ef7240796ba231413afa7b68ce38fd21da2995549f5961981", size = 4927539, upload-time = "2026-02-10T19:17:40.241Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/02/cfe39181b02419bbbbcf3abdd16c1c5c8541f03ca8bda240debc467d5a12/cryptography-46.0.5-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:1abfdb89b41c3be0365328a410baa9df3ff8a9110fb75e7b52e66803ddabc9a9", size = 4442199, upload-time = "2026-02-10T19:17:41.789Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/96/2fcaeb4873e536cf71421a388a6c11b5bc846e986b2b069c79363dc1648e/cryptography-46.0.5-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:d66e421495fdb797610a08f43b05269e0a5ea7f5e652a89bfd5a7d3c1dee3648", size = 3960131, upload-time = "2026-02-10T19:17:43.379Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/d2/b27631f401ddd644e94c5cf33c9a4069f72011821cf3dc7309546b0642a0/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:4e817a8920bfbcff8940ecfd60f23d01836408242b30f1a708d93198393a80b4", size = 4270072, upload-time = "2026-02-10T19:17:45.481Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/a7/60d32b0370dae0b4ebe55ffa10e8599a2a59935b5ece1b9f06edb73abdeb/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:68f68d13f2e1cb95163fa3b4db4bf9a159a418f5f6e7242564fc75fcae667fd0", size = 4892170, upload-time = "2026-02-10T19:17:46.997Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/b9/cf73ddf8ef1164330eb0b199a589103c363afa0cf794218c24d524a58eab/cryptography-46.0.5-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:a3d1fae9863299076f05cb8a778c467578262fae09f9dc0ee9b12eb4268ce663", size = 4441741, upload-time = "2026-02-10T19:17:48.661Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/eb/eee00b28c84c726fe8fa0158c65afe312d9c3b78d9d01daf700f1f6e37ff/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c4143987a42a2397f2fc3b4d7e3a7d313fbe684f67ff443999e803dd75a76826", size = 4396728, upload-time = "2026-02-10T19:17:50.058Z" },
-    { url = "https://files.pythonhosted.org/packages/65/f4/6bc1a9ed5aef7145045114b75b77c2a8261b4d38717bd8dea111a63c3442/cryptography-46.0.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7d731d4b107030987fd61a7f8ab512b25b53cef8f233a97379ede116f30eb67d", size = 4652001, upload-time = "2026-02-10T19:17:51.54Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/04/c85bdeab78c8bc77b701bf0d9bdcf514c044e18a46dcff330df5448631b0/cryptography-46.0.5-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7d1f30a86d2757199cb2d56e48cce14deddf1f9c95f1ef1b64ee91ea43fe2e18", size = 4275349, upload-time = "2026-02-10T19:17:58.419Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/32/9b87132a2f91ee7f5223b091dc963055503e9b442c98fc0b8a5ca765fab0/cryptography-46.0.5-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:039917b0dc418bb9f6edce8a906572d69e74bd330b0b3fea4f79dab7f8ddd235", size = 4420667, upload-time = "2026-02-10T19:18:00.619Z" },
-    { url = "https://files.pythonhosted.org/packages/a1/a6/a7cb7010bec4b7c5692ca6f024150371b295ee1c108bdc1c400e4c44562b/cryptography-46.0.5-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:ba2a27ff02f48193fc4daeadf8ad2590516fa3d0adeeb34336b96f7fa64c1e3a", size = 4276980, upload-time = "2026-02-10T19:18:02.379Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/7c/c4f45e0eeff9b91e3f12dbd0e165fcf2a38847288fcfd889deea99fb7b6d/cryptography-46.0.5-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:61aa400dce22cb001a98014f647dc21cda08f7915ceb95df0c9eaf84b4b6af76", size = 4939143, upload-time = "2026-02-10T19:18:03.964Z" },
-    { url = "https://files.pythonhosted.org/packages/37/19/e1b8f964a834eddb44fa1b9a9976f4e414cbb7aa62809b6760c8803d22d1/cryptography-46.0.5-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3ce58ba46e1bc2aac4f7d9290223cead56743fa6ab94a5d53292ffaac6a91614", size = 4453674, upload-time = "2026-02-10T19:18:05.588Z" },
-    { url = "https://files.pythonhosted.org/packages/db/ed/db15d3956f65264ca204625597c410d420e26530c4e2943e05a0d2f24d51/cryptography-46.0.5-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:420d0e909050490d04359e7fdb5ed7e667ca5c3c402b809ae2563d7e66a92229", size = 3978801, upload-time = "2026-02-10T19:18:07.167Z" },
-    { url = "https://files.pythonhosted.org/packages/41/e2/df40a31d82df0a70a0daf69791f91dbb70e47644c58581d654879b382d11/cryptography-46.0.5-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:582f5fcd2afa31622f317f80426a027f30dc792e9c80ffee87b993200ea115f1", size = 4276755, upload-time = "2026-02-10T19:18:09.813Z" },
-    { url = "https://files.pythonhosted.org/packages/33/45/726809d1176959f4a896b86907b98ff4391a8aa29c0aaaf9450a8a10630e/cryptography-46.0.5-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:bfd56bb4b37ed4f330b82402f6f435845a5f5648edf1ad497da51a8452d5d62d", size = 4901539, upload-time = "2026-02-10T19:18:11.263Z" },
-    { url = "https://files.pythonhosted.org/packages/99/0f/a3076874e9c88ecb2ecc31382f6e7c21b428ede6f55aafa1aa272613e3cd/cryptography-46.0.5-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:a3d507bb6a513ca96ba84443226af944b0f7f47dcc9a399d110cd6146481d24c", size = 4452794, upload-time = "2026-02-10T19:18:12.914Z" },
-    { url = "https://files.pythonhosted.org/packages/02/ef/ffeb542d3683d24194a38f66ca17c0a4b8bf10631feef44a7ef64e631b1a/cryptography-46.0.5-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:9f16fbdf4da055efb21c22d81b89f155f02ba420558db21288b3d0035bafd5f4", size = 4404160, upload-time = "2026-02-10T19:18:14.375Z" },
-    { url = "https://files.pythonhosted.org/packages/96/93/682d2b43c1d5f1406ed048f377c0fc9fc8f7b0447a478d5c65ab3d3a66eb/cryptography-46.0.5-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ced80795227d70549a411a4ab66e8ce307899fad2220ce5ab2f296e687eacde9", size = 4667123, upload-time = "2026-02-10T19:18:15.886Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/6f/6cc6cc9955caa6eaf83660b0da2b077c7fe8ff9950a3c5e45d605038d439/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:bc84e875994c3b445871ea7181d424588171efec3e185dced958dad9e001950a", size = 4218321, upload-time = "2026-02-10T19:18:22.349Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/5d/c4da701939eeee699566a6c1367427ab91a8b7088cc2328c09dbee940415/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:2ae6971afd6246710480e3f15824ed3029a60fc16991db250034efd0b9fb4356", size = 4381786, upload-time = "2026-02-10T19:18:24.529Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/97/a538654732974a94ff96c1db621fa464f455c02d4bb7d2652f4edc21d600/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:d861ee9e76ace6cf36a6a89b959ec08e7bc2493ee39d07ffe5acb23ef46d27da", size = 4217990, upload-time = "2026-02-10T19:18:25.957Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/11/7e500d2dd3ba891197b9efd2da5454b74336d64a7cc419aa7327ab74e5f6/cryptography-46.0.5-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:2b7a67c9cd56372f3249b39699f2ad479f6991e62ea15800973b956f4b73e257", size = 4381252, upload-time = "2026-02-10T19:18:27.496Z" },
+sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
+    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
+    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
+    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
+    { url = "https://files.pythonhosted.org/packages/74/66/e3ce040721b0b5599e175ba91ab08884c75928fbeb74597dd10ef13505d2/cryptography-46.0.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c", size = 4268551, upload-time = "2026-04-08T01:56:46.071Z" },
+    { url = "https://files.pythonhosted.org/packages/03/11/5e395f961d6868269835dee1bafec6a1ac176505a167f68b7d8818431068/cryptography-46.0.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902", size = 4408887, upload-time = "2026-04-08T01:56:47.718Z" },
+    { url = "https://files.pythonhosted.org/packages/40/53/8ed1cf4c3b9c8e611e7122fb56f1c32d09e1fff0f1d77e78d9ff7c82653e/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d", size = 4271354, upload-time = "2026-04-08T01:56:49.312Z" },
+    { url = "https://files.pythonhosted.org/packages/50/46/cf71e26025c2e767c5609162c866a78e8a2915bbcfa408b7ca495c6140c4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022", size = 4905845, upload-time = "2026-04-08T01:56:50.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/ea/01276740375bac6249d0a971ebdf6b4dc9ead0ee0a34ef3b5a88c1a9b0d4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce", size = 4444641, upload-time = "2026-04-08T01:56:52.882Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/4c/7d258f169ae71230f25d9f3d06caabcff8c3baf0978e2b7d65e0acac3827/cryptography-46.0.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f", size = 3967749, upload-time = "2026-04-08T01:56:54.597Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/2a/2ea0767cad19e71b3530e4cad9605d0b5e338b6a1e72c37c9c1ceb86c333/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99", size = 4270942, upload-time = "2026-04-08T01:56:56.416Z" },
+    { url = "https://files.pythonhosted.org/packages/41/3d/fe14df95a83319af25717677e956567a105bb6ab25641acaa093db79975d/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1", size = 4871079, upload-time = "2026-04-08T01:56:58.31Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/59/4a479e0f36f8f378d397f4eab4c850b4ffb79a2f0d58704b8fa0703ddc11/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2", size = 4443999, upload-time = "2026-04-08T01:57:00.508Z" },
+    { url = "https://files.pythonhosted.org/packages/28/17/b59a741645822ec6d04732b43c5d35e4ef58be7bfa84a81e5ae6f05a1d33/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e", size = 4399191, upload-time = "2026-04-08T01:57:02.654Z" },
+    { url = "https://files.pythonhosted.org/packages/59/6a/bb2e166d6d0e0955f1e9ff70f10ec4b2824c9cfcdb4da772c7dd69cc7d80/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee", size = 4655782, upload-time = "2026-04-08T01:57:04.592Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
+    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
+    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
+    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
+    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/ea/075aac6a84b7c271578d81a2f9968acb6e273002408729f2ddff517fed4a/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:d3b99c535a9de0adced13d159c5a9cf65c325601aa30f4be08afd680643e9c15", size = 4219700, upload-time = "2026-04-08T01:57:40.625Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/7b/1c55db7242b5e5612b29fc7a630e91ee7a6e3c8e7bf5406d22e206875fbd/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:d02c738dacda7dc2a74d1b2b3177042009d5cab7c7079db74afc19e56ca1b455", size = 4385982, upload-time = "2026-04-08T01:57:42.725Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/da/9870eec4b69c63ef5925bf7d8342b7e13bc2ee3d47791461c4e49ca212f4/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:04959522f938493042d595a736e7dbdff6eb6cc2339c11465b3ff89343b65f65", size = 4219115, upload-time = "2026-04-08T01:57:44.939Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/72/05aa5832b82dd341969e9a734d1812a6aadb088d9eb6f0430fc337cc5a8f/cryptography-46.0.7-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:3986ac1dee6def53797289999eabe84798ad7817f3e97779b5061a95b0ee4968", size = 4385479, upload-time = "2026-04-08T01:57:46.86Z" },
 ]
 
 [[package]]
@@ -475,14 +475,14 @@ wheels = [
 
 [[package]]
 name = "gitpython"
-version = "3.1.46"
+version = "3.1.50"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "gitdb" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/df/b5/59d16470a1f0dfe8c793f9ef56fd3826093fc52b3bd96d6b9d6c26c7e27b/gitpython-3.1.46.tar.gz", hash = "sha256:400124c7d0ef4ea03f7310ac2fbf7151e09ff97f2a3288d64a440c584a29c37f", size = 215371, upload-time = "2026-01-01T15:37:32.073Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/33/f6/354ae6491228b5eb40e10d89c4d13c651fe1cf7556e35ebdded50cff57ce/gitpython-3.1.50.tar.gz", hash = "sha256:80da2d12504d52e1f998772dc5baf6e553f8d2fcfe1fcc226c9d9a2ee3372dcc", size = 219798, upload-time = "2026-05-06T04:01:26.571Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6a/09/e21df6aef1e1ffc0c816f0522ddc3f6dcded766c3261813131c78a704470/gitpython-3.1.46-py3-none-any.whl", hash = "sha256:79812ed143d9d25b6d176a10bb511de0f9c67b1fa641d82097b0ab90398a2058", size = 208620, upload-time = "2026-01-01T15:37:30.574Z" },
+    { url = "https://files.pythonhosted.org/packages/20/7a/1c6e3562dfd8950adbb11ffbc65d21e7c89d01a6e4f137fa981056de25c5/gitpython-3.1.50-py3-none-any.whl", hash = "sha256:d352abe2908d07355014abdd21ddf798c2a961469239afec4962e9da884858f9", size = 212507, upload-time = "2026-05-06T04:01:23.799Z" },
 ]
 
 [[package]]
@@ -600,11 +600,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -877,11 +877,11 @@ wheels = [
 
 [[package]]
 name = "pygments"
-version = "2.19.2"
+version = "2.20.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
 ]
 
 [[package]]
@@ -895,7 +895,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -904,9 +904,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]
@@ -962,11 +962,11 @@ sdist = { url = "https://files.pythonhosted.org/packages/36/47/ab65fc1d682befc31
 
 [[package]]
 name = "python-dotenv"
-version = "1.2.1"
+version = "1.2.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f0/26/19cadc79a718c5edbec86fd4919a6b6d3f681039a2f6d66d14be94e75fb9/python_dotenv-1.2.1.tar.gz", hash = "sha256:42667e897e16ab0d66954af0e60a9caa94f0fd4ecf3aaf6d2d260eec1aa36ad6", size = 44221, upload-time = "2025-10-26T15:12:10.434Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/ed/0301aeeac3e5353ef3d94b6ec08bbcabd04a72018415dcb29e588514bba8/python_dotenv-1.2.2.tar.gz", hash = "sha256:2c371a91fbd7ba082c2c1dc1f8bf89ca22564a087c2c287cd9b662adde799cf3", size = 50135, upload-time = "2026-03-01T16:00:26.196Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/14/1b/a298b06749107c305e1fe0f814c6c74aea7b2f1e10989cb30f544a1b3253/python_dotenv-1.2.1-py3-none-any.whl", hash = "sha256:b81ee9561e9ca4004139c6cbba3a238c32b03e4894671e181b671e8cb8425d61", size = 21230, upload-time = "2025-10-26T15:12:09.109Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/d7/1959b9648791274998a9c3526f6d0ec8fd2233e4d4acce81bbae76b44b2a/python_dotenv-1.2.2-py3-none-any.whl", hash = "sha256:1d8214789a24de455a8b8bd8ae6fe3c6b69a5e3d64aa8a8e5d68e694bbcb285a", size = 22101, upload-time = "2026-03-01T16:00:25.09Z" },
 ]
 
 [[package]]
@@ -1049,7 +1049,7 @@ wheels = [
 
 [[package]]
 name = "requests"
-version = "2.32.5"
+version = "2.33.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -1057,9 +1057,9 @@ dependencies = [
     { name = "idna" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232, upload-time = "2026-03-25T15:10:41.586Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
+    { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017, upload-time = "2026-03-25T15:10:40.382Z" },
 ]
 
 [[package]]
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.92"
+version = "2.2.93"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },
@@ -1346,11 +1346,11 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]
@@ -1367,28 +1367,28 @@ wheels = [
 
 [[package]]
 name = "uv"
-version = "0.9.21"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/e2/2b/4e2090bc3a6265b445b3d31ca6fff20c6458d11145069f7e48ade3e2d75b/uv-0.9.21.tar.gz", hash = "sha256:aa4ca6ccd68e81b5ebaa3684d3c4df2b51a982ac16211eadf0707741d36e6488", size = 3834762, upload-time = "2025-12-30T16:12:51.927Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/26/0750c5bb1637ebefe1db0936dc76ead8ce97f17368cda950642bfd90fa3f/uv-0.9.21-py3-none-linux_armv6l.whl", hash = "sha256:0b330eaced2fd9d94e2a70f3bb6c8fd7beadc9d9bf9f1227eb14da44039c413a", size = 21266556, upload-time = "2025-12-30T16:12:47.311Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/ef/f019466c1e367ea68003cf35f4d44cc328694ed4a59b6004aa7dcacb2b35/uv-0.9.21-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:1d8e0940bddd37a55f4479d61adaa6b302b780d473f037fc084e48b09a1678e7", size = 20485648, upload-time = "2025-12-30T16:12:15.746Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/41/f735bd9a5b4848b6f4f1028e6d768f581559d68eddb6403eb0f19ca4c843/uv-0.9.21-py3-none-macosx_11_0_arm64.whl", hash = "sha256:cb420ddab7bcdd12c2352d4b551ced428d104311c0b98ce205675ab5c97072db", size = 18986976, upload-time = "2025-12-30T16:12:25.034Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/5f/01d537e05927594dc379ff8bc04f8cde26384d25108a9f63758eae2a7936/uv-0.9.21-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:a36d164438a6310c9fceebd041d80f7cffcc63ba80a7c83ee98394fadf2b8545", size = 20819312, upload-time = "2025-12-30T16:12:41.802Z" },
-    { url = "https://files.pythonhosted.org/packages/18/89/9497395f57e007a2daed8172042ecccade3ff5569fd367d093f49bd6a4a8/uv-0.9.21-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:c0ad83ce874cbbf9eda569ba793a9fb70870db426e9862300db8cf2950a7fe3b", size = 20900227, upload-time = "2025-12-30T16:12:19.242Z" },
-    { url = "https://files.pythonhosted.org/packages/04/61/a3f6dfc75d278cce96b370e00b6f03d73ec260e5304f622504848bad219d/uv-0.9.21-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:9076191c934b813147060e4cd97e33a58999de0f9c46f8ac67f614e154dae5c8", size = 21965424, upload-time = "2025-12-30T16:12:01.589Z" },
-    { url = "https://files.pythonhosted.org/packages/18/3e/344e8c1078cfea82159c6608b8694f24fdfe850ce329a4708c026cb8b0ff/uv-0.9.21-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:2ce0f6aca91f7fbf1192e43c063f4de3666fd43126aacc71ff7d5a79f831af59", size = 23540343, upload-time = "2025-12-30T16:12:13.139Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/20/5826659a81526687c6e5b5507f3f79f4f4b7e3022f3efae2ba36b19864c3/uv-0.9.21-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0b4817642d5ef248b74ca7be3505e5e012a06be050669b80d1f7ced5ad50d188", size = 23171564, upload-time = "2025-12-30T16:12:22.219Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/8d/404c54e019bb99ce474dc21e6b96c8a1351ba3c06e5e19fd8dcae0ba1899/uv-0.9.21-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4fb42237fa309d79905fb73f653f63c1fe45a51193411c614b13512cf5506df3", size = 22202400, upload-time = "2025-12-30T16:12:04.612Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/f0/aa3d0081a2004050564364a1ef3277ddf889c9989a7278c0a9cce8284926/uv-0.9.21-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f1d22f0ac03635d661e811c69d7c0b292751f90699acc6a1fb1509e17c936474", size = 22206448, upload-time = "2025-12-30T16:12:30.626Z" },
-    { url = "https://files.pythonhosted.org/packages/fc/a9/7a375e723a588f31f305ddf9ae2097af0b9dc7f7813641788b5b9764a237/uv-0.9.21-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:cdd805909d360ad67640201376c8eb02de08dcf1680a1a81aebd9519daed6023", size = 20940568, upload-time = "2025-12-30T16:12:27.533Z" },
-    { url = "https://files.pythonhosted.org/packages/18/d5/6187ffb7e1d24df34defe2718db8c4c3c08f153d3e7da22c250134b79cd1/uv-0.9.21-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:82e438595a609cbe4e45c413a54bd5756d37c8c39108ce7b2799aff15f7d3337", size = 22085077, upload-time = "2025-12-30T16:12:10.153Z" },
-    { url = "https://files.pythonhosted.org/packages/ee/fa/8e211167d0690d9f15a08da610a0383d2f43a6c838890878e14948472284/uv-0.9.21-py3-none-musllinux_1_1_armv7l.whl", hash = "sha256:fc1c06e1e5df423e1517e350ea2c9d85ecefd0919188a0a9f19bd239bbbdeeaf", size = 20862893, upload-time = "2025-12-30T16:12:49.87Z" },
-    { url = "https://files.pythonhosted.org/packages/33/b2/9d24d84cb9a1a6a5ea98d03a29abf800d87e5710d25e53896dc73aeb63a5/uv-0.9.21-py3-none-musllinux_1_1_i686.whl", hash = "sha256:9ef3d2a213c7720f4dae336e5123fe88427200d7523c78091c4ab7f849c3f13f", size = 21428397, upload-time = "2025-12-30T16:12:07.483Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/40/1e8e4c2e1308432c708eaa66dccdb83d2ee6120ea2b7d65e04fc06f48ff8/uv-0.9.21-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:8da20914d92ba4cc35f071414d3da7365294fc0b7114da8ac2ab3a86c695096f", size = 22450537, upload-time = "2025-12-30T16:12:33.36Z" },
-    { url = "https://files.pythonhosted.org/packages/18/b8/99c4731d001f512e844dfdc740db2bf2fea56d538749b639d21f5117a74a/uv-0.9.21-py3-none-win32.whl", hash = "sha256:e716e23bc0ec8cbb0811f99e653745e0cf15223e7ba5d8857d46be5b40b3045b", size = 20032654, upload-time = "2025-12-30T16:12:36.007Z" },
-    { url = "https://files.pythonhosted.org/packages/29/6b/da441bf335f5e1c0c100b7dfb9702b6fed367ba703e543037bf1e70bf8c3/uv-0.9.21-py3-none-win_amd64.whl", hash = "sha256:64a7bb0e4e6a4c2d98c2d55f42aead7c2df0ceb17d5911d1a42b76228cab4525", size = 22206744, upload-time = "2025-12-30T16:12:38.953Z" },
-    { url = "https://files.pythonhosted.org/packages/98/02/afbed8309fe07aaa9fa58a98941cebffbcd300fe70499a02a6806d93517b/uv-0.9.21-py3-none-win_arm64.whl", hash = "sha256:6c13c40966812f6bd6ecb6546e5d3e27e7fe9cefa07018f074f51d703cb29e1c", size = 20591604, upload-time = "2025-12-30T16:12:44.634Z" },
+version = "0.11.17"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/2c/8e/ec34c19d0f254fcbcc5c1ce8c7f06e47e0f69a7e1a0269c1d59cb0b0f279/uv-0.11.17.tar.gz", hash = "sha256:1d1be74deec997db1dda05a7e67541c904d65cbfd72e455d3c0a2a1e4bf2cddf", size = 4203607, upload-time = "2026-05-28T20:39:47.707Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/15/2e/e6d42f9d39009eee976f1e5dfd31d3d1943e6e593ad7b191cf11e9744a36/uv-0.11.17-py3-none-linux_armv6l.whl", hash = "sha256:8426bfe315564d414cbc5ba5467595dc6348965e19acec742914f47da3ff269f", size = 23551216, upload-time = "2026-05-28T20:39:05.395Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/ee/d72bcc60f3585653a4b768425854d737d98d65c1765547d25c2999547ea9/uv-0.11.17-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:6d1a033cc68cabb4141d6c1e3b66ffc6e970b98ba42e210f33270251e0bd8697", size = 22997377, upload-time = "2026-05-28T20:39:25.21Z" },
+    { url = "https://files.pythonhosted.org/packages/58/34/1bc69798d9ae998fbc42c61b02883f2ba00d04bdd858e589604d01846287/uv-0.11.17-py3-none-macosx_11_0_arm64.whl", hash = "sha256:58c07ffc272c847d29cd98ca5082fa4304a645f87c718ec900e3cca9026bd096", size = 21630197, upload-time = "2026-05-28T20:39:28.935Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/93/1be48ec6a8933d9a77d0ce5240ed63f68869f68517ccf5d62268ed03f3e8/uv-0.11.17-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.musllinux_1_1_aarch64.whl", hash = "sha256:036d6e2940afe8b79637530b01b9241d8cfd174b07f1179a1ebbd42409c38ca3", size = 23414940, upload-time = "2026-05-28T20:39:55.015Z" },
+    { url = "https://files.pythonhosted.org/packages/00/31/b7488ff49d80090ea9d05d67a4d381a1b4479502e9853e654caa1c1c678e/uv-0.11.17-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.musllinux_1_1_armv7l.whl", hash = "sha256:283186700c3e65a4644a73a917232da7d3e4a94d25ea0377a44f5b263fa49577", size = 23096330, upload-time = "2026-05-28T20:39:01.284Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/95/42b6137c5de06278d229c7eef2f314df2a738cd799795bbb44dace21bd6e/uv-0.11.17-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f2e44dfbfc7778d0d90edc6738f237c91e5e37e4e3cfe94c8a312cec56a41485", size = 23101906, upload-time = "2026-05-28T20:39:17.149Z" },
+    { url = "https://files.pythonhosted.org/packages/17/7c/0ca03b2d19965db6d5dfe0c8cf96a3d0b424503c8cbc3cd2ffdc5869a15d/uv-0.11.17-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1a817eeb3026f27a53d3f4b7855a5105f6787dd192140e201eda4d2b9a11b72e", size = 24444409, upload-time = "2026-05-28T20:39:59.218Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/fb/179f55a3b19d47c30ec1f41b9b964da74dfa7053ff310a70a9c4d8cb998d/uv-0.11.17-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:bf8f5ad959583dcd2c4ae445c754a97c05700246ff89259f3fd285c9c20f4c00", size = 25540153, upload-time = "2026-05-28T20:39:09.535Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/29/592f42012765c43ae45c112110e214bca7b0cfc08c4c1b52e1dfa47dedd5/uv-0.11.17-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:ce16892a45134d20165c1ceababe06f3e9ce6a58902db1eff812c8c93626823f", size = 24665906, upload-time = "2026-05-28T20:39:41.254Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/51/b75808766f895248553c6370968509cd4f726e6943e310a8f7a171036ad0/uv-0.11.17-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9da839e5a491c9a701d7d327a199cafc76ac27a03ac84fd2a8d4bf32c3af2448", size = 24863325, upload-time = "2026-05-28T20:39:51.006Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/6a/6f27ee69e97f480104bb8ec335f04c2a12add98edfcc4844a68e9538b6e2/uv-0.11.17-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:ec004b3c9bf9cb7756067ad1bd0bf64eb843e6fa2edbfbb3135ee152c14cea91", size = 23521674, upload-time = "2026-05-28T20:38:55.869Z" },
+    { url = "https://files.pythonhosted.org/packages/df/11/1344aca7c710f794750f74de0e552a54ab24193ecc01fa3b3ae22ff822a1/uv-0.11.17-py3-none-manylinux_2_31_riscv64.musllinux_1_1_riscv64.whl", hash = "sha256:659227cac719b618cc91e02be9e274ad5bd72d74fa278123e6373537e9f28216", size = 24224725, upload-time = "2026-05-28T20:39:32.945Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/44/7b11550c1453ea13b81e549c83523e6ab6ed3231d09b2fd6b9eb19acceaf/uv-0.11.17-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:e301d844eed9401f0f0351de12c55f1306ca05372acb0f28d35717c8ba663a22", size = 24301643, upload-time = "2026-05-28T20:39:45.183Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/36/8f683bc60547b8f93d0e752a8574d13fad776999cb978482b360c053ca22/uv-0.11.17-py3-none-musllinux_1_1_i686.whl", hash = "sha256:f0bf483c0d9fa14283992d56061b498b9d3d4adebd285af8744dc33f64dadfba", size = 23786049, upload-time = "2026-05-28T20:39:20.999Z" },
+    { url = "https://files.pythonhosted.org/packages/10/dc/7a495db39c2970de4fa375c337dbd617b16780911f88f0511f8fe7f6747c/uv-0.11.17-py3-none-musllinux_1_1_x86_64.whl", hash = "sha256:2ccd5487a4a192bc832ea04c867a26883757db8fdfe88bed85d8129c82f9e505", size = 25049786, upload-time = "2026-05-28T20:40:03.292Z" },
+    { url = "https://files.pythonhosted.org/packages/37/dd/74eff72d749eaf7e19f489878e21a368a7fef58d26ea0c63ec044ecd78b1/uv-0.11.17-py3-none-win32.whl", hash = "sha256:12b701fa32c5be3691759a73956e4462f30fa7b0dfa52ec66cb305bbb6ea4129", size = 22479213, upload-time = "2026-05-28T20:39:13.316Z" },
+    { url = "https://files.pythonhosted.org/packages/79/99/8af4a92b99a8a4823297c26df727fe957267e03e1196e3caa803c3f6ccb2/uv-0.11.17-py3-none-win_amd64.whl", hash = "sha256:44ec1fe3af839f87370dcf0400c0cab917cc1ce697d563e860fc7d9ed72655e7", size = 25083161, upload-time = "2026-05-28T20:40:07.931Z" },
+    { url = "https://files.pythonhosted.org/packages/00/76/a689077832d585d29d87f9cd0d65eca1af58abd29a4eab004d0a8a858b9c/uv-0.11.17-py3-none-win_arm64.whl", hash = "sha256:37c915bfcf86f99c1c5be7c9ed21e0d80624067ba47bc8916a3cb0530bc94d27", size = 23544936, upload-time = "2026-05-28T20:39:37.137Z" },
 ]
 
 [[package]]

From cdd3bf683793bb906400732776ae7a375139f0ce Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 29 May 2026 18:19:37 -0400
Subject: [PATCH 52/80] Configurable CLI exit behavior for API errors (#211)

* feat: add --exit-code-on-api-error flag + Buildkite-aware infra error logging

Adds a configurable exit code for API/infrastructure failures so CI pipelines
can distinguish them from blocking security findings (exit 1), without changing
any default behavior.

- New CliConfig field exit_code_on_api_error (default 3) + --exit-code-on-api-error
  flag. The CLI already exited 3 on unexpected errors; this just makes that code
  configurable (e.g. remap to a Buildkite soft_fail code, or 0 to swallow).
- New _emit_infrastructure_error helper + IS_BUILDKITE gate: emits Buildkite log
  section markers (^^^ +++ / --- :warning:) and a soft_fail hint when running in
  Buildkite; plain log.error elsewhere so markers don't leak as literal text.
- Wire the top-level generic-exception handler in cli() through the helper and
  the configurable code.

Deliberately NON-breaking for 2.3.x:
- --disable-blocking STILL forces exit 0 for all outcomes and takes precedence
  over --exit-code-on-api-error (documented in the flag help so the two aren't
  combined by mistake).
- Default exit codes are unchanged; the exit code only changes when the user
  explicitly passes the flag.

The breaking variant (infra errors bypassing --disable-blocking, distinct
RequestTimeoutExceeded handling, exit 1 -> 3 for diff API failures) is
intentionally deferred to a future 3.0 release.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* feat(config): auto-truncate commit messages over 200 chars

The --commit-message flag passes its value directly into the API request URL
as a query parameter with no length limit. AI-generated commit messages and
the common CI pattern of concatenating $BUILDKITE_BUILD_NUMBER + $BUILDKITE_MESSAGE
can easily exceed URL length limits, producing HTTP 413 errors.

The 413 originates from an infrastructure-layer URL length limit (nginx/Cloudflare),
not application-level validation -- confirmed via inspection of the Socket API route
handler, which has no constraint on commit_message (unlike committers, which enforces
<= 200 chars and returns a clean 400).

200 chars chosen as a conservative defensive ceiling given URL encoding can 2-3x
raw character count. No customer should ever want a 2000-character commit message
in their scan metadata.

A backend-side validation (returning 400 instead of 413) is filed as a follow-on
for the depscan API team.

Motivated by customer incidents (Plaid).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* pass timeout through SDK diff requests

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* fix: propagate --exclude-license-details to the full-scan diff request

The full-scan diff comparison ignored --exclude-license-details: the flag was
applied to full-scan params and report URLs but never forwarded to the
fullscans.stream_diff request, so diff comparisons always fetched license
details regardless of the flag.

Thread it through get_added_and_removed_packages -> stream_diff via a new
include_license_details param (defaulting True to preserve current behavior).

Non-breaking: the APIFailure handling at this call site is deliberately left
as-is (exit 1, --disable-blocking -> 0). Re-routing diff APIFailures through
the top-level exit-3 path is part of the 3.0 exit-code change, not this one.

Originally from the unreleased PR #195 branch; the timeout-propagation half
already landed in the preceding commit.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* test: cover --exit-code-on-api-error, truncation, and Buildkite formatting

tests/unit/test_cli_config.py
- exit_code_on_api_error default 3 / custom / zero
- commit-message truncation: passthrough under 200, truncate over 200,
  quote-strip-before-truncate

tests/unit/test_socketcli.py
- unexpected error exits 3 by default
- --exit-code-on-api-error 100 remaps the failure exit code
- --disable-blocking OVERRIDES --exit-code-on-api-error (-> 0): locks in the
  documented precedence so the soft_fail guidance can't silently regress
- KeyboardInterrupt still exits 2
- _emit_infrastructure_error: BK markers + soft_fail hint only when
  IS_BUILDKITE; traceback gated on include_traceback

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore(release): 2.3.0 -- configurable API-error exit code

Minor bump for the new --exit-code-on-api-error flag and the supporting
non-breaking improvements (commit-message truncation, Buildkite-aware infra
error logging, --timeout / --exclude-license-details fixes).

This release is intentionally NON-breaking: default exit codes are unchanged,
the exit code only shifts when --exit-code-on-api-error is explicitly passed,
and --disable-blocking keeps its existing precedence. The breaking exit-code
behavior change (infra errors exiting non-zero even under --disable-blocking)
is deferred to a future 3.0.

CHANGELOG + README document the flag AND its interaction with --disable-blocking
(which overrides it) to reduce user error in the Buildkite soft_fail setup.

Version refs synced across pyproject.toml, socketsecurity/__init__.py, and
uv.lock (per the version-incrementation CI check).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 CHANGELOG.md                    | 46 ++++++++++++++++
 README.md                       | 42 +++++++++++++++
 pyproject.toml                  |  2 +-
 socketsecurity/__init__.py      |  2 +-
 socketsecurity/config.py        | 30 +++++++++++
 socketsecurity/core/__init__.py | 15 ++++--
 socketsecurity/socketcli.py     | 66 ++++++++++++++++++++---
 tests/core/test_sdk_methods.py  |  1 +
 tests/unit/test_cli_config.py   | 39 ++++++++++++++
 tests/unit/test_socketcli.py    | 96 +++++++++++++++++++++++++++++++++
 uv.lock                         |  2 +-
 11 files changed, 326 insertions(+), 15 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e917ffa..abdfac7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,51 @@
 # Changelog
 
+## 2.3.0
+
+### New: `--exit-code-on-api-error`
+
+Adds a configurable exit code for API / infrastructure failures (timeouts,
+network errors, unexpected exceptions), so CI pipelines can distinguish them
+from blocking security findings (exit `1`):
+
+```
+socketcli --exit-code-on-api-error 100 ...
+```
+
+Default is `3` (the code the CLI already used for these errors), so **default
+behavior is unchanged** — the exit code only changes when you pass the flag.
+Set it to a Buildkite `soft_fail` code, or to `0` to swallow infra errors.
+
+**Interaction to be aware of:** `--disable-blocking` forces exit `0` for *all*
+outcomes and therefore overrides `--exit-code-on-api-error`. Use the new flag
+*without* `--disable-blocking` if you want a custom infra-error code to take
+effect. See the exit-code reference in the README.
+
+> A future `3.0` release is planned to make infrastructure errors exit non-zero
+> even under `--disable-blocking` (so outages stop being silently swallowed).
+> That is a breaking change and is intentionally **not** in this release.
+
+### New: commit message auto-truncation
+
+`--commit-message` values longer than 200 characters are now automatically
+truncated before being sent to the API, preventing HTTP 413 errors from
+oversized URL query parameters (common with AI-generated commit messages or
+`$BUILDKITE_MESSAGE`).
+
+### Improved: Buildkite log formatting
+
+When running inside a Buildkite job (`BUILDKITE=true`), infrastructure errors
+emit Buildkite log section markers (`^^^ +++` / `--- :warning:`) so the error
+section auto-expands in the BK UI, plus a `soft_fail` hint. No effect on other
+CI platforms.
+
+### Fixed
+
+- `--timeout` is now honored end-to-end: it was only applied to the local
+  `CliClient`, but the full-scan diff comparison uses the Socket SDK instance,
+  which was constructed without the CLI timeout and defaulted to 1200s.
+- `--exclude-license-details` now propagates to the full-scan diff comparison
+  request (it was only applied to full-scan params / report URLs before).
 ## 2.2.93
 
 - Bundled twelve Dependabot dependency updates: `urllib3`, `gitpython`, `python-dotenv`, `pytest`, `uv`, `cryptography`, `pygments`, `requests`, and `idna` (main app), plus `axios`, `requests`, and `flask` (e2e fixtures). `idna` 3.11 → 3.15 includes the fix for CVE-2026-45409.
diff --git a/README.md b/README.md
index 66f042c..a3eeb10 100644
--- a/README.md
+++ b/README.md
@@ -194,6 +194,48 @@ Minimal pattern:
     SOCKET_SECURITY_API_TOKEN: ${{ secrets.SOCKET_SECURITY_API_TOKEN }}
 ```
 
+## Exit codes
+
+| Code | Meaning |
+|------|---------|
+| `0`  | Clean scan — no blocking issues (or `--disable-blocking` set) |
+| `1`  | Blocking security finding(s) detected |
+| `2`  | Scan interrupted (SIGINT / Ctrl+C) |
+| `3`  | Infrastructure or API error (timeout, network failure, unexpected error) |
+
+`--exit-code-on-api-error <N>` remaps the infrastructure-error code (`3`) to any
+value — e.g. a Buildkite `soft_fail` code, or `0` to swallow infra errors. Exit
+`3` is a Socket convention, not an industry standard.
+
+### How these options interact
+
+The two flags that affect exit codes can cancel each other out, so the order of
+precedence matters:
+
+- **`--disable-blocking` wins over everything.** It forces exit `0` for *all*
+  outcomes — security findings *and* infrastructure errors. If you set it,
+  `--exit-code-on-api-error` has no effect (you'll always get `0`).
+- **`--exit-code-on-api-error` only applies when `--disable-blocking` is *not*
+  set.** It changes the infra-error code (and the generic-error code); it never
+  touches the security-finding code (`1`).
+
+So for the common "don't let Socket outages block my pipeline, but still fail on
+real findings" goal, use `--exit-code-on-api-error` **without** `--disable-blocking`:
+
+```yaml
+# Buildkite: soft-fail only on infrastructure errors, still block on findings
+steps:
+  - label: ":lock: Socket Security Scan"
+    command: "socketcli --exit-code-on-api-error 100 ..."   # NOT --disable-blocking
+    soft_fail:
+      - exit_status: 100
+```
+
+Combining `--disable-blocking` with `--exit-code-on-api-error 100` would make the
+scan exit `0` on *both* findings and outages — the `soft_fail: 100` rule would
+never match, and real findings would stop blocking. That's usually not what you
+want.
+
 ## Common gotchas
 
 See [`docs/troubleshooting.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/troubleshooting.md#common-gotchas).
diff --git a/pyproject.toml b/pyproject.toml
index 7a7577e..cf409eb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.2.93"
+version = "2.3.0"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index f5930c6..10f2993 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.2.93'
+__version__ = '2.3.0'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index c048af2..7a262de 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -101,6 +101,7 @@ class CliConfig:
     pending_head: bool = False
     enable_diff: bool = False
     timeout: Optional[int] = 1200
+    exit_code_on_api_error: int = 3
     exclude_license_details: bool = False
     include_module_folders: bool = False
     repo_is_public: bool = False
@@ -182,6 +183,19 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
         if commit_message and commit_message.startswith('"') and commit_message.endswith('"'):
             commit_message = commit_message[1:-1]
 
+        # Truncate to avoid 413s from oversized URL query parameters.
+        # The API has no application-layer length validation on commit_message;
+        # the 413 originates from an infrastructure-layer URL length limit
+        # (nginx/Cloudflare). 200 chars chosen as a conservative ceiling given
+        # URL encoding can 2-3x raw character count.
+        MAX_COMMIT_MESSAGE_LENGTH = 200
+        if commit_message and len(commit_message) > MAX_COMMIT_MESSAGE_LENGTH:
+            logging.debug(
+                f"commit_message truncated from {len(commit_message)} to "
+                f"{MAX_COMMIT_MESSAGE_LENGTH} characters to avoid API request size limits"
+            )
+            commit_message = commit_message[:MAX_COMMIT_MESSAGE_LENGTH]
+
         config_args = {
             'api_token': api_token,
             'repo': args.repo,
@@ -219,6 +233,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'integration_type': args.integration,
             'pending_head': args.pending_head,
             'timeout': args.timeout,
+            'exit_code_on_api_error': args.exit_code_on_api_error,
             'exclude_license_details': args.exclude_license_details,
             'include_module_folders': args.include_module_folders,
             'repo_is_public': args.repo_is_public,
@@ -802,6 +817,21 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Timeout in seconds for API requests",
         required=False
     )
+    advanced_group.add_argument(
+        "--exit-code-on-api-error",
+        dest="exit_code_on_api_error",
+        type=int,
+        default=3,
+        metavar="<int>",
+        help=(
+            "Exit code to use when the CLI fails on an API or infrastructure error "
+            "(timeout, network failure, unexpected exception). Default: 3. Useful for "
+            "distinguishing infrastructure failures from security findings (exit 1) in "
+            "CI -- e.g. set to a Buildkite soft_fail code. NOTE: --disable-blocking "
+            "forces exit 0 for ALL outcomes and therefore overrides this flag; do not "
+            "combine the two if you want the custom code to take effect."
+        )
+    )
     advanced_group.add_argument(
         "--allow-unverified",
         action="store_true",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 1f488b2..99c3455 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -941,7 +941,8 @@ def get_license_text_via_purl(self, packages: dict[str, Package], batch_size: in
     def get_added_and_removed_packages(
             self,
             head_full_scan_id: str,
-            new_full_scan_id: str
+            new_full_scan_id: str,
+            include_license_details: bool = True
     ) -> Tuple[Dict[str, Package], Dict[str, Package], Dict[str, Package]]:
         """
         Get packages that were added and removed between scans.
@@ -958,12 +959,12 @@ def get_added_and_removed_packages(
         diff_start = time.time()
         try:
             diff_report = (
-                self.sdk.fullscans.stream_diff
-                           (
+                self.sdk.fullscans.stream_diff(
                     self.config.org_slug,
                     head_full_scan_id,
                     new_full_scan_id,
-                    use_types=True
+                    use_types=True,
+                    include_license_details=str(include_license_details).lower()
                 ).data
             )
         except APIFailure as e:
@@ -1175,7 +1176,11 @@ def create_new_diff(
             added_packages,
             removed_packages,
             packages
-        ) = self.get_added_and_removed_packages(head_full_scan_id, new_full_scan.id)
+        ) = self.get_added_and_removed_packages(
+            head_full_scan_id,
+            new_full_scan.id,
+            include_license_details=getattr(params, "include_license_details", True)
+        )
 
         # Separate unchanged packages from added/removed for --strict-blocking support
         unchanged_packages = {
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 26823cc..1849239 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -27,6 +27,37 @@
 
 load_dotenv()
 
+# Buildkite sets BUILDKITE=true in every job environment. Used to gate log
+# section markers that would render as literal text on other CI platforms.
+IS_BUILDKITE = os.getenv("BUILDKITE") == "true"
+
+
+def _emit_infrastructure_error(message: str, include_traceback: bool = False) -> None:
+    """Emit a structured error for infrastructure/API failures.
+
+    When running in Buildkite, wraps the error in log-section markers
+    (`^^^ +++` expands the section in the BK UI) and prints a soft_fail hint.
+    On every other platform it's a plain log.error so the markers don't leak
+    as literal text. This is presentation only -- it does not decide the exit
+    code (the caller does that, honoring --disable-blocking and
+    --exit-code-on-api-error).
+    """
+    if IS_BUILDKITE:
+        print("^^^ +++", flush=True)
+        print("--- :warning: Socket infrastructure error", flush=True)
+
+    log.error(message)
+
+    if IS_BUILDKITE:
+        log.error(
+            "Tip: this is an infrastructure error, not a security finding. To keep it "
+            "from blocking the build, add a soft_fail rule for the CLI's API-error exit "
+            "code (default 3, or whatever you pass to --exit-code-on-api-error)."
+        )
+
+    if include_traceback:
+        traceback.print_exc()
+
 
 def build_license_artifact_payload(
     diff: Diff,
@@ -62,6 +93,23 @@ def _write_attribution_file(config, payload: dict) -> None:
     Core.save_file(config.license_file_name, json.dumps(payload, indent=2))
 
 
+DEFAULT_API_TIMEOUT = 1200
+
+
+def get_api_request_timeout(config: CliConfig) -> int:
+    return config.timeout if config.timeout is not None else DEFAULT_API_TIMEOUT
+
+
+def build_socket_sdk(config: CliConfig) -> socketdev:
+    cli_user_agent_string = f"SocketPythonCLI/{config.version}"
+    return socketdev(
+        token=config.api_token,
+        timeout=get_api_request_timeout(config),
+        allow_unverified=config.allow_unverified,
+        user_agent=cli_user_agent_string
+    )
+
+
 def cli():
     try:
         main_code()
@@ -73,12 +121,17 @@ def cli():
         else:
             sys.exit(0)
     except Exception as error:
-        log.error("Unexpected error when running the cli")
-        log.error(error)
-        traceback.print_exc()
         config = CliConfig.from_args()  # Get current config
+        _emit_infrastructure_error(
+            f"Unexpected error when running the CLI: {error}",
+            include_traceback=True,
+        )
+        # --disable-blocking forces a clean exit for ALL outcomes (it takes
+        # precedence over --exit-code-on-api-error); otherwise infra/API errors
+        # exit with the configurable code (default 3), keeping them distinct
+        # from blocking security findings (exit 1).
         if not config.disable_blocking:
-            sys.exit(3)
+            sys.exit(config.exit_code_on_api_error)
         else:
             sys.exit(0)
 
@@ -99,8 +152,7 @@ def main_code():
                  "1. Command line: --api-token YOUR_TOKEN\n"
                  "2. Environment variable: SOCKET_SECURITY_API_TOKEN")
         sys.exit(3)
-    cli_user_agent_string = f"SocketPythonCLI/{config.version}"
-    sdk = socketdev(token=config.api_token, allow_unverified=config.allow_unverified, user_agent=cli_user_agent_string)
+    sdk = build_socket_sdk(config)
     
     # Suppress urllib3 InsecureRequestWarning when using --allow-unverified
     if config.allow_unverified:
@@ -119,7 +171,7 @@ def main_code():
     socket_config = SocketConfig(
         api_key=config.api_token,
         allow_unverified_ssl=config.allow_unverified,
-        timeout=config.timeout if config.timeout is not None else 1200  # Use CLI timeout if provided
+        timeout=get_api_request_timeout(config)
     )
     log.debug("loaded socket_config")
     client = CliClient(socket_config)
diff --git a/tests/core/test_sdk_methods.py b/tests/core/test_sdk_methods.py
index bb096eb..fdcbef3 100644
--- a/tests/core/test_sdk_methods.py
+++ b/tests/core/test_sdk_methods.py
@@ -101,6 +101,7 @@ def test_get_added_and_removed_packages(core):
         "head",
         "new",
         use_types=True,
+        include_license_details="true",
     )
     
     # Verify the results
diff --git a/tests/unit/test_cli_config.py b/tests/unit/test_cli_config.py
index 27801ec..39447c2 100644
--- a/tests/unit/test_cli_config.py
+++ b/tests/unit/test_cli_config.py
@@ -1,6 +1,45 @@
 import pytest
 from socketsecurity.config import CliConfig
 
+
+class TestExitCodeOnApiError:
+    def test_default_is_3(self):
+        config = CliConfig.from_args(["--api-token", "test"])
+        assert config.exit_code_on_api_error == 3
+
+    def test_custom_value(self):
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--exit-code-on-api-error", "100"]
+        )
+        assert config.exit_code_on_api_error == 100
+
+    def test_zero_value(self):
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--exit-code-on-api-error", "0"]
+        )
+        assert config.exit_code_on_api_error == 0
+
+
+class TestCommitMessageTruncation:
+    def test_passes_through_under_limit(self):
+        msg = "a normal short commit message"
+        config = CliConfig.from_args(["--api-token", "test", "--commit-message", msg])
+        assert config.commit_message == msg
+
+    def test_truncated_above_limit(self):
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--commit-message", "a" * 250]
+        )
+        assert config.commit_message == "a" * 200
+
+    def test_quote_strip_runs_before_truncation(self):
+        quoted = '"' + ("b" * 250) + '"'
+        config = CliConfig.from_args(
+            ["--api-token", "test", "--commit-message", quoted]
+        )
+        assert config.commit_message == "b" * 200
+
+
 class TestCliConfig:
     def test_api_token_from_env(self, monkeypatch):
         monkeypatch.setenv("SOCKET_SECURITY_API_KEY", "test-token")
diff --git a/tests/unit/test_socketcli.py b/tests/unit/test_socketcli.py
index e48788a..39f59f5 100644
--- a/tests/unit/test_socketcli.py
+++ b/tests/unit/test_socketcli.py
@@ -1,7 +1,103 @@
+import sys
+
+import pytest
+
 from socketsecurity.core.classes import Diff, Package
+from socketsecurity import socketcli
 from socketsecurity.socketcli import build_license_artifact_payload
 
 
+# ---------------------------------------------------------------------------
+# Exit-code-on-api-error (flag-only, non-breaking for 2.3.x).
+#
+# Default behavior is unchanged from prior releases: unexpected errors exit 3,
+# and --disable-blocking forces exit 0 for everything. The flag only changes
+# the code when explicitly set, and --disable-blocking still takes precedence.
+# ---------------------------------------------------------------------------
+
+
+def _run_cli_expecting_exit(monkeypatch, argv, boom=None):
+    def fail_main_code():
+        raise (boom or RuntimeError("infra boom"))
+
+    monkeypatch.setattr(socketcli, "main_code", fail_main_code)
+    monkeypatch.setattr(sys, "argv", argv)
+    with pytest.raises(SystemExit) as exc_info:
+        socketcli.cli()
+    return exc_info.value.code
+
+
+def test_unexpected_error_exits_3_by_default(monkeypatch):
+    code = _run_cli_expecting_exit(monkeypatch, ["socketcli", "--api-token", "test"])
+    assert code == 3
+
+
+def test_exit_code_on_api_error_remaps_failure(monkeypatch):
+    code = _run_cli_expecting_exit(
+        monkeypatch,
+        ["socketcli", "--api-token", "test", "--exit-code-on-api-error", "100"],
+    )
+    assert code == 100
+
+
+def test_disable_blocking_overrides_exit_code_on_api_error(monkeypatch):
+    # The documented interaction: --disable-blocking forces exit 0 for ALL
+    # outcomes and therefore overrides --exit-code-on-api-error. A user who
+    # sets both gets 0, NOT 100 -- this guards against silently regressing
+    # that precedence (which would break the documented soft_fail guidance).
+    code = _run_cli_expecting_exit(
+        monkeypatch,
+        [
+            "socketcli", "--api-token", "test",
+            "--exit-code-on-api-error", "100",
+            "--disable-blocking",
+        ],
+    )
+    assert code == 0
+
+
+def test_keyboard_interrupt_still_exits_2(monkeypatch):
+    code = _run_cli_expecting_exit(
+        monkeypatch, ["socketcli", "--api-token", "test"], boom=KeyboardInterrupt()
+    )
+    assert code == 2
+
+
+# ---------------------------------------------------------------------------
+# Buildkite-aware infrastructure error formatting.
+# ---------------------------------------------------------------------------
+
+
+def test_emit_infra_error_no_buildkite_has_no_markers(monkeypatch, capsys, caplog):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", False)
+    with caplog.at_level("ERROR", logger="socketcli"):
+        socketcli._emit_infrastructure_error("something failed")
+    out = capsys.readouterr().out
+    assert "^^^ +++" not in out
+    assert "--- :warning:" not in out
+    assert "soft_fail" not in "\n".join(r.getMessage() for r in caplog.records)
+
+
+def test_emit_infra_error_buildkite_emits_markers(monkeypatch, capsys, caplog):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", True)
+    with caplog.at_level("ERROR", logger="socketcli"):
+        socketcli._emit_infrastructure_error("something failed")
+    out = capsys.readouterr().out
+    assert "^^^ +++" in out
+    assert "--- :warning: Socket infrastructure error" in out
+    assert "soft_fail" in "\n".join(r.getMessage() for r in caplog.records)
+
+
+def test_emit_infra_error_traceback_gated(monkeypatch, capsys):
+    monkeypatch.setattr(socketcli, "IS_BUILDKITE", False)
+    try:
+        raise ValueError("boom")
+    except ValueError:
+        socketcli._emit_infrastructure_error("wrapped", include_traceback=True)
+    err = capsys.readouterr().err
+    assert "Traceback" in err and "ValueError: boom" in err
+
+
 def test_build_license_artifact_payload_without_packages_returns_empty_dict():
     diff = Diff()
 
diff --git a/uv.lock b/uv.lock
index facecef..9df9b09 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1168,7 +1168,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.2.93"
+version = "2.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "bs4" },

From 152ea215a9fb29ba402e5e54bd9705d900e4f313 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Tue, 2 Jun 2026 14:17:26 +0200
Subject: [PATCH 53/80] feat(core): brotli-compress .socket.facts.json on
 full-scan upload (#219)

Compress the reachability facts file to a `.socket.facts.json.br` multipart
part before uploading it as part of a full scan. The Socket API transparently
decompresses parts named exactly `.socket.facts.json.br` and stores plain JSON,
so the stored result is unchanged while the on-the-wire payload shrinks by
roughly 10-40x for typical facts files.

This keeps large tier-1 reachability facts files under the API's per-file
upload size cap. Previously an oversized facts file made the full-scan upload
fail (surfaced as an HTTP 4xx/502 with the scan stuck and no report produced).

- Compress at the upload boundary (Core.create_full_scan); the on-disk file is
  left untouched so local consumers still read plain .socket.facts.json.
- Only files whose basename is exactly .socket.facts.json are compressed (the
  API matches that exact name); a custom --reach-output-file name and empty
  placeholder files are left as plain uploads.
- Stream in 1 MiB chunks so large files aren't held fully in memory.
- Never blocks an upload: any compression failure falls back to the plain file,
  and a partially-written .socket.facts.json.br is removed rather than left
  behind in the target directory.
- Add brotli (CPython) / brotlicffi (PyPy) dependency.
---
 CHANGELOG.md                         |  27 ++++++
 pyproject.toml                       |   4 +-
 socketsecurity/__init__.py           |   2 +-
 socketsecurity/core/__init__.py      | 130 ++++++++++++++++++++++++-
 tests/core/test_facts_compression.py | 137 +++++++++++++++++++++++++++
 uv.lock                              | 110 ++++++++++++++++++++-
 6 files changed, 405 insertions(+), 5 deletions(-)
 create mode 100644 tests/core/test_facts_compression.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index abdfac7..3f78b70 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog
 
+## 2.3.1
+
+### New: brotli-compressed `.socket.facts.json` upload
+
+The reachability facts file (`.socket.facts.json`) is now brotli-compressed before it is
+uploaded as part of a full scan. The Socket API transparently decompresses any multipart
+part named exactly `.socket.facts.json.br` and stores it as plain `.socket.facts.json`, so
+the stored result is unchanged — but the on-the-wire payload shrinks dramatically (a
+~262 MB facts file compresses to roughly 15–30 MB).
+
+This fixes large tier‑1 reachability scans that previously failed when the uncompressed
+facts file exceeded the API's per‑file upload size cap (surfaced to the CLI as an HTTP
+4xx/“502”, leaving the scan stuck with no report).
+
+Details:
+
+- Compression happens at the upload boundary (`Core.create_full_scan`); the file on disk is
+  left untouched, so local consumers (SARIF/JSON output, tier‑1 finalize, alert selection)
+  continue to read the plain `.socket.facts.json`.
+- Only a file whose basename is exactly `.socket.facts.json` is compressed (the API matches
+  that exact name). A custom `--reach-output-file` name is uploaded uncompressed, as before.
+- Empty baseline-scan placeholder files are not compressed.
+- Compression never blocks an upload: if it fails for any reason it falls back to uploading
+  the plain file, and a partially-written `.socket.facts.json.br` is removed rather than
+  left behind in the target directory.
+- Adds a `brotli` (CPython) / `brotlicffi` (PyPy) dependency.
+
 ## 2.3.0
 
 ### New: `--exit-code-on-api-error`
diff --git a/pyproject.toml b/pyproject.toml
index cf409eb..982da93 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.3.0"
+version = "2.3.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -19,6 +19,8 @@ dependencies = [
     "socketdev>=3.0.33,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
+    "brotli>=1.0.9; platform_python_implementation == 'CPython'",
+    "brotlicffi>=1.0.9; platform_python_implementation != 'CPython'",
 ]
 readme = "README.md"
 description = "Socket Security CLI for CI/CD"
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 10f2993..b459b8c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.3.0'
+__version__ = '2.3.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 99c3455..c2bb862 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -51,6 +51,26 @@
 
 _HUMANIZE_BOUNDARY = re.compile(r"(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])")
 
+# Reachability facts-file upload compression.
+#
+# The Socket full-scan endpoint transparently brotli-decompresses any multipart part
+# whose basename is exactly ``.socket.facts.json.br`` and stores it as plain
+# ``.socket.facts.json``. Compressing the facts file on upload keeps it well under the
+# server's per-file size cap (a ~262 MB facts file compresses to roughly 15-30 MB),
+# which is required for large reachability (tier 1) scans to succeed.
+#
+# The server matches the *exact* name ``.socket.facts.json.br``, so we only compress
+# files whose basename is exactly ``.socket.facts.json`` (a custom ``--reach-output-file``
+# name would not be decompressed server-side, so it is left as a plain upload).
+SOCKET_FACTS_FILENAME = ".socket.facts.json"
+SOCKET_FACTS_BROTLI_FILENAME = ".socket.facts.json.br"
+# Brotli quality (0-11); 5 is a good speed/ratio tradeoff for large JSON payloads.
+SOCKET_FACTS_BROTLI_QUALITY = 5
+# Largest brotli window (2**24 bytes); improves the ratio on large facts files.
+SOCKET_FACTS_BROTLI_LGWIN = 24
+# Stream the facts file in 1 MiB chunks so large files aren't held fully in memory.
+SOCKET_FACTS_BROTLI_CHUNK_SIZE = 1024 * 1024
+
 
 def _humanize_alert_type(alert_type: str) -> str:
     """Convert a camelCase/PascalCase alert type into a Title-Cased label.
@@ -544,6 +564,102 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
             log.debug(f"Unable to finalize tier 1 scan: {e}")
             return False
 
+    @staticmethod
+    def _compress_facts_file(source_path: str) -> str:
+        """Brotli-compress a ``.socket.facts.json`` file to a sibling ``.socket.facts.json.br``.
+
+        The source is streamed in chunks so a large facts file (hundreds of MB) never has
+        to be held in memory at once. The compressed file is written next to the source so
+        that the multipart key the SDK derives keeps the same directory prefix, only with a
+        ``.br`` basename. Any existing ``.socket.facts.json.br`` sibling is overwritten, and a
+        partially-written output is removed if compression fails part-way through (e.g. the
+        disk fills up mid-stream) so no orphaned ``.br`` is left in the target directory.
+
+        Args:
+            source_path: Path to the plain ``.socket.facts.json`` file.
+
+        Returns:
+            Path to the compressed sibling file.
+        """
+        # Imported lazily so the dependency is only needed when actually uploading a facts
+        # file. brotlicffi is the API-compatible fallback used on PyPy / non-CPython runtimes.
+        try:
+            import brotli
+        except ImportError:
+            import brotlicffi as brotli
+
+        target_path = os.path.join(os.path.dirname(source_path), SOCKET_FACTS_BROTLI_FILENAME)
+        compressor = brotli.Compressor(
+            quality=SOCKET_FACTS_BROTLI_QUALITY,
+            lgwin=SOCKET_FACTS_BROTLI_LGWIN,
+        )
+        try:
+            with open(source_path, "rb") as src, open(target_path, "wb") as dst:
+                while True:
+                    chunk = src.read(SOCKET_FACTS_BROTLI_CHUNK_SIZE)
+                    if not chunk:
+                        break
+                    compressed = compressor.process(chunk)
+                    if compressed:
+                        dst.write(compressed)
+                dst.write(compressor.finish())
+        except BaseException:
+            # Don't leave a half-written .br behind for the caller to miss (it only tracks
+            # the path for cleanup once this returns). Remove it, then re-raise so the caller
+            # falls back to uploading the plain file.
+            try:
+                os.unlink(target_path)
+            except OSError:
+                pass
+            raise
+        return target_path
+
+    def _compress_facts_files_for_upload(self, files: List[str]) -> Tuple[List[str], List[str]]:
+        """Replace any ``.socket.facts.json`` upload entry with a brotli-compressed ``.br`` sibling.
+
+        The Socket full-scan endpoint transparently decompresses a multipart part named
+        exactly ``.socket.facts.json.br``, so compressing here keeps a large facts file under
+        the server's per-file size cap without changing the stored result. Files whose
+        basename is not exactly ``.socket.facts.json`` are left untouched (the server only
+        matches that exact name), as are empty placeholder files (e.g. baseline scans).
+
+        Compression never blocks an upload: if it fails for any reason (missing optional
+        ``brotli`` dependency, unwritable directory, etc.) the original plain file is used.
+
+        Args:
+            files: The list of file paths about to be uploaded.
+
+        Returns:
+            ``(upload_files, temp_paths)`` where ``upload_files`` is the possibly-rewritten
+            list to upload and ``temp_paths`` are compressed files the caller must delete
+            once the upload completes.
+        """
+        upload_files: List[str] = []
+        temp_paths: List[str] = []
+        for file_path in files:
+            try:
+                if (
+                    os.path.basename(file_path) == SOCKET_FACTS_FILENAME
+                    and os.path.isfile(file_path)
+                    and os.path.getsize(file_path) > 0
+                ):
+                    compressed_path = self._compress_facts_file(file_path)
+                    log.debug(
+                        f"Brotli-compressed {file_path} for upload: "
+                        f"{os.path.getsize(file_path)} -> {os.path.getsize(compressed_path)} bytes "
+                        f"(uploading as {SOCKET_FACTS_BROTLI_FILENAME})"
+                    )
+                    upload_files.append(compressed_path)
+                    temp_paths.append(compressed_path)
+                    continue
+            except Exception as e:
+                # Never let compression break an upload: fall back to the plain file.
+                log.warning(
+                    f"Failed to brotli-compress facts file {file_path}, uploading uncompressed: {e}"
+                )
+            upload_files.append(file_path)
+        return upload_files, temp_paths
+
     def create_full_scan(self, files: List[str], params: FullScanParams, base_paths: Optional[List[str]] = None) -> FullScan:
         """
         Creates a new full scan via the Socket API.
@@ -559,7 +675,19 @@ def create_full_scan(self, files: List[str], params: FullScanParams, base_paths:
         log.info("Creating new full scan")
         create_full_start = time.time()
 
-        res = self.sdk.fullscans.post(files, params, use_types=True, use_lazy_loading=True, max_open_files=50, base_paths=base_paths)
+        # Brotli-compress the reachability facts file (if present) so it is uploaded as a
+        # `.socket.facts.json.br` part. The API decompresses it server-side, keeping a large
+        # facts file under the per-file upload size cap. See _compress_facts_files_for_upload.
+        upload_files, compressed_temp_files = self._compress_facts_files_for_upload(files)
+        try:
+            res = self.sdk.fullscans.post(upload_files, params, use_types=True, use_lazy_loading=True, max_open_files=50, base_paths=base_paths)
+        finally:
+            for temp_file in compressed_temp_files:
+                try:
+                    os.unlink(temp_file)
+                    log.debug(f"Cleaned up temporary compressed facts file: {temp_file}")
+                except OSError as cleanup_error:
+                    log.debug(f"Failed to clean up temporary compressed facts file {temp_file}: {cleanup_error}")
         if not res.success:
             log.error(f"Error creating full scan: {res.message}, status: {res.status}")
             raise Exception(f"Error creating full scan: {res.message}, status: {res.status}")
diff --git a/tests/core/test_facts_compression.py b/tests/core/test_facts_compression.py
new file mode 100644
index 0000000..ba04efa
--- /dev/null
+++ b/tests/core/test_facts_compression.py
@@ -0,0 +1,137 @@
+"""Tests for brotli compression of the reachability facts file on upload.
+
+The Socket full-scan endpoint transparently decompresses a multipart part named exactly
+`.socket.facts.json.br`, so the CLI compresses the facts file before uploading it. These
+tests cover the helpers in `Core` that do that rewriting.
+"""
+import json
+import os
+
+import pytest
+
+try:
+    import brotli
+except ImportError:  # pragma: no cover - PyPy / non-CPython fallback
+    import brotlicffi as brotli
+
+from socketsecurity.core import (
+    SOCKET_FACTS_BROTLI_FILENAME,
+    SOCKET_FACTS_FILENAME,
+    Core,
+)
+
+
+def _write(path, data: bytes):
+    with open(path, "wb") as f:
+        f.write(data)
+    return path
+
+
+def test_compress_facts_file_roundtrips(tmp_path):
+    """The compressed sibling decompresses back to the exact original bytes."""
+    source = tmp_path / SOCKET_FACTS_FILENAME
+    payload = json.dumps({"components": [{"id": str(i)} for i in range(1000)]}).encode()
+    _write(str(source), payload)
+
+    compressed_path = Core._compress_facts_file(str(source))
+
+    # Compressed file is a sibling named exactly `.socket.facts.json.br`.
+    assert compressed_path == str(tmp_path / SOCKET_FACTS_BROTLI_FILENAME)
+    assert os.path.basename(compressed_path) == SOCKET_FACTS_BROTLI_FILENAME
+    # The original is untouched (other code paths still read it locally).
+    assert source.read_bytes() == payload
+    # Roundtrip matches.
+    with open(compressed_path, "rb") as f:
+        assert brotli.decompress(f.read()) == payload
+
+
+def test_compress_for_upload_rewrites_facts_entry(tmp_path):
+    """A `.socket.facts.json` entry is replaced by its `.br` sibling; others pass through."""
+    core = Core.__new__(Core)
+    facts = _write(str(tmp_path / SOCKET_FACTS_FILENAME), b'{"a": 1}')
+    manifest = _write(str(tmp_path / "package.json"), b"{}")
+
+    upload_files, temp_paths = core._compress_facts_files_for_upload([facts, manifest])
+
+    expected_br = str(tmp_path / SOCKET_FACTS_BROTLI_FILENAME)
+    assert upload_files == [expected_br, manifest]
+    assert temp_paths == [expected_br]
+    assert os.path.isfile(expected_br)
+    # Non-facts files are never compressed.
+    assert manifest in upload_files
+
+
+def test_compress_facts_file_removes_partial_output_on_failure(tmp_path, monkeypatch):
+    """If compression fails mid-stream, the half-written .br is removed (not orphaned)."""
+    source = _write(str(tmp_path / SOCKET_FACTS_FILENAME), b'{"a": 1}' * 1000)
+
+    class ExplodingCompressor:
+        def __init__(self, *args, **kwargs):
+            pass
+
+        def process(self, _data):
+            raise RuntimeError("disk full")
+
+        def finish(self):  # pragma: no cover - never reached
+            return b""
+
+    # Patch the module the helper imports (brotli on CPython, brotlicffi elsewhere).
+    monkeypatch.setattr(brotli, "Compressor", ExplodingCompressor)
+
+    with pytest.raises(RuntimeError, match="disk full"):
+        Core._compress_facts_file(source)
+
+    # No orphaned .br left behind in the target directory.
+    assert not (tmp_path / SOCKET_FACTS_BROTLI_FILENAME).exists()
+
+
+def test_compress_for_upload_preserves_directory_prefix(tmp_path):
+    """The `.br` sibling keeps the facts file's directory so the relative key is preserved."""
+    core = Core.__new__(Core)
+    subdir = tmp_path / "nested"
+    subdir.mkdir()
+    facts = _write(str(subdir / SOCKET_FACTS_FILENAME), b'{"a": 1}')
+
+    upload_files, temp_paths = core._compress_facts_files_for_upload([facts])
+
+    assert upload_files == [str(subdir / SOCKET_FACTS_BROTLI_FILENAME)]
+    assert temp_paths == [str(subdir / SOCKET_FACTS_BROTLI_FILENAME)]
+
+
+def test_empty_facts_file_is_not_compressed(tmp_path):
+    """Empty placeholder facts files (e.g. baseline scans) are uploaded as-is."""
+    core = Core.__new__(Core)
+    empty_facts = _write(str(tmp_path / SOCKET_FACTS_FILENAME), b"")
+
+    upload_files, temp_paths = core._compress_facts_files_for_upload([empty_facts])
+
+    assert upload_files == [empty_facts]
+    assert temp_paths == []
+    assert not (tmp_path / SOCKET_FACTS_BROTLI_FILENAME).exists()
+
+
+def test_custom_named_facts_file_is_not_compressed(tmp_path):
+    """A custom --reach-output-file name is not compressed (server only matches the exact name)."""
+    core = Core.__new__(Core)
+    custom = _write(str(tmp_path / "custom.facts.json"), b'{"a": 1}')
+
+    upload_files, temp_paths = core._compress_facts_files_for_upload([custom])
+
+    assert upload_files == [custom]
+    assert temp_paths == []
+
+
+def test_compression_failure_falls_back_to_plain_file(tmp_path, monkeypatch):
+    """If compression raises, the original plain file is uploaded instead of failing."""
+    core = Core.__new__(Core)
+    facts = _write(str(tmp_path / SOCKET_FACTS_FILENAME), b'{"a": 1}')
+
+    def boom(_source_path):
+        raise RuntimeError("brotli unavailable")
+
+    monkeypatch.setattr(Core, "_compress_facts_file", staticmethod(boom))
+
+    upload_files, temp_paths = core._compress_facts_files_for_upload([facts])
+
+    assert upload_files == [facts]
+    assert temp_paths == []
diff --git a/uv.lock b/uv.lock
index 9df9b09..0ffdcce 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,6 +1,10 @@
 version = 1
 revision = 3
 requires-python = ">=3.11"
+resolution-markers = [
+    "python_full_version >= '3.13'",
+    "python_full_version < '3.13'",
+]
 
 [[package]]
 name = "anyio"
@@ -119,6 +123,79 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1a/39/47f9197bdd44df24d67ac8893641e16f386c984a0619ef2ee4c51fbbc019/beautifulsoup4-4.14.3-py3-none-any.whl", hash = "sha256:0918bfe44902e6ad8d57732ba310582e98da931428d231a5ecb9e7c703a735bb", size = 107721, upload-time = "2025-11-30T15:08:24.087Z" },
 ]
 
+[[package]]
+name = "brotli"
+version = "1.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f7/16/c92ca344d646e71a43b8bb353f0a6490d7f6e06210f8554c8f874e454285/brotli-1.2.0.tar.gz", hash = "sha256:e310f77e41941c13340a95976fe66a8a95b01e783d430eeaf7a2f87e0a57dd0a", size = 7388632, upload-time = "2025-11-05T18:39:42.86Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7a/ef/f285668811a9e1ddb47a18cb0b437d5fc2760d537a2fe8a57875ad6f8448/brotli-1.2.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:15b33fe93cedc4caaff8a0bd1eb7e3dab1c61bb22a0bf5bdfdfd97cd7da79744", size = 863110, upload-time = "2025-11-05T18:38:12.978Z" },
+    { url = "https://files.pythonhosted.org/packages/50/62/a3b77593587010c789a9d6eaa527c79e0848b7b860402cc64bc0bc28a86c/brotli-1.2.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:898be2be399c221d2671d29eed26b6b2713a02c2119168ed914e7d00ceadb56f", size = 445438, upload-time = "2025-11-05T18:38:14.208Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/e1/7fadd47f40ce5549dc44493877db40292277db373da5053aff181656e16e/brotli-1.2.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:350c8348f0e76fff0a0fd6c26755d2653863279d086d3aa2c290a6a7251135dd", size = 1534420, upload-time = "2025-11-05T18:38:15.111Z" },
+    { url = "https://files.pythonhosted.org/packages/12/8b/1ed2f64054a5a008a4ccd2f271dbba7a5fb1a3067a99f5ceadedd4c1d5a7/brotli-1.2.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2e1ad3fda65ae0d93fec742a128d72e145c9c7a99ee2fcd667785d99eb25a7fe", size = 1632619, upload-time = "2025-11-05T18:38:16.094Z" },
+    { url = "https://files.pythonhosted.org/packages/89/5a/7071a621eb2d052d64efd5da2ef55ecdac7c3b0c6e4f9d519e9c66d987ef/brotli-1.2.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:40d918bce2b427a0c4ba189df7a006ac0c7277c180aee4617d99e9ccaaf59e6a", size = 1426014, upload-time = "2025-11-05T18:38:17.177Z" },
+    { url = "https://files.pythonhosted.org/packages/26/6d/0971a8ea435af5156acaaccec1a505f981c9c80227633851f2810abd252a/brotli-1.2.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:2a7f1d03727130fc875448b65b127a9ec5d06d19d0148e7554384229706f9d1b", size = 1489661, upload-time = "2025-11-05T18:38:18.41Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/75/c1baca8b4ec6c96a03ef8230fab2a785e35297632f402ebb1e78a1e39116/brotli-1.2.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:9c79f57faa25d97900bfb119480806d783fba83cd09ee0b33c17623935b05fa3", size = 1599150, upload-time = "2025-11-05T18:38:19.792Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/1a/23fcfee1c324fd48a63d7ebf4bac3a4115bdb1b00e600f80f727d850b1ae/brotli-1.2.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:844a8ceb8483fefafc412f85c14f2aae2fb69567bf2a0de53cdb88b73e7c43ae", size = 1493505, upload-time = "2025-11-05T18:38:20.913Z" },
+    { url = "https://files.pythonhosted.org/packages/36/e5/12904bbd36afeef53d45a84881a4810ae8810ad7e328a971ebbfd760a0b3/brotli-1.2.0-cp311-cp311-win32.whl", hash = "sha256:aa47441fa3026543513139cb8926a92a8e305ee9c71a6209ef7a97d91640ea03", size = 334451, upload-time = "2025-11-05T18:38:21.94Z" },
+    { url = "https://files.pythonhosted.org/packages/02/8b/ecb5761b989629a4758c394b9301607a5880de61ee2ee5fe104b87149ebc/brotli-1.2.0-cp311-cp311-win_amd64.whl", hash = "sha256:022426c9e99fd65d9475dce5c195526f04bb8be8907607e27e747893f6ee3e24", size = 369035, upload-time = "2025-11-05T18:38:22.941Z" },
+    { url = "https://files.pythonhosted.org/packages/11/ee/b0a11ab2315c69bb9b45a2aaed022499c9c24a205c3a49c3513b541a7967/brotli-1.2.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:35d382625778834a7f3061b15423919aa03e4f5da34ac8e02c074e4b75ab4f84", size = 861543, upload-time = "2025-11-05T18:38:24.183Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/2f/29c1459513cd35828e25531ebfcbf3e92a5e49f560b1777a9af7203eb46e/brotli-1.2.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7a61c06b334bd99bc5ae84f1eeb36bfe01400264b3c352f968c6e30a10f9d08b", size = 444288, upload-time = "2025-11-05T18:38:25.139Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/6f/feba03130d5fceadfa3a1bb102cb14650798c848b1df2a808356f939bb16/brotli-1.2.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:acec55bb7c90f1dfc476126f9711a8e81c9af7fb617409a9ee2953115343f08d", size = 1528071, upload-time = "2025-11-05T18:38:26.081Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/38/f3abb554eee089bd15471057ba85f47e53a44a462cfce265d9bf7088eb09/brotli-1.2.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:260d3692396e1895c5034f204f0db022c056f9e2ac841593a4cf9426e2a3faca", size = 1626913, upload-time = "2025-11-05T18:38:27.284Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a7/03aa61fbc3c5cbf99b44d158665f9b0dd3d8059be16c460208d9e385c837/brotli-1.2.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:072e7624b1fc4d601036ab3f4f27942ef772887e876beff0301d261210bca97f", size = 1419762, upload-time = "2025-11-05T18:38:28.295Z" },
+    { url = "https://files.pythonhosted.org/packages/21/1b/0374a89ee27d152a5069c356c96b93afd1b94eae83f1e004b57eb6ce2f10/brotli-1.2.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:adedc4a67e15327dfdd04884873c6d5a01d3e3b6f61406f99b1ed4865a2f6d28", size = 1484494, upload-time = "2025-11-05T18:38:29.29Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/57/69d4fe84a67aef4f524dcd075c6eee868d7850e85bf01d778a857d8dbe0a/brotli-1.2.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7a47ce5c2288702e09dc22a44d0ee6152f2c7eda97b3c8482d826a1f3cfc7da7", size = 1593302, upload-time = "2025-11-05T18:38:30.639Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/3b/39e13ce78a8e9a621c5df3aeb5fd181fcc8caba8c48a194cd629771f6828/brotli-1.2.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:af43b8711a8264bb4e7d6d9a6d004c3a2019c04c01127a868709ec29962b6036", size = 1487913, upload-time = "2025-11-05T18:38:31.618Z" },
+    { url = "https://files.pythonhosted.org/packages/62/28/4d00cb9bd76a6357a66fcd54b4b6d70288385584063f4b07884c1e7286ac/brotli-1.2.0-cp312-cp312-win32.whl", hash = "sha256:e99befa0b48f3cd293dafeacdd0d191804d105d279e0b387a32054c1180f3161", size = 334362, upload-time = "2025-11-05T18:38:32.939Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/4e/bc1dcac9498859d5e353c9b153627a3752868a9d5f05ce8dedd81a2354ab/brotli-1.2.0-cp312-cp312-win_amd64.whl", hash = "sha256:b35c13ce241abdd44cb8ca70683f20c0c079728a36a996297adb5334adfc1c44", size = 369115, upload-time = "2025-11-05T18:38:33.765Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/d4/4ad5432ac98c73096159d9ce7ffeb82d151c2ac84adcc6168e476bb54674/brotli-1.2.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:9e5825ba2c9998375530504578fd4d5d1059d09621a02065d1b6bfc41a8e05ab", size = 861523, upload-time = "2025-11-05T18:38:34.67Z" },
+    { url = "https://files.pythonhosted.org/packages/91/9f/9cc5bd03ee68a85dc4bc89114f7067c056a3c14b3d95f171918c088bf88d/brotli-1.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:0cf8c3b8ba93d496b2fae778039e2f5ecc7cff99df84df337ca31d8f2252896c", size = 444289, upload-time = "2025-11-05T18:38:35.6Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/b6/fe84227c56a865d16a6614e2c4722864b380cb14b13f3e6bef441e73a85a/brotli-1.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c8565e3cdc1808b1a34714b553b262c5de5fbda202285782173ec137fd13709f", size = 1528076, upload-time = "2025-11-05T18:38:36.639Z" },
+    { url = "https://files.pythonhosted.org/packages/55/de/de4ae0aaca06c790371cf6e7ee93a024f6b4bb0568727da8c3de112e726c/brotli-1.2.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:26e8d3ecb0ee458a9804f47f21b74845cc823fd1bb19f02272be70774f56e2a6", size = 1626880, upload-time = "2025-11-05T18:38:37.623Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/16/a1b22cbea436642e071adcaf8d4b350a2ad02f5e0ad0da879a1be16188a0/brotli-1.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:67a91c5187e1eec76a61625c77a6c8c785650f5b576ca732bd33ef58b0dff49c", size = 1419737, upload-time = "2025-11-05T18:38:38.729Z" },
+    { url = "https://files.pythonhosted.org/packages/46/63/c968a97cbb3bdbf7f974ef5a6ab467a2879b82afbc5ffb65b8acbb744f95/brotli-1.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4ecdb3b6dc36e6d6e14d3a1bdc6c1057c8cbf80db04031d566eb6080ce283a48", size = 1484440, upload-time = "2025-11-05T18:38:39.916Z" },
+    { url = "https://files.pythonhosted.org/packages/06/9d/102c67ea5c9fc171f423e8399e585dabea29b5bc79b05572891e70013cdd/brotli-1.2.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3e1b35d56856f3ed326b140d3c6d9db91740f22e14b06e840fe4bb1923439a18", size = 1593313, upload-time = "2025-11-05T18:38:41.24Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/4a/9526d14fa6b87bc827ba1755a8440e214ff90de03095cacd78a64abe2b7d/brotli-1.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:54a50a9dad16b32136b2241ddea9e4df159b41247b2ce6aac0b3276a66a8f1e5", size = 1487945, upload-time = "2025-11-05T18:38:42.277Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e8/3fe1ffed70cbef83c5236166acaed7bb9c766509b157854c80e2f766b38c/brotli-1.2.0-cp313-cp313-win32.whl", hash = "sha256:1b1d6a4efedd53671c793be6dd760fcf2107da3a52331ad9ea429edf0902f27a", size = 334368, upload-time = "2025-11-05T18:38:43.345Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/91/e739587be970a113b37b821eae8097aac5a48e5f0eca438c22e4c7dd8648/brotli-1.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:b63daa43d82f0cdabf98dee215b375b4058cce72871fd07934f179885aad16e8", size = 369116, upload-time = "2025-11-05T18:38:44.609Z" },
+    { url = "https://files.pythonhosted.org/packages/17/e1/298c2ddf786bb7347a1cd71d63a347a79e5712a7c0cba9e3c3458ebd976f/brotli-1.2.0-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:6c12dad5cd04530323e723787ff762bac749a7b256a5bece32b2243dd5c27b21", size = 863080, upload-time = "2025-11-05T18:38:45.503Z" },
+    { url = "https://files.pythonhosted.org/packages/84/0c/aac98e286ba66868b2b3b50338ffbd85a35c7122e9531a73a37a29763d38/brotli-1.2.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:3219bd9e69868e57183316ee19c84e03e8f8b5a1d1f2667e1aa8c2f91cb061ac", size = 445453, upload-time = "2025-11-05T18:38:46.433Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/f1/0ca1f3f99ae300372635ab3fe2f7a79fa335fee3d874fa7f9e68575e0e62/brotli-1.2.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:963a08f3bebd8b75ac57661045402da15991468a621f014be54e50f53a58d19e", size = 1528168, upload-time = "2025-11-05T18:38:47.371Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a6/2ebfc8f766d46df8d3e65b880a2e220732395e6d7dc312c1e1244b0f074a/brotli-1.2.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9322b9f8656782414b37e6af884146869d46ab85158201d82bab9abbcb971dc7", size = 1627098, upload-time = "2025-11-05T18:38:48.385Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/2f/0976d5b097ff8a22163b10617f76b2557f15f0f39d6a0fe1f02b1a53e92b/brotli-1.2.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cf9cba6f5b78a2071ec6fb1e7bd39acf35071d90a81231d67e92d637776a6a63", size = 1419861, upload-time = "2025-11-05T18:38:49.372Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/d76df7176a2ce7616ff94c1fb72d307c9a30d2189fe877f3dd99af00ea5a/brotli-1.2.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7547369c4392b47d30a3467fe8c3330b4f2e0f7730e45e3103d7d636678a808b", size = 1484594, upload-time = "2025-11-05T18:38:50.655Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/93/14cf0b1216f43df5609f5b272050b0abd219e0b54ea80b47cef9867b45e7/brotli-1.2.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:fc1530af5c3c275b8524f2e24841cbe2599d74462455e9bae5109e9ff42e9361", size = 1593455, upload-time = "2025-11-05T18:38:51.624Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/73/3183c9e41ca755713bdf2cc1d0810df742c09484e2e1ddd693bee53877c1/brotli-1.2.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:d2d085ded05278d1c7f65560aae97b3160aeb2ea2c0b3e26204856beccb60888", size = 1488164, upload-time = "2025-11-05T18:38:53.079Z" },
+    { url = "https://files.pythonhosted.org/packages/64/6a/0c78d8f3a582859236482fd9fa86a65a60328a00983006bcf6d83b7b2253/brotli-1.2.0-cp314-cp314-win32.whl", hash = "sha256:832c115a020e463c2f67664560449a7bea26b0c1fdd690352addad6d0a08714d", size = 339280, upload-time = "2025-11-05T18:38:54.02Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/10/56978295c14794b2c12007b07f3e41ba26acda9257457d7085b0bb3bb90c/brotli-1.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:e7c0af964e0b4e3412a0ebf341ea26ec767fa0b4cf81abb5e897c9338b5ad6a3", size = 375639, upload-time = "2025-11-05T18:38:55.67Z" },
+]
+
+[[package]]
+name = "brotlicffi"
+version = "1.2.0.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8a/b6/017dc5f852ed9b8735af77774509271acbf1de02d238377667145fcee01d/brotlicffi-1.2.0.1.tar.gz", hash = "sha256:c20d5c596278307ad06414a6d95a892377ea274a5c6b790c2548c009385d621c", size = 478156, upload-time = "2026-03-05T19:54:11.547Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ef/f9/dfa56316837fa798eac19358351e974de8e1e2ca9475af4cb90293cd6576/brotlicffi-1.2.0.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:2c85e65913cf2b79c57a3fdd05b98d9731d9255dc0cb696b09376cc091b9cddd", size = 433046, upload-time = "2026-03-05T19:53:46.209Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/f5/f8f492158c76b0d940388801f04f747028971ad5774287bded5f1e53f08d/brotlicffi-1.2.0.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:535f2d05d0273408abc13fc0eebb467afac17b0ad85090c8913690d40207dac5", size = 1541126, upload-time = "2026-03-05T19:53:48.248Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/e1/ff87af10ac419600c63e9287a0649c673673ae6b4f2bcf48e96cb2f89f60/brotlicffi-1.2.0.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ce17eb798ca59ecec67a9bb3fd7a4304e120d1cd02953ce522d959b9a84d58ac", size = 1541983, upload-time = "2026-03-05T19:53:50.317Z" },
+    { url = "https://files.pythonhosted.org/packages/47/c0/80ecd9bd45776109fab14040e478bf63e456967c9ddee2353d8330ed8de1/brotlicffi-1.2.0.1-cp314-cp314t-win32.whl", hash = "sha256:3c9544f83cb715d95d7eab3af4adbbef8b2093ad6382288a83b3a25feb1a57ec", size = 349047, upload-time = "2026-03-05T19:53:52.215Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/98/13e5b250236a281b6cd9e92a01ee1ae231029fa78faee932ef3766e1cb24/brotlicffi-1.2.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:625f8115d32ae9c0740d01ea51518437c3fbaa3e78d41cb18459f6f7ac326000", size = 385652, upload-time = "2026-03-05T19:53:53.892Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/9f/b98dcd4af47994cee97aebac866996a006a2e5fc1fd1e2b82a8ad95cf09c/brotlicffi-1.2.0.1-cp38-abi3-macosx_11_0_arm64.whl", hash = "sha256:91ba5f0ccc040f6ff8f7efaf839f797723d03ed46acb8ae9408f99ffd2572cf4", size = 432608, upload-time = "2026-03-05T19:53:56.736Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/7a/ac4ee56595a061e3718a6d1ea7e921f4df156894acffb28ed88a1fd52022/brotlicffi-1.2.0.1-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be9a670c6811af30a4bd42d7116dc5895d3b41beaa8ed8a89050447a0181f5ce", size = 1534257, upload-time = "2026-03-05T19:53:58.667Z" },
+    { url = "https://files.pythonhosted.org/packages/99/39/e7410db7f6f56de57744ea52a115084ceb2735f4d44973f349bb92136586/brotlicffi-1.2.0.1-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6f3314a3476f59e5443f9f72a6dff16edc0c3463c9b318feaef04ae3e4683f5a", size = 1536838, upload-time = "2026-03-05T19:54:00.705Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/75/6e7977d1935fc3fbb201cbd619be8f2c7aea25d40a096967132854b34708/brotlicffi-1.2.0.1-cp38-abi3-win32.whl", hash = "sha256:82ea52e2b5d3145b6c406ebd3efb0d55db718b7ad996bd70c62cec0439de1187", size = 343337, upload-time = "2026-03-05T19:54:02.446Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/ef/e7e485ce5e4ba3843a0a92feb767c7b6098fd6e65ce752918074d175ae71/brotlicffi-1.2.0.1-cp38-abi3-win_amd64.whl", hash = "sha256:da2e82a08e7778b8bc539d27ca03cdd684113e81394bfaaad8d0dfc6a17ddede", size = 379026, upload-time = "2026-03-05T19:54:04.322Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/53/6262c2256513e6f530d81642477cb19367270922063eaa2d7b781d8c723d/brotlicffi-1.2.0.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:e015af99584c6db1490a69a210c765953e473e63adc2d891ac3062a737c9e851", size = 402265, upload-time = "2026-03-05T19:54:05.858Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/d9/d5340b43cf5fbe7fe5a083d237e5338cc1caa73bea523be1c5e452c26290/brotlicffi-1.2.0.1-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:37cb587d32bf7168e2218c455e22e409ad1f3157c6c71945879a311f3e6b6abf", size = 406710, upload-time = "2026-03-05T19:54:07.272Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/82/dbced4c1e0792efdf23fd90ff6d2a320c64ff4dfef7aacc85c04fde9ddd2/brotlicffi-1.2.0.1-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d6ba65dd528892b4d9960beba2ae011a753620bcfc66cf6fa3cee18d7b0baa4", size = 402787, upload-time = "2026-03-05T19:54:08.73Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/6f/534205ba7590c9a8716a614f270c5c2ec419b5b7079b3f9cd31b7b5580de/brotlicffi-1.2.0.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:f2a5575653b0672638ba039b82fda56854934d7a6a24d4b8b5033f73ab43cbc1", size = 375108, upload-time = "2026-03-05T19:54:10.079Z" },
+]
+
 [[package]]
 name = "bs4"
 version = "0.0.2"
@@ -149,6 +226,8 @@ dependencies = [
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
 wheels = [
+    { url = "https://files.pythonhosted.org/packages/12/4a/3dfd5f7850cbf0d06dc84ba9aa00db766b52ca38d8b86e3a38314d52498c/cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe", size = 184344, upload-time = "2025-09-08T23:22:26.456Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/8b/f0e4c441227ba756aafbe78f117485b25bb26b1c059d01f137fa6d14896b/cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c", size = 180560, upload-time = "2025-09-08T23:22:28.197Z" },
     { url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
     { url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
     { url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
@@ -157,6 +236,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/44/64/58f6255b62b101093d5df22dcb752596066c7e89dd725e0afaed242a61be/cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9", size = 218971, upload-time = "2025-09-08T23:22:36.805Z" },
     { url = "https://files.pythonhosted.org/packages/ab/49/fa72cebe2fd8a55fbe14956f9970fe8eb1ac59e5df042f603ef7c8ba0adc/cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414", size = 211972, upload-time = "2025-09-08T23:22:38.436Z" },
     { url = "https://files.pythonhosted.org/packages/0b/28/dd0967a76aab36731b6ebfe64dec4e981aff7e0608f60c2d46b46982607d/cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743", size = 217078, upload-time = "2025-09-08T23:22:39.776Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c0/015b25184413d7ab0a410775fdb4a50fca20f5589b5dab1dbbfa3baad8ce/cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5", size = 172076, upload-time = "2025-09-08T23:22:40.95Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/8f/dc5531155e7070361eb1b7e4c1a9d896d0cb21c49f807a6c03fd63fc877e/cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5", size = 182820, upload-time = "2025-09-08T23:22:42.463Z" },
+    { url = "https://files.pythonhosted.org/packages/95/5c/1b493356429f9aecfd56bc171285a4c4ac8697f76e9bbbbb105e537853a1/cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d", size = 177635, upload-time = "2025-09-08T23:22:43.623Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/47/4f61023ea636104d4f16ab488e268b93008c3d0bb76893b1b31db1f96802/cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d", size = 185271, upload-time = "2025-09-08T23:22:44.795Z" },
+    { url = "https://files.pythonhosted.org/packages/df/a2/781b623f57358e360d62cdd7a8c681f074a71d445418a776eef0aadb4ab4/cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c", size = 181048, upload-time = "2025-09-08T23:22:45.938Z" },
     { url = "https://files.pythonhosted.org/packages/ff/df/a4f0fbd47331ceeba3d37c2e51e9dfc9722498becbeec2bd8bc856c9538a/cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe", size = 212529, upload-time = "2025-09-08T23:22:47.349Z" },
     { url = "https://files.pythonhosted.org/packages/d5/72/12b5f8d3865bf0f87cf1404d8c374e7487dcf097a1c91c436e72e6badd83/cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062", size = 220097, upload-time = "2025-09-08T23:22:48.677Z" },
     { url = "https://files.pythonhosted.org/packages/c2/95/7a135d52a50dfa7c882ab0ac17e8dc11cec9d55d2c18dda414c051c5e69e/cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e", size = 207983, upload-time = "2025-09-08T23:22:50.06Z" },
@@ -164,6 +248,11 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/78/2d/7fa73dfa841b5ac06c7b8855cfc18622132e365f5b81d02230333ff26e9e/cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba", size = 219572, upload-time = "2025-09-08T23:22:52.902Z" },
     { url = "https://files.pythonhosted.org/packages/07/e0/267e57e387b4ca276b90f0434ff88b2c2241ad72b16d31836adddfd6031b/cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94", size = 222963, upload-time = "2025-09-08T23:22:54.518Z" },
     { url = "https://files.pythonhosted.org/packages/b6/75/1f2747525e06f53efbd878f4d03bac5b859cbc11c633d0fb81432d98a795/cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187", size = 221361, upload-time = "2025-09-08T23:22:55.867Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
+    { url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
     { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
     { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
     { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
@@ -171,18 +260,31 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
     { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
     { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
+    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
+    { url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
+    { url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
     { url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
     { url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
     { url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
     { url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
     { url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
     { url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
     { url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
     { url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
     { url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
     { url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
     { url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
     { url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
 ]
 
 [[package]]
@@ -612,7 +714,7 @@ name = "importlib-metadata"
 version = "8.7.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "zipp" },
+    { name = "zipp", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/f3/49/3b30cad09e7771a4982d9975a8cbf64f00d4a1ececb53297f1d9a7be1b10/importlib_metadata-8.7.1.tar.gz", hash = "sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb", size = 57107, upload-time = "2025-12-21T10:00:19.278Z" }
 wheels = [
@@ -1168,9 +1270,11 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.3.0"
+version = "2.3.1"
 source = { editable = "." }
 dependencies = [
+    { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
+    { name = "brotlicffi", marker = "platform_python_implementation != 'CPython'" },
     { name = "bs4" },
     { name = "gitpython" },
     { name = "markdown" },
@@ -1205,6 +1309,8 @@ dev = [
 
 [package.metadata]
 requires-dist = [
+    { name = "brotli", marker = "platform_python_implementation == 'CPython'", specifier = ">=1.0.9" },
+    { name = "brotlicffi", marker = "platform_python_implementation != 'CPython'", specifier = ">=1.0.9" },
     { name = "bs4", specifier = ">=0.0.2" },
     { name = "gitpython" },
     { name = "hatch", marker = "extra == 'dev'" },

From ce9f0e1b3d4e5d607d492e7d1ac7e635e37b2aa0 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Tue, 2 Jun 2026 19:33:41 -0400
Subject: [PATCH 54/80] Dependabot hardening and workflow pipeline cleanup
 (#217)

* ci: skip PR Preview and Version Check on Dependabot PRs

Both workflows failed on every Dependabot PR for reasons that don't apply to
dependency bumps:

- PR Preview publishes a dev build to Test PyPI + Docker Hub. On a dependency
  bump there's no version change, so the publish 400s ("File already exists")
  -- and it needs publish secrets a Dependabot PR shouldn't carry anyway.
- Version Check requires an incremented app version, but Dependabot PRs touch
  uv.lock / pyproject.toml without bumping socketsecurity's version, so the
  check always fails.

Add a job-level `if` to skip each on `dependabot[bot]`-authored PRs (same
pattern already used for e2e-test.yml). Job-level skips report as "skipped"
rather than blocking, and these stay required for human-authored PRs.

Follow-up to #207 (the Dependabot review hardening), addressing fallout
observed once that config went live on real Dependabot PRs.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: pin sfw uv sync to the locked dependency set on Dependabot review

`sfw uv sync` is the intended way to route uv through Socket Firewall (per
Socket's own uv-wrapper guidance), so the python-sfw-smoke job was already
exercising the firewall -- uv's integration is just quieter than npm/pip
(no "N packages fetched" footer), which made it look like a no-op.

Add `--locked` so the check verifies the exact uv.lock set and fails on
lockfile drift instead of silently re-resolving to newer versions than the
PR locked. This makes the firewall inspect precisely what would be installed
and aligns with the deterministic-verification guidance for uv-based repos.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: use official socketdev/action for Socket Firewall setup

Replace the hand-rolled `npm install -g sfw` in all three sfw smoke jobs with
the official setup action (socketdev/action@v1.3.2, mode: firewall-free).

Why:
- It's the documented GitHub Actions integration for Socket Firewall Free and
  wires up sfw routing correctly, rather than relying on an ad-hoc global npm
  install. This is the right mitigation for the class of Wrapper-Mode routing
  gaps where sfw can fail to proxy fetches from files.pythonhosted.org
  (tracked upstream as ENG-4871) -- exactly the "no interception" symptom that
  made the python job look like a no-op.
- The Python jobs no longer need actions/setup-node at all (the action
  provides sfw directly), so those steps are dropped; the npm fixture job keeps
  setup-node since `npm install` needs it.

Setup mode is firewall-free (anonymous, no API token) -- unchanged, and the
reason this is safe to run on Dependabot/untrusted PRs.

Our setup is Wrapper Mode + free edition + no CodeArtifact, so the Registry
Mode + CodeArtifact `uv sync`/`uv lock` issue (CE-171) does not apply.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: factor Socket Firewall setup into a composite action

The three sfw smoke jobs (python / npm-fixture / pypi-fixture) repeated the
same setup: toolchain bootstrap + socketdev/action install. GitHub Actions
doesn't support YAML anchors, so extract the shared setup into a local
composite action instead.

- New .github/actions/setup-sfw: optional Python/Node/uv toolchain inputs +
  the socketdev/action (firewall-free) install.
- Each job now just declares the toolchain it needs (`uv`, `node`, or
  `python`) and runs its own distinct sfw command.

Net effect: the pinned socketdev/action SHA now lives in ONE place (future
bumps touch a single line), the per-job setup-python/setup-node duplication
is gone, and each job body is reduced to its actual firewall check. No
behavior change.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: speed up and de-duplicate the release & preview pipelines

Performance (PR preview, the iterative-feedback path):
- Add a concurrency group with cancel-in-progress so pushing a PR again
  cancels the superseded (slow) preview run instead of letting it churn.
- Build preview images amd64-only. arm64 under QEMU emulation was the
  slowest part of the job, and preview images are for quick testing;
  release/stable keep multi-arch.
- Enable GitHub Actions Docker layer cache (type=gha) on all image builds
  so unchanged layers are reused across runs.

De-duplication (GitHub Actions has no YAML anchors, so use composite actions):
- New .github/actions/setup-docker-publish: the QEMU + Buildx + Docker Hub
  login trio, shared by release.yml, pr-preview.yml, and docker-stable.yml.
  These had drifted to three different pinned SHA sets; now there is one.
  (Docker Hub creds are passed as inputs since composite actions can't read
  secrets directly.)
- New .github/actions/setup-hatch: the pinned virtualenv/hatchling/hatch
  install shared by release.yml and pr-preview.yml.

No behavior change to what gets published; only how the pipelines are
assembled and how fast/parallel they run.

Stacked on #217 (lelia/fix-dependabot-checks) to avoid a pr-preview.yml
conflict with that PR's Dependabot skip; rebase onto main once #217 lands.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: pin all GitHub Actions to latest release SHAs with version comments

Bump every third-party action to its latest git-tagged release, pinned to
the resolved commit SHA with a trailing '# vX.Y.Z' comment for readability:

  actions/checkout              -> v6.0.2
  actions/setup-python          -> v6.2.0
  actions/setup-node            -> v6.4.0
  actions/github-script         -> v9.0.0
  pypa/gh-action-pypi-publish   -> v1.14.0
  docker/setup-qemu-action      -> v4.1.0
  docker/setup-buildx-action    -> v4.1.0
  docker/login-action           -> v4.2.0
  docker/build-push-action      -> v7.2.0
  socketdev/action              -> v1.3.2 (comment only)

Applied across the setup-sfw composite action and all workflows, including
docker-stable.yml which previously used floating major-version comments.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* Keep dependabot action pins visible

* Configure Dependabot for composite actions

* Include composite actions in Dependabot review notice

* Rename Docker setup composite action

* Extend dependency review to maintainer PRs

* Use CLI Socket token for enterprise dependency review

* Restrict enterprise SFW to org members

* Use dedicated SFW token secret

* Use environment-scoped SFW token

* Gate enterprise SFW on non-fork PRs

* ci(dependency-review): bundle SFW reports as artifacts

Collect each Socket Firewall smoke job's output into an sfw-artifacts/
directory and upload it (if: always(), so the report survives even when
sfw BLOCKS an install):

  - context.txt   -- provenance (mode, manifest, PR#, head SHA)
  - sfw-*.log      -- teed firewall console output (pipefail preserves the
                      sfw exit code so a block still fails the job)
  - import-smoke.log (python jobs)
  - sfw-report.json -- the structured firewall report, copied from
                       $SFW_JSON_REPORT_PATH (the path socketdev/action
                       exports); a sfw-report-missing.txt breadcrumb is
                       written instead when no report is produced

Copy rather than redirect the JSON: socketdev/action's post step reads
$SFW_JSON_REPORT_PATH to render its job summary, so the report must stay
at its temp path. Artifacts are named per edition+manifest to stay unique
within a run. Pins actions/upload-artifact to v7.0.1.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 .github/actions/setup-docker/action.yml |  23 +
 .github/actions/setup-hatch/action.yml  |  13 +
 .github/actions/setup-sfw/action.yml    |  49 ++
 .github/dependabot.yml                  |   6 +-
 .github/workflows/dependabot-review.yml | 205 ---------
 .github/workflows/dependency-review.yml | 588 ++++++++++++++++++++++++
 .github/workflows/docker-stable.yml     |  20 +-
 .github/workflows/e2e-test.yml          |   8 +-
 .github/workflows/pr-preview.yml        |  53 ++-
 .github/workflows/python-tests.yml      |   8 +-
 .github/workflows/release.yml           |  34 +-
 .github/workflows/version-check.yml     |   8 +-
 12 files changed, 742 insertions(+), 273 deletions(-)
 create mode 100644 .github/actions/setup-docker/action.yml
 create mode 100644 .github/actions/setup-hatch/action.yml
 create mode 100644 .github/actions/setup-sfw/action.yml
 delete mode 100644 .github/workflows/dependabot-review.yml
 create mode 100644 .github/workflows/dependency-review.yml

diff --git a/.github/actions/setup-docker/action.yml b/.github/actions/setup-docker/action.yml
new file mode 100644
index 0000000..846efd4
--- /dev/null
+++ b/.github/actions/setup-docker/action.yml
@@ -0,0 +1,23 @@
+name: "Set up Docker"
+description: >-
+  Set up QEMU + Docker Buildx and authenticate to Docker Hub for multi-arch
+  image builds. Centralizes the QEMU/Buildx/login trio used by release,
+  preview, and stable workflows.
+
+inputs:
+  dockerhub-username:
+    description: "Docker Hub username (pass from secrets)"
+    required: true
+  dockerhub-token:
+    description: "Docker Hub token/password (pass from secrets)"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+    - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+    - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      with:
+        username: ${{ inputs.dockerhub-username }}
+        password: ${{ inputs.dockerhub-token }}
diff --git a/.github/actions/setup-hatch/action.yml b/.github/actions/setup-hatch/action.yml
new file mode 100644
index 0000000..0da5160
--- /dev/null
+++ b/.github/actions/setup-hatch/action.yml
@@ -0,0 +1,13 @@
+name: "Set up Hatch build tooling"
+description: >-
+  Install the pinned hatch / hatchling / virtualenv toolchain used to build
+  and publish the package. Assumes Python is already set up by the caller.
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        python -m pip install --upgrade pip
+        pip install "virtualenv<20.36"
+        pip install hatchling==1.27.0 hatch==1.14.0
diff --git a/.github/actions/setup-sfw/action.yml b/.github/actions/setup-sfw/action.yml
new file mode 100644
index 0000000..456f90b
--- /dev/null
+++ b/.github/actions/setup-sfw/action.yml
@@ -0,0 +1,49 @@
+name: "Set up Socket Firewall"
+description: >-
+  Set up the requested language toolchain and install Socket Firewall (free
+  or enterprise edition) so subsequent steps can run package-manager commands
+  wrapped with `sfw`. Defaults to free/anonymous mode (no API token -- safe on
+  untrusted / Dependabot / fork PRs). Pass mode: firewall-enterprise +
+  socket-token for full org-policy enforcement on trusted maintainer PRs.
+
+inputs:
+  python:
+    description: "Set up Python 3.12"
+    default: "false"
+  node:
+    description: "Set up Node 20 (needed for npm-wrapped checks)"
+    default: "false"
+  uv:
+    description: "Install uv (implies Python)"
+    default: "false"
+  mode:
+    description: "socketdev/action mode: firewall-free or firewall-enterprise"
+    default: "firewall-free"
+  socket-token:
+    description: "Socket API token (only used/required for firewall-enterprise)"
+    default: ""
+
+runs:
+  using: "composite"
+  steps:
+    - if: ${{ inputs.python == 'true' || inputs.uv == 'true' }}
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: "3.12"
+
+    - if: ${{ inputs.node == 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: "20"
+
+    # Official Socket setup action. Wires up sfw routing correctly.
+    # socket-token is ignored in firewall-free mode and empty when absent.
+    - uses: socketdev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
+      with:
+        mode: ${{ inputs.mode }}
+        socket-token: ${{ inputs.socket-token }}
+
+    - if: ${{ inputs.uv == 'true' }}
+      name: Install uv
+      shell: bash
+      run: python -m pip install --upgrade pip uv
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7c05ee5..89e2ed0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,9 +36,11 @@ updates:
     cooldown:
       default-days: 7
 
-  # GitHub Actions used in workflows
+  # GitHub Actions used in workflows and local composite actions.
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 2
diff --git a/.github/workflows/dependabot-review.yml b/.github/workflows/dependabot-review.yml
deleted file mode 100644
index 486ccb3..0000000
--- a/.github/workflows/dependabot-review.yml
+++ /dev/null
@@ -1,205 +0,0 @@
-name: dependabot-review
-
-# Dependency-update PR guardrails for Dependabot-authored PRs.
-#
-# Runs only on PRs opened by dependabot[bot]. Inspects which files
-# changed, then conditionally runs Socket Firewall (sfw) install smoke
-# jobs for the affected manifests. Because sfw uses the free, anonymous
-# Socket public-data path it needs NO API key, so we can run it from
-# the unprivileged `pull_request` context without pull_request_target
-# or any of its security tradeoffs.
-#
-# Pattern adapted from SocketDev/socket-basics.
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: dependabot-review-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  inspect:
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    outputs:
-      python_deps_changed: ${{ steps.diff.outputs.python_deps_changed }}
-      fixture_npm_changed: ${{ steps.diff.outputs.fixture_npm_changed }}
-      fixture_pypi_changed: ${{ steps.diff.outputs.fixture_pypi_changed }}
-      dockerfile_changed: ${{ steps.diff.outputs.dockerfile_changed }}
-      workflow_or_action_changed: ${{ steps.diff.outputs.workflow_or_action_changed }}
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Inspect changed files
-        id: diff
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          CHANGED_FILES="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
-
-          {
-            echo "## Changed files"
-            echo '```'
-            printf '%s\n' "$CHANGED_FILES"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-          has_file() {
-            local pattern="$1"
-            if printf '%s\n' "$CHANGED_FILES" | grep -Eq "$pattern"; then
-              echo "true"
-            else
-              echo "false"
-            fi
-          }
-
-          {
-            echo "python_deps_changed=$(has_file '^(pyproject\.toml|uv\.lock)$')"
-            echo "fixture_npm_changed=$(has_file '^tests/e2e/fixtures/simple-npm/')"
-            echo "fixture_pypi_changed=$(has_file '^tests/e2e/fixtures/simple-pypi/')"
-            echo "dockerfile_changed=$(has_file '^Dockerfile$')"
-            echo "workflow_or_action_changed=$(has_file '^\.github/workflows/|^\.github/dependabot\.yml$')"
-          } >> "$GITHUB_OUTPUT"
-
-      - name: Summarize review expectations
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-        run: |
-          {
-            echo "## Dependabot Review Checklist"
-            echo "- PR: $PR_URL"
-            echo "- Confirm upstream release notes before merge"
-            echo "- Do not treat a Dependabot PR as trusted solely because of the actor"
-            echo "- This workflow runs in pull_request context only; no publish secrets are exposed"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-  python-sfw-smoke:
-    needs: inspect
-    if: needs.inspect.outputs.python_deps_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
-        with:
-          python-version: "3.12"
-
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
-        with:
-          node-version: "20"
-
-      - name: Install Socket Firewall
-        run: npm install -g sfw
-
-      - name: Install uv
-        run: python -m pip install --upgrade pip uv
-
-      - name: Sync project through Socket Firewall
-        run: sfw uv sync --extra test --extra dev
-
-      - name: Import smoke test
-        run: |
-          uv run python -c "
-          from socketsecurity.socketcli import cli, build_socket_sdk
-          from socketsecurity.core import Core
-          from socketsecurity.core.exceptions import (
-              APIFailure, RequestTimeoutExceeded, APIResourceNotFound,
-          )
-          from socketsecurity.core.git_interface import Git
-          from socketsecurity.config import CliConfig
-          print('import smoke OK')
-          "
-
-  fixture-npm-sfw-smoke:
-    needs: inspect
-    if: needs.inspect.outputs.fixture_npm_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
-        with:
-          node-version: "20"
-
-      - name: Install Socket Firewall
-        run: npm install -g sfw
-
-      - name: Install fixture through Socket Firewall
-        working-directory: tests/e2e/fixtures/simple-npm
-        run: sfw npm install --no-audit --no-fund --ignore-scripts
-
-  fixture-pypi-sfw-smoke:
-    needs: inspect
-    if: needs.inspect.outputs.fixture_pypi_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
-        with:
-          python-version: "3.12"
-
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
-        with:
-          node-version: "20"
-
-      - name: Install Socket Firewall
-        run: npm install -g sfw
-
-      - name: Install fixture through Socket Firewall
-        working-directory: tests/e2e/fixtures/simple-pypi
-        run: |
-          python -m venv .venv
-          # shellcheck disable=SC1091
-          source .venv/bin/activate
-          sfw pip install -r requirements.txt
-
-  dockerfile-smoke:
-    needs: inspect
-    if: needs.inspect.outputs.dockerfile_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Build the Dockerfile (no push)
-        run: docker build --pull -t socket-python-cli:dependabot-smoke .
-
-  workflow-notice:
-    needs: inspect
-    if: needs.inspect.outputs.workflow_or_action_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 2
-    steps:
-      - name: Flag workflow-sensitive updates
-        run: |
-          {
-            echo "## Sensitive File Notice"
-            echo "This Dependabot PR changes workflow or dependabot config files."
-            echo "Require explicit human review before merge."
-          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..58c3f39
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,588 @@
+name: dependency-review
+
+# Supply-chain guardrails for dependency-update PRs -- for BOTH Dependabot
+# and maintainers.
+#
+# Inspects the changed files, then conditionally runs Socket Firewall (sfw)
+# install smoke jobs for the affected manifests, picking the firewall edition
+# per PR:
+#
+#   - Trusted authors: any in-repo (non-fork) PR other than Dependabot's
+#     (i.e. someone with write access) -> Socket Firewall ENTERPRISE through
+#     the socket-firewall environment and its SOCKET_SFW_API_TOKEN secret
+#     (authenticated, full org-policy enforcement).
+#   - Everyone else: Dependabot and all fork PRs from external contributors ->
+#     Socket Firewall FREE (anonymous, no API token), which is safe in the
+#     unprivileged `pull_request` context.
+#
+# Only Enterprise jobs declare the socket-firewall environment. Free jobs do
+# not touch that environment or its token.
+#
+# Each sfw smoke job collects an sfw-artifacts/ directory (provenance context
+# + the firewall's console logs) and uploads it as a build artifact
+# (if: always(), so the report survives even when sfw BLOCKS an install --
+# which is exactly when you want to read it).
+#
+# Pattern adapted from SocketDev/socket-basics and SocketDev/socket-sdk-python.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependency-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  inspect:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      python_deps_changed: ${{ steps.diff.outputs.python_deps_changed }}
+      fixture_npm_changed: ${{ steps.diff.outputs.fixture_npm_changed }}
+      fixture_pypi_changed: ${{ steps.diff.outputs.fixture_pypi_changed }}
+      dockerfile_changed: ${{ steps.diff.outputs.dockerfile_changed }}
+      workflow_or_action_changed: ${{ steps.diff.outputs.workflow_or_action_changed }}
+      sfw_mode: ${{ steps.mode.outputs.sfw_mode }}
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Inspect changed files
+        id: diff
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          CHANGED_FILES="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
+
+          {
+            echo "## Changed files"
+            echo '```'
+            printf '%s\n' "$CHANGED_FILES"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          has_file() {
+            local pattern="$1"
+            if printf '%s\n' "$CHANGED_FILES" | grep -Eq "$pattern"; then
+              echo "true"
+            else
+              echo "false"
+            fi
+          }
+
+          {
+            echo "python_deps_changed=$(has_file '^(pyproject\.toml|uv\.lock)$')"
+            echo "fixture_npm_changed=$(has_file '^tests/e2e/fixtures/simple-npm/')"
+            echo "fixture_pypi_changed=$(has_file '^tests/e2e/fixtures/simple-pypi/')"
+            echo "dockerfile_changed=$(has_file '^Dockerfile$')"
+            echo "workflow_or_action_changed=$(has_file '^\.github/workflows/|^\.github/actions/|^\.github/dependabot\.yml$')"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Determine Socket Firewall mode
+        id: mode
+        # Trusted == any in-repo (non-fork) PR that isn't Dependabot's. Only
+        # accounts with write access can push a branch to this repo, so a
+        # non-fork PR already implies a trusted author -- the same boundary
+        # GitHub uses to decide whether secrets are exposed at all.
+        #
+        # NB: author_association is deliberately NOT used to require strict org
+        # membership. It only reflects PUBLIC org membership, so private members
+        # (the common case) show up as CONTRIBUTOR and would be misclassified.
+        # Reliable strict-membership detection would need a read:org token or
+        # public membership. This step references NO secret regardless -- it
+        # only decides which smoke job runs.
+        env:
+          IS_DEPENDABOT: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+          IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+          AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
+        run: |
+          mode=firewall-free
+          if [ "$IS_DEPENDABOT" != "true" ] && [ "$IS_FORK" != "true" ]; then
+            mode=firewall-enterprise
+          fi
+
+          echo "sfw_mode=$mode" >> "$GITHUB_OUTPUT"
+          {
+            echo "## Socket Firewall mode: \`$mode\`"
+            echo "- author_association: \`$AUTHOR_ASSOC\`"
+            echo "- dependabot: \`$IS_DEPENDABOT\` | fork: \`$IS_FORK\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Summarize review expectations
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          {
+            echo "## Dependency Review Checklist"
+            echo "- PR: $PR_URL"
+            echo "- Confirm upstream release notes before merge"
+            echo "- Do not treat a dependency PR as trusted solely because of the actor"
+            echo "- This workflow runs in pull_request context only; no publish secrets are exposed"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  python-sfw-smoke-free:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.python_deps_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-free'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-free"
+            echo "manifest=python"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          uv: "true"
+          mode: firewall-free
+
+      - name: Sync project through Socket Firewall
+        # `sfw uv sync` is the intended way to route uv through Socket Firewall
+        # (per Socket's own uv wrapper guidance). --locked verifies the exact
+        # uv.lock set and fails on lockfile drift rather than silently
+        # re-resolving, so the firewall inspects precisely what would install.
+        # Note: uv's sfw integration is quieter than npm/pip -- it does not
+        # print the "N packages fetched" footer, but interception is active.
+        #
+        # Use the runner's setup-python interpreter and forbid managed-Python
+        # downloads. The firewall is here to vet PyPI installs, not the
+        # interpreter/toolchain download path.
+        #
+        # pipefail keeps sfw's exit code through the tee so a firewall block
+        # still fails the job; tee captures the report for the artifact upload.
+        env:
+          UV_PYTHON: "3.12"
+          UV_PYTHON_DOWNLOADS: never
+        run: |
+          set -o pipefail
+          sfw uv sync --locked --extra test --extra dev 2>&1 | tee sfw-artifacts/sfw-uv-sync.log
+
+      - name: Import smoke test
+        env:
+          UV_PYTHON: "3.12"
+          UV_PYTHON_DOWNLOADS: never
+        run: |
+          set -o pipefail
+          uv run python -c "
+          from socketsecurity.socketcli import cli, build_socket_sdk
+          from socketsecurity.core import Core
+          from socketsecurity.core.exceptions import (
+              APIFailure, RequestTimeoutExceeded, APIResourceNotFound,
+          )
+          from socketsecurity.core.git_interface import Git
+          from socketsecurity.config import CliConfig
+          print('import smoke OK')
+          " 2>&1 | tee sfw-artifacts/import-smoke.log
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-free-python-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  python-sfw-smoke-enterprise:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.python_deps_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: socket-firewall
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-enterprise"
+            echo "manifest=python"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          uv: "true"
+          mode: firewall-enterprise
+          socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
+
+      - name: Sync project through Socket Firewall
+        # `sfw uv sync` is the intended way to route uv through Socket Firewall
+        # (per Socket's own uv wrapper guidance). --locked verifies the exact
+        # uv.lock set and fails on lockfile drift rather than silently
+        # re-resolving, so the firewall inspects precisely what would install.
+        # Note: uv's sfw integration is quieter than npm/pip -- it does not
+        # print the "N packages fetched" footer, but interception is active.
+        #
+        # Use the runner's setup-python interpreter and forbid managed-Python
+        # downloads. The firewall is here to vet PyPI installs, not the
+        # interpreter/toolchain download path.
+        #
+        # pipefail keeps sfw's exit code through the tee so a firewall block
+        # still fails the job; tee captures the report for the artifact upload.
+        env:
+          UV_PYTHON: "3.12"
+          UV_PYTHON_DOWNLOADS: never
+        run: |
+          set -o pipefail
+          sfw uv sync --locked --extra test --extra dev 2>&1 | tee sfw-artifacts/sfw-uv-sync.log
+
+      - name: Import smoke test
+        env:
+          UV_PYTHON: "3.12"
+          UV_PYTHON_DOWNLOADS: never
+        run: |
+          set -o pipefail
+          uv run python -c "
+          from socketsecurity.socketcli import cli, build_socket_sdk
+          from socketsecurity.core import Core
+          from socketsecurity.core.exceptions import (
+              APIFailure, RequestTimeoutExceeded, APIResourceNotFound,
+          )
+          from socketsecurity.core.git_interface import Git
+          from socketsecurity.config import CliConfig
+          print('import smoke OK')
+          " 2>&1 | tee sfw-artifacts/import-smoke.log
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-enterprise-python-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  fixture-npm-sfw-smoke-free:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.fixture_npm_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-free'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-free"
+            echo "manifest=npm"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          node: "true"
+          mode: firewall-free
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-npm
+        # Tee to an absolute path under the workspace so the log lands in the
+        # repo-root sfw-artifacts/ dir despite this step's working-directory.
+        run: |
+          set -o pipefail
+          sfw npm install --no-audit --no-fund --ignore-scripts 2>&1 | tee "$GITHUB_WORKSPACE/sfw-artifacts/sfw-npm-install.log"
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-free-npm-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  fixture-npm-sfw-smoke-enterprise:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.fixture_npm_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: socket-firewall
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-enterprise"
+            echo "manifest=npm"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          node: "true"
+          mode: firewall-enterprise
+          socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-npm
+        # Tee to an absolute path under the workspace so the log lands in the
+        # repo-root sfw-artifacts/ dir despite this step's working-directory.
+        run: |
+          set -o pipefail
+          sfw npm install --no-audit --no-fund --ignore-scripts 2>&1 | tee "$GITHUB_WORKSPACE/sfw-artifacts/sfw-npm-install.log"
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-enterprise-npm-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  fixture-pypi-sfw-smoke-free:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.fixture_pypi_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-free'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-free"
+            echo "manifest=pypi"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          python: "true"
+          mode: firewall-free
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-pypi
+        # Tee to an absolute path under the workspace so the log lands in the
+        # repo-root sfw-artifacts/ dir despite this step's working-directory.
+        run: |
+          set -o pipefail
+          python -m venv .venv
+          # shellcheck disable=SC1091
+          source .venv/bin/activate
+          sfw pip install -r requirements.txt 2>&1 | tee "$GITHUB_WORKSPACE/sfw-artifacts/sfw-pip-install.log"
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-free-pypi-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  fixture-pypi-sfw-smoke-enterprise:
+    needs: inspect
+    if: |
+      needs.inspect.outputs.fixture_pypi_changed == 'true' &&
+      needs.inspect.outputs.sfw_mode == 'firewall-enterprise'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: socket-firewall
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Prepare SFW artifact directory
+        run: |
+          mkdir -p sfw-artifacts
+          {
+            echo "mode=firewall-enterprise"
+            echo "manifest=pypi"
+            echo "pr=${{ github.event.pull_request.number }}"
+            echo "sha=${{ github.event.pull_request.head.sha }}"
+          } > sfw-artifacts/context.txt
+
+      - uses: ./.github/actions/setup-sfw
+        with:
+          python: "true"
+          mode: firewall-enterprise
+          socket-token: ${{ secrets.SOCKET_SFW_API_TOKEN }}
+
+      - name: Install fixture through Socket Firewall
+        working-directory: tests/e2e/fixtures/simple-pypi
+        # Tee to an absolute path under the workspace so the log lands in the
+        # repo-root sfw-artifacts/ dir despite this step's working-directory.
+        run: |
+          set -o pipefail
+          python -m venv .venv
+          # shellcheck disable=SC1091
+          source .venv/bin/activate
+          sfw pip install -r requirements.txt 2>&1 | tee "$GITHUB_WORKSPACE/sfw-artifacts/sfw-pip-install.log"
+
+      - name: Collect SFW JSON report
+        # socketdev/action points sfw at SFW_JSON_REPORT_PATH (a $RUNNER_TEMP
+        # file) and reads it back in its post step to render the job summary, so
+        # COPY (don't move) the report into the bundle. sfw writes it even when
+        # it blocks an install -- always() keeps it on failures too.
+        if: always()
+        run: |
+          if [ -n "${SFW_JSON_REPORT_PATH:-}" ] && [ -f "$SFW_JSON_REPORT_PATH" ]; then
+            cp "$SFW_JSON_REPORT_PATH" "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report.json"
+            echo "Collected SFW report -> sfw-artifacts/sfw-report.json"
+          else
+            echo "No SFW JSON report found at '${SFW_JSON_REPORT_PATH:-<unset>}'." \
+              > "$GITHUB_WORKSPACE/sfw-artifacts/sfw-report-missing.txt"
+          fi
+
+      - name: Upload SFW report artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: socket-firewall-enterprise-pypi-${{ github.event.pull_request.number }}
+          path: sfw-artifacts/
+          if-no-files-found: warn
+          retention-days: 14
+
+  dockerfile-smoke:
+    needs: inspect
+    if: needs.inspect.outputs.dockerfile_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Build the Dockerfile (no push)
+        run: docker build --pull -t socket-python-cli:dependabot-smoke .
+
+  workflow-notice:
+    needs: inspect
+    if: needs.inspect.outputs.workflow_or_action_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Flag workflow-sensitive updates
+        run: |
+          {
+            echo "## Sensitive File Notice"
+            echo "This PR changes workflow, composite-action, or dependabot config files."
+            echo "Require explicit human review before merge."
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/docker-stable.yml b/.github/workflows/docker-stable.yml
index 3639ffc..934e0d9 100644
--- a/.github/workflows/docker-stable.yml
+++ b/.github/workflows/docker-stable.yml
@@ -13,7 +13,7 @@ jobs:
   stable:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -28,23 +28,19 @@ jobs:
           fi
           echo "Version ${INPUT_VERSION} found on PyPI - proceeding with release"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-
-      - name: Login to Docker Hub with Organization Token
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+      - name: Set up Docker publishing
+        uses: ./.github/actions/setup-docker
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build & Push Stable Docker
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           push: true
           platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: socketdev/cli:stable
           build-args: |
             CLI_VERSION=${{ inputs.version }}
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index 83a6fa4..f233115 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -14,7 +14,7 @@ jobs:
     # Skip e2e on:
     #  - PRs from forks (no secrets)
     #  - Dependabot PRs (no secrets, and dependency-bump risk is already
-    #    covered by dependabot-review.yml's Socket Firewall smoke jobs)
+    #    covered by dependency-review.yml's Socket Firewall smoke jobs)
     if: >-
       (github.event_name != 'pull_request' ||
         github.event.pull_request.head.repo.full_name == github.repository) &&
@@ -70,16 +70,16 @@ jobs:
 
     name: e2e-${{ matrix.name }}
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         if: matrix.setup-node == 'true'
         with:
           node-version: '20'
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index 1d7115a..eb29ef9 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -3,29 +3,37 @@ on:
   pull_request:
     types: [opened, synchronize, ready_for_review]
 
+# Cancel an in-flight preview when the PR is pushed again -- previews are slow
+# (publish + multi-step Docker build), so superseded runs shouldn't keep going.
+concurrency:
+  group: pr-preview-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 jobs:
   preview:
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Skip on:
+    #  - PRs from forks (no access to publish secrets)
+    #  - Dependabot PRs: preview-publishing a dependency bump to Test PyPI /
+    #    Docker Hub is pointless and fails (no version bump, secret access).
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     permissions:
       id-token: write
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.13'
 
-      # Install all dependencies from pyproject.toml
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install "virtualenv<20.36"
-          pip install hatchling==1.27.0 hatch==1.14.0
+      - name: Install build tooling
+        uses: ./.github/actions/setup-hatch
 
       - name: Inject full dynamic version
         run: python .hooks/sync_version.py --dev
@@ -57,14 +65,14 @@ jobs:
 
       - name: Publish to Test PyPI
         if: steps.version_check.outputs.exists != 'true'
-        uses: pypa/gh-action-pypi-publish@ab69e431e9c9f48a3310be0a56527c679f56e04d
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
 
       - name: Comment on PR
         if: steps.version_check.outputs.exists != 'true'
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           VERSION: ${{ env.VERSION }}
         with:
@@ -133,27 +141,26 @@ jobs:
           echo "success=false" >> $GITHUB_OUTPUT
           exit 1
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349
-
-      - name: Login to Docker Hub with Organization Token
+      - name: Set up Docker publishing
         if: steps.verify_package.outputs.success == 'true'
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
+        uses: ./.github/actions/setup-docker
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build & Push Docker Preview
         if: steps.verify_package.outputs.success == 'true'
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         env:
           VERSION: ${{ env.VERSION }}
         with:
           push: true
-          platforms: linux/amd64,linux/arm64
+          # Preview images are for quick testing -- build amd64 only. arm64 via
+          # QEMU emulation is the slowest part of the job; release builds keep
+          # multi-arch. GHA layer cache speeds up repeated preview builds.
+          platforms: linux/amd64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: |
             socketdev/cli:pr-${{ github.event.pull_request.number }}
           build-args: |
diff --git a/.github/workflows/python-tests.yml b/.github/workflows/python-tests.yml
index 94f4f82..3247275 100644
--- a/.github/workflows/python-tests.yml
+++ b/.github/workflows/python-tests.yml
@@ -35,12 +35,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
           persist-credentials: false
       - name: 🐍 setup python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: 🛠️ install deps
@@ -71,12 +71,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
           persist-credentials: false
       - name: 🐍 setup python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
       - name: 🚫 verify install is rejected on unsupported python
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5549b88..6c41e9c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,21 +10,17 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.13'
 
-      # Install all dependencies from pyproject.toml
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install "virtualenv<20.36"
-          pip install hatchling==1.27.0 hatch==1.14.0
-          
+      - name: Install build tooling
+        uses: ./.github/actions/setup-hatch
+
       - name: Get Version
         id: version
         env:
@@ -70,19 +66,13 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.version_check.outputs.pypi_exists != 'true'
-        uses: pypa/gh-action-pypi-publish@ab69e431e9c9f48a3310be0a56527c679f56e04d
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
 
-      - name: Login to Docker Hub with Organization Token
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567
+      - name: Set up Docker publishing
+        uses: ./.github/actions/setup-docker
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Verify package is installable
         id: verify_package
@@ -106,12 +96,14 @@ jobs:
         if: |
           steps.verify_package.outputs.success == 'true' &&
           steps.docker_check.outputs.docker_exists != 'true'
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         env:
           VERSION: ${{ env.VERSION }}
         with:
           push: true
           platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           tags: |
             socketdev/cli:latest
             socketdev/cli:${{ env.VERSION }}
diff --git a/.github/workflows/version-check.yml b/.github/workflows/version-check.yml
index 1eefa27..a097208 100644
--- a/.github/workflows/version-check.yml
+++ b/.github/workflows/version-check.yml
@@ -14,9 +14,13 @@ permissions:
 
 jobs:
   check_version:
+    # Skip on Dependabot PRs: they bump dependencies (touching uv.lock /
+    # pyproject.toml) without bumping the app version, so the increment check
+    # would always fail. App-version bumps come from maintainer PRs.
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0  # Fetch all history for all branches
           persist-credentials: false
@@ -86,7 +90,7 @@ jobs:
           fi
 
       - name: Manage PR Comment
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         if: always() && github.event.pull_request.head.repo.full_name == github.repository
         env:
           MAIN_VERSION: ${{ env.MAIN_VERSION }}

From a486d4adb9915c1230481d9ff92bf0700c09538b Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Tue, 2 Jun 2026 20:01:15 -0400
Subject: [PATCH 55/80] Always omit license details from full-scan diff request
 (#221)

* fix(core): always omit license details from full-scan diff request (#CE-224 follow-on)

The full-scan diff request (fullscans.stream_diff) now always sets
include_license_details=false, decoupled from the --exclude-license-details
flag. This prevents the CE-224 truncation crash (Unterminated string / JSON
parse failure on large repos, reported by the tremendous org) from recurring
even when the flag is not passed.

Why this is safe (no output changes): the license fields the diff endpoint can
embed are never consumed off the diff. With --generate-license off, the only
consumer (the legal/FOSSA artifact builder) never runs. With --generate-license
on, get_license_text_via_purl re-fetches license data from the dedicated PURL
endpoint and overwrites whatever the diff embedded before anything reads it.
Either way the embedded payload was dead weight that only bloated the response.

--exclude-license-details still works but its scope is now narrower: it controls
only the dashboard report URL, not the internal diff payload. Help text updated.
Core.get_added_and_removed_packages(..., include_license_details=True) remains as
an explicit override seam (exercised in tests).

Minor bump to 2.4.0: outputs are provably unchanged, but this is a deliberate
default-behavior change (2.3.0 made the flag propagate; 2.4.0 makes the lean diff
the default), which warrants a minor bump per the project's semver policy.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: trim changelog release notes

* chore: require socketdev 3.1.2

* docs: note exclude license flag scope change

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 CHANGELOG.md                    | 51 +++++++++++++++------------------
 pyproject.toml                  |  4 +--
 socketsecurity/__init__.py      |  2 +-
 socketsecurity/config.py        |  7 ++++-
 socketsecurity/core/__init__.py | 35 ++++++++++++++++++++--
 tests/core/test_sdk_methods.py  | 20 +++++++++++--
 uv.lock                         | 10 +++----
 7 files changed, 87 insertions(+), 42 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f78b70..41545c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.4.0
+
+### Changed: license details are no longer requested on the full-scan diff
+
+- Full-scan diff requests now always set `include_license_details=false`, keeping
+  large diff responses smaller and avoiding truncation crashes on large repos.
+- Soft breaking change for flag-scripted use: `--exclude-license-details` still
+  controls the dashboard report URL, but no longer affects the internal diff
+  request. Its `--help` text has been updated to reflect the narrower scope.
+- License artifact output is unchanged: `--generate-license` continues to fetch
+  license details from the dedicated PURL endpoint.
+- Requires `socketdev>=3.1.2`.
+
 ## 2.3.1
 
 ### New: brotli-compressed `.socket.facts.json` upload
@@ -31,40 +44,21 @@ Details:
 
 ### New: `--exit-code-on-api-error`
 
-Adds a configurable exit code for API / infrastructure failures (timeouts,
-network errors, unexpected exceptions), so CI pipelines can distinguish them
-from blocking security findings (exit `1`):
-
-```
-socketcli --exit-code-on-api-error 100 ...
-```
-
-Default is `3` (the code the CLI already used for these errors), so **default
-behavior is unchanged** — the exit code only changes when you pass the flag.
-Set it to a Buildkite `soft_fail` code, or to `0` to swallow infra errors.
-
-**Interaction to be aware of:** `--disable-blocking` forces exit `0` for *all*
-outcomes and therefore overrides `--exit-code-on-api-error`. Use the new flag
-*without* `--disable-blocking` if you want a custom infra-error code to take
-effect. See the exit-code reference in the README.
-
-> A future `3.0` release is planned to make infrastructure errors exit non-zero
-> even under `--disable-blocking` (so outages stop being silently swallowed).
-> That is a breaking change and is intentionally **not** in this release.
+- Added `--exit-code-on-api-error` so CI can distinguish API / infrastructure
+  failures from blocking security findings. The default remains `3`; the flag
+  only changes behavior when set explicitly.
+- `--disable-blocking` still takes precedence and exits `0` for all outcomes.
 
 ### New: commit message auto-truncation
 
-`--commit-message` values longer than 200 characters are now automatically
-truncated before being sent to the API, preventing HTTP 413 errors from
-oversized URL query parameters (common with AI-generated commit messages or
-`$BUILDKITE_MESSAGE`).
+- `--commit-message` values longer than 200 characters are now truncated before
+  being sent to the API, preventing HTTP 413 errors from oversized query
+  parameters.
 
 ### Improved: Buildkite log formatting
 
-When running inside a Buildkite job (`BUILDKITE=true`), infrastructure errors
-emit Buildkite log section markers (`^^^ +++` / `--- :warning:`) so the error
-section auto-expands in the BK UI, plus a `soft_fail` hint. No effect on other
-CI platforms.
+- Infrastructure errors now emit Buildkite log section markers when
+  `BUILDKITE=true`, making those failures easier to find in Buildkite logs.
 
 ### Fixed
 
@@ -73,6 +67,7 @@ CI platforms.
   which was constructed without the CLI timeout and defaulted to 1200s.
 - `--exclude-license-details` now propagates to the full-scan diff comparison
   request (it was only applied to full-scan params / report URLs before).
+
 ## 2.2.93
 
 - Bundled twelve Dependabot dependency updates: `urllib3`, `gitpython`, `python-dotenv`, `pytest`, `uv`, `cryptography`, `pygments`, `requests`, and `idna` (main app), plus `axios`, `requests`, and `flask` (e2e fixtures). `idna` 3.11 → 3.15 includes the fix for CVE-2026-45409.
diff --git a/pyproject.toml b/pyproject.toml
index 982da93..c88ce43 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.3.1"
+version = "2.4.0"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.0.33,<4.0.0",
+    "socketdev>=3.1.2,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
     "brotli>=1.0.9; platform_python_implementation == 'CPython'",
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index b459b8c..55d08d9 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.3.1'
+__version__ = '2.4.0'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 7a262de..5a3cce7 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -705,7 +705,12 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--exclude-license-details",
         dest="exclude_license_details",
         action="store_true",
-        help="Exclude license details from the diff report (boosts performance for large repos)"
+        help=(
+            "Exclude license details from the dashboard report URL. "
+            "As of 2.4.0 the internal diff request always omits license details "
+            "(they were unused there and bloated large-repo responses), so this "
+            "flag now only affects the report link, not diff performance."
+        )
     )
     output_group.add_argument(
         "--max-purl-batch-size",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index c2bb862..0e98323 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1070,7 +1070,7 @@ def get_added_and_removed_packages(
             self,
             head_full_scan_id: str,
             new_full_scan_id: str,
-            include_license_details: bool = True
+            include_license_details: bool = False
     ) -> Tuple[Dict[str, Package], Dict[str, Package], Dict[str, Package]]:
         """
         Get packages that were added and removed between scans.
@@ -1078,6 +1078,27 @@ def get_added_and_removed_packages(
         Args:
             head_full_scan_id: Previous scan (maybe None if first scan)
             new_full_scan_id: New scan just created
+            include_license_details: Whether to ask the diff endpoint to embed
+                per-package license attribution/details in the response.
+
+                Defaults to ``False`` on purpose. The diff endpoint exists to
+                compare alerts between two scans; the license fields it can embed
+                are never consumed off the diff:
+                  * When ``--generate-license`` is OFF, the only consumer of
+                    ``Package.licenseDetails``/``licenseAttrib`` (the legal/FOSSA
+                    artifact builder) is never invoked, so the embedded license
+                    data is parsed and then dropped on the floor.
+                  * When ``--generate-license`` is ON, ``get_license_text_via_purl``
+                    re-fetches license data from the dedicated PURL endpoint and
+                    OVERWRITES whatever the diff embedded, before anything reads it.
+                Either way the embedded license payload is dead weight, and on
+                large dependency trees it inflated the diff response past ~2.3MB
+                and truncated it mid-string, crashing ``response.json()``
+                (CE-224, customer: Tremendous). Defaulting to ``False`` keeps the
+                diff lean with zero change to any output artifact. The parameter
+                is retained as an explicit override seam, not wired to the
+                ``--exclude-license-details`` user flag (which still governs the
+                human-facing dashboard report URL).
 
         Returns:
             Tuple of (added_packages, removed_packages) dictionaries
@@ -1299,7 +1320,15 @@ def create_new_diff(
                 except OSError as e:
                     log.warning(f"Failed to clean up temporary file {temp_file}: {e}")
 
-        # Handle diff generation - now we always have both scans
+        # Handle diff generation - now we always have both scans.
+        #
+        # Note: we intentionally do NOT forward params.include_license_details
+        # (the --exclude-license-details user flag) into the diff request. The
+        # diff path never consumes embedded license data (see
+        # get_added_and_removed_packages docstring), so requesting it only bloats
+        # the response and risks the CE-224 truncation crash on large repos. The
+        # user flag still controls the dashboard report URL below; it just no
+        # longer gates this internal diff payload.
         (
             added_packages,
             removed_packages,
@@ -1307,7 +1336,7 @@ def create_new_diff(
         ) = self.get_added_and_removed_packages(
             head_full_scan_id,
             new_full_scan.id,
-            include_license_details=getattr(params, "include_license_details", True)
+            include_license_details=False
         )
 
         # Separate unchanged packages from added/removed for --strict-blocking support
diff --git a/tests/core/test_sdk_methods.py b/tests/core/test_sdk_methods.py
index fdcbef3..2cad8e5 100644
--- a/tests/core/test_sdk_methods.py
+++ b/tests/core/test_sdk_methods.py
@@ -95,13 +95,17 @@ def test_get_added_and_removed_packages(core):
     # Get two different scans to compare
     added, removed, all_packages = core.get_added_and_removed_packages("head", "new")
     
-    # Verify SDK was called correctly
+    # Verify SDK was called correctly.
+    # include_license_details defaults to "false": the diff path never consumes
+    # embedded license data (license artifacts come from the PURL endpoint), so
+    # requesting it only bloats the response and risks the CE-224 truncation
+    # crash on large repos.
     core.sdk.fullscans.stream_diff.assert_called_once_with(
         core.config.org_slug,
         "head",
         "new",
         use_types=True,
-        include_license_details="true",
+        include_license_details="false",
     )
     
     # Verify the results
@@ -116,6 +120,18 @@ def test_get_added_and_removed_packages(core):
     assert "dp2_t1" in removed  # Verify transitive dependencies are also tracked
     assert "pypi/direct_package_1@1.6.0" in all_packages  # Unchanged package is in full package map
 
+def test_get_added_and_removed_packages_license_override(core):
+    """The include_license_details override seam still works when explicitly requested."""
+    core.get_added_and_removed_packages("head", "new", include_license_details=True)
+
+    core.sdk.fullscans.stream_diff.assert_called_once_with(
+        core.config.org_slug,
+        "head",
+        "new",
+        use_types=True,
+        include_license_details="true",
+    )
+
 def test_empty_alerts_preserved(core):
     """Test that empty alerts arrays stay as empty arrays and don't become None"""
     # Get the scan that contains dp2 (which has empty alerts array)
diff --git a/uv.lock b/uv.lock
index 0ffdcce..957202f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1257,20 +1257,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.1.0"
+version = "3.1.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/95/3e/50f05942e23d12043028d71c0e502c0d02c470686afc3dfbab0d1931e5c1/socketdev-3.1.0.tar.gz", hash = "sha256:a9534189d50c9f6c39e802280cc2317f830dd0c9970677e8cde843a69daa84ed", size = 172581, upload-time = "2026-05-21T17:14:03.607Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/34/3c/974f11a7064d12303049ed46b2a475ff6e65c073c0985558195756d30543/socketdev-3.1.2.tar.gz", hash = "sha256:3dc46258f29f66f8ed84767ab6158237d38a7de4ecb4b28950b4f0bb0d49ff68", size = 178479, upload-time = "2026-06-02T23:33:17.251Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/df/76/4fb37245468dd9c67137059ce6833db97d76c808bf0d10397f1b5a2943d1/socketdev-3.1.0-py3-none-any.whl", hash = "sha256:e9245916d423952aba4f0018bea2bca28740530ec30308089c48dddb2133e38a", size = 67255, upload-time = "2026-05-21T17:14:01.873Z" },
+    { url = "https://files.pythonhosted.org/packages/51/e9/72a8ccf2c3a20d436616e303b3c51a700e0def781806d361bd0f65ab436b/socketdev-3.1.2-py3-none-any.whl", hash = "sha256:14a4e913fa5c2bbea856820b2ebc9f7c21960c8c42e77a8fd2ae4ef626ba0f49", size = 67225, upload-time = "2026-06-02T23:33:15.714Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.3.1"
+version = "2.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
@@ -1327,7 +1327,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.0.33,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.1.2,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From dcab4445071fabaf7583bdcf9a2acacab2410cfe Mon Sep 17 00:00:00 2001
From: Oskar Haarklou Veileborg <ohv1020@hotmail.com>
Date: Wed, 3 Jun 2026 12:31:18 +0200
Subject: [PATCH 56/80] Bundle pyenv in the Docker image for on-demand Python
 versions (#225)

* Add pyenv to Docker image for on-demand Python versions

Install pyenv (pinned to v2.7.1) just below uv, along with the Alpine
build dependencies needed to compile CPython from source. This lets the
bundled tooling build/install arbitrary Python versions on demand.

Only the `pyenv` binary is symlinked onto the PATH; pyenv's shims
directory is deliberately left off PATH so its shims don't shadow the
system Python that the CLI runs on. bash is required since pyenv and the
pyenv-installer are bash scripts.

* Release 2.4.1: bundle pyenv in the Docker image

Bump version to 2.4.1 and document the pyenv addition. The CLI is
unchanged; this release exists to publish a Docker image that includes
pyenv for on-demand Python version installation.
---
 CHANGELOG.md               | 10 ++++++++++
 Dockerfile                 | 23 +++++++++++++++++++++++
 pyproject.toml             |  2 +-
 socketsecurity/__init__.py |  2 +-
 uv.lock                    |  2 +-
 5 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41545c3..f8636da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## 2.4.1
+
+### Added: pyenv in the Docker image
+
+- The `socketdev/cli` Docker image now bundles [pyenv](https://github.com/pyenv/pyenv)
+  (pinned to `v2.7.1`) along with the Alpine build dependencies needed to compile
+  CPython from source, so the image can build/install arbitrary Python versions on
+  demand.
+- The CLI itself is unchanged — this release only affects the published Docker image.
+
 ## 2.4.0
 
 ### Changed: license details are no longer requested on the full-scan diff
diff --git a/Dockerfile b/Dockerfile
index 0d9f2cb..7511078 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -88,6 +88,29 @@ ENV GOPATH="/go"
 # Install uv
 COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
 
+# Install pyenv
+# pyenv lets us build/install arbitrary Python versions on demand. We install
+# the build dependencies needed to compile CPython on Alpine, then install
+# pyenv itself. We deliberately only symlink the `pyenv` binary onto the PATH
+# and do NOT add pyenv's shims directory, so its shims don't shadow the system
+# Python that the CLI runs on.
+RUN apk add --no-cache \
+        bash \
+        bzip2-dev \
+        ca-certificates \
+        libffi-dev \
+        libxslt-dev \
+        linux-headers \
+        ncurses-dev \
+        openssl-dev \
+        readline-dev \
+        sqlite-dev \
+        xz-dev \
+        zlib-dev
+RUN curl -L https://raw.githubusercontent.com/pyenv/pyenv-installer/master/bin/pyenv-installer | PYENV_GIT_TAG="v2.7.1" bash && \
+    ln -s ~/.pyenv/bin/pyenv /bin/pyenv && \
+    pyenv --version
+
 # Install CLI based on build mode
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         echo "Using local development install"; \
diff --git a/pyproject.toml b/pyproject.toml
index c88ce43..4d5f098 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.0"
+version = "2.4.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 55d08d9..4c6871c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.0'
+__version__ = '2.4.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index 957202f..06d1578 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1270,7 +1270,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.0"
+version = "2.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 7d7ac0c14c16c3cd0f8dc66d5ea79a66a4283f7d Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Wed, 3 Jun 2026 16:02:49 +0200
Subject: [PATCH 57/80] feat(reach): align reachability flags and coana env
 with Node CLI (#226)

Bring the Python CLI's reachability surface to parity with the Node CLI:

- --reach-disable-external-tool-checks -> coana --disable-external-tool-checks
- forward SOCKET_CLI_VERSION + SOCKET_CALLER_USER_AGENT to coana (proxy is left to
  coana, which reads/inherits HTTPS_PROXY/HTTP_PROXY itself)
- omit SOCKET_REPO_NAME/SOCKET_BRANCH_NAME for the default repo/branch sentinels
- Node-style --reach-analysis-timeout/--reach-analysis-memory-limit as primary names,
  --reach-timeout/--reach-memory-limit kept as hidden aliases
- --reach-debug -> coana --debug (global --enable-debug -> -d unchanged)
- retry tier1 finalize with exponential backoff (3 attempts), never raising

Memory-limit and concurrency are intentionally NOT hardcoded: coana already defaults to
8192 MB and concurrency 1, so the CLI omits the flags and lets coana apply them (and still
forwards an explicit value when the user sets one). Splitting stays explicitly disabled
(--disable-analysis-splitting) because coana defaults it ON.

Removes stray always-on WARNING logging in the reachability runner. Adds a CHANGELOG 2.4.2
entry and tests for the flags/aliases, the coana command/env builder, and finalize retry.
---
 CHANGELOG.md                              |  20 ++++
 pyproject.toml                            |   2 +-
 socketsecurity/__init__.py                |   2 +-
 socketsecurity/config.py                  |  40 +++++++-
 socketsecurity/core/__init__.py           |  52 ++++++++---
 socketsecurity/core/tools/reachability.py |  46 ++++++++--
 socketsecurity/socketcli.py               |  23 ++++-
 tests/unit/test_config.py                 |  49 ++++++++++
 tests/unit/test_reachability.py           | 106 ++++++++++++++++++++++
 tests/unit/test_tier1_finalize.py         |  70 ++++++++++++++
 uv.lock                                   |   2 +-
 11 files changed, 382 insertions(+), 30 deletions(-)
 create mode 100644 tests/unit/test_reachability.py
 create mode 100644 tests/unit/test_tier1_finalize.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8636da..f47b76d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,25 @@
 # Changelog
 
+## 2.4.2
+
+### Added: reachability flag and Coana environment alignment with the Node CLI
+
+- New `--reach-disable-external-tool-checks` flag (passes `--disable-external-tool-checks`
+  to the Coana CLI).
+- New `--reach-debug` flag to enable Coana debug output (`--debug`) independently of the
+  global `--enable-debug`.
+- Node-style `--reach-analysis-timeout` and `--reach-analysis-memory-limit` are now the
+  primary flag names; the previous `--reach-timeout` / `--reach-memory-limit` continue to
+  work as hidden aliases.
+- The Coana subprocess now receives `SOCKET_CLI_VERSION` and `SOCKET_CALLER_USER_AGENT` so
+  calls are attributed to the Python CLI. Proxies continue to work via the inherited
+  `HTTPS_PROXY` / `HTTP_PROXY` environment variables, which Coana reads itself.
+- `SOCKET_REPO_NAME` / `SOCKET_BRANCH_NAME` are no longer forwarded to Coana when the repo
+  and branch are the default sentinels, avoiding cross-run reachability cache-bucket
+  collisions.
+- Tier 1 reachability finalize now retries with exponential backoff instead of giving up on
+  the first transient error.
+
 ## 2.4.1
 
 ### Added: pyenv in the Docker image
diff --git a/pyproject.toml b/pyproject.toml
index 4d5f098..d4af492 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.1"
+version = "2.4.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 4c6871c..e98e031 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.1'
+__version__ = '2.4.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 5a3cce7..58af7e5 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -139,6 +139,8 @@ class CliConfig:
     reach_continue_on_install_errors: bool = False
     reach_continue_on_missing_lock_files: bool = False
     reach_continue_on_no_source_files: bool = False
+    reach_debug: bool = False
+    reach_disable_external_tool_checks: bool = False
     max_purl_batch_size: int = 5000
     enable_commit_status: bool = False
     legal: bool = False
@@ -267,6 +269,8 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_continue_on_install_errors': args.reach_continue_on_install_errors,
             'reach_continue_on_missing_lock_files': args.reach_continue_on_missing_lock_files,
             'reach_continue_on_no_source_files': args.reach_continue_on_no_source_files,
+            'reach_debug': args.reach_debug,
+            'reach_disable_external_tool_checks': args.reach_disable_external_tool_checks,
             'max_purl_batch_size': args.max_purl_batch_size,
             'enable_commit_status': args.enable_commit_status,
             'legal': args.legal or args.legal_format == "fossa",
@@ -878,18 +882,32 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Specific version of @coana-tech/cli to use (e.g., '1.2.3')"
     )
     reachability_group.add_argument(
-        "--reach-timeout",
+        "--reach-analysis-timeout",
         dest="reach_analysis_timeout",
         type=int,
         metavar="<seconds>",
         help="Timeout for reachability analysis in seconds"
     )
+    # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
     reachability_group.add_argument(
-        "--reach-memory-limit",
+        "--reach-timeout",
+        dest="reach_analysis_timeout",
+        type=int,
+        help=argparse.SUPPRESS
+    )
+    reachability_group.add_argument(
+        "--reach-analysis-memory-limit",
         dest="reach_analysis_memory_limit",
         type=int,
         metavar="<mb>",
-        help="Memory limit for reachability analysis in MB"
+        help="Memory limit for reachability analysis in MB (defaults to the coana CLI's own default, currently 8192)"
+    )
+    # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
+    reachability_group.add_argument(
+        "--reach-memory-limit",
+        dest="reach_analysis_memory_limit",
+        type=int,
+        help=argparse.SUPPRESS
     )
     reachability_group.add_argument(
         "--reach-ecosystems",
@@ -957,7 +975,7 @@ def create_argument_parser() -> argparse.ArgumentParser:
         dest="reach_concurrency",
         type=int,
         metavar="<number>",
-        help="Concurrency level for reachability analysis (must be >= 1)"
+        help="Concurrency level for reachability analysis (must be >= 1; defaults to the coana CLI's own default, currently 1)"
     )
     reachability_group.add_argument(
         "--reach-additional-params",
@@ -1002,6 +1020,20 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=argparse.SUPPRESS
     )
+    reachability_group.add_argument(
+        "--reach-debug",
+        dest="reach_debug",
+        action="store_true",
+        help="Enable debug output for the reachability analysis (passes --debug to the coana CLI). "
+             "Independent of the global --enable-debug flag."
+    )
+    reachability_group.add_argument(
+        "--reach-disable-external-tool-checks",
+        dest="reach_disable_external_tool_checks",
+        action="store_true",
+        help="Disable coana's external tool availability checks during reachability analysis "
+             "(passes --disable-external-tool-checks to the coana CLI)."
+    )
 
     parser.add_argument(
         '--version',
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 0e98323..005dbae 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -71,6 +71,11 @@
 # Stream the facts file in 1 MiB chunks so large files aren't held fully in memory.
 SOCKET_FACTS_BROTLI_CHUNK_SIZE = 1024 * 1024
 
+# Tier 1 reachability finalize retry policy. The finalize call links the tier1 scan to the
+# full scan and can fail transiently (network/API blips); a few backoff retries make it robust.
+TIER1_FINALIZE_MAX_ATTEMPTS = 3
+TIER1_FINALIZE_BACKOFF_SECONDS = 1.0
+
 
 def _humanize_alert_type(alert_type: str) -> str:
     """Convert a camelCase/PascalCase alert type into a Title-Cased label.
@@ -549,20 +554,43 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
             log.debug(f"Failed to read tier1ReachabilityScanId from {facts_file_path}: {e}")
             return False
 
-        # Call the SDK to finalize the tier 1 scan
-        try:
-            success = self.sdk.fullscans.finalize_tier1(
-                full_scan_id=full_scan_id,
-                tier1_reachability_scan_id=tier1_scan_id,
-            )
+        # Call the SDK to finalize the tier 1 scan, retrying transient failures with backoff.
+        last_error: Optional[Exception] = None
+        for attempt in range(1, TIER1_FINALIZE_MAX_ATTEMPTS + 1):
+            try:
+                success = self.sdk.fullscans.finalize_tier1(
+                    full_scan_id=full_scan_id,
+                    tier1_reachability_scan_id=tier1_scan_id,
+                )
 
-            if success:
-                log.debug(f"Successfully finalized tier 1 scan {tier1_scan_id} for full scan {full_scan_id}")
-            return success
+                if success:
+                    log.debug(f"Successfully finalized tier 1 scan {tier1_scan_id} for full scan {full_scan_id}")
+                    return True
 
-        except Exception as e:
-            log.debug(f"Unable to finalize tier 1 scan: {e}")
-            return False
+                log.debug(
+                    f"finalize_tier1 returned a falsy result for scan {tier1_scan_id} "
+                    f"(attempt {attempt}/{TIER1_FINALIZE_MAX_ATTEMPTS})"
+                )
+            except Exception as e:
+                last_error = e
+                log.debug(
+                    f"Unable to finalize tier 1 scan (attempt {attempt}/{TIER1_FINALIZE_MAX_ATTEMPTS}): {e}"
+                )
+
+            if attempt < TIER1_FINALIZE_MAX_ATTEMPTS:
+                time.sleep(TIER1_FINALIZE_BACKOFF_SECONDS * (2 ** (attempt - 1)))
+
+        if last_error is not None:
+            log.debug(
+                f"Giving up finalizing tier 1 scan {tier1_scan_id} after "
+                f"{TIER1_FINALIZE_MAX_ATTEMPTS} attempts: {last_error}"
+            )
+        else:
+            log.debug(
+                f"Giving up finalizing tier 1 scan {tier1_scan_id} after "
+                f"{TIER1_FINALIZE_MAX_ATTEMPTS} attempts"
+            )
+        return False
 
     @staticmethod
     def _compress_facts_file(source_path: str) -> str:
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 27593c8..008bd65 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -1,15 +1,31 @@
 from socketdev import socketdev
 from typing import List, Optional, Dict, Any
 import os
+import platform
 import subprocess
 import json
 import pathlib
 import logging
 import sys
 
+from socketsecurity import __version__
+
 log = logging.getLogger(__name__)
 
 
+def _build_caller_user_agent() -> str:
+    """Build the SOCKET_CALLER_USER_AGENT string forwarded to the coana CLI.
+
+    Mirrors the Node CLI's ``<product>/<version> <runtime>/<version> <platform>/<arch>``
+    shape so the backend can attribute reachability calls to the Python CLI.
+    """
+    return (
+        f"socket/{__version__} "
+        f"python/{platform.python_version()} "
+        f"{platform.system().lower()}/{platform.machine().lower()}"
+    )
+
+
 class ReachabilityAnalyzer:
     def __init__(self, sdk: socketdev, api_token: str):
         self.sdk = sdk
@@ -108,6 +124,8 @@ def run_reachability_analysis(
         continue_on_install_errors: bool = False,
         continue_on_missing_lock_files: bool = False,
         continue_on_no_source_files: bool = False,
+        reach_debug: bool = False,
+        disable_external_tool_checks: bool = False,
     ) -> Dict[str, Any]:
         """
         Run reachability analysis.
@@ -147,8 +165,7 @@ def run_reachability_analysis(
         
         # Add required arguments
         output_dir = str(pathlib.Path(output_path).parent)
-        log.warning(f"output_dir: {output_dir}")
-        log.warning(f"output_path: {output_path}")
+        log.debug(f"output_dir: {output_dir}, output_path: {output_path}")
         cmd.extend([
             "--output-dir", output_dir,
             "--socket-mode", output_path,
@@ -197,6 +214,12 @@ def run_reachability_analysis(
         if enable_debug:
             cmd.append("-d")
 
+        if reach_debug:
+            cmd.append("--debug")
+
+        if disable_external_tool_checks:
+            cmd.append("--disable-external-tool-checks")
+
         if use_only_pregenerated_sboms:
             cmd.append("--use-only-pregenerated-sboms")
 
@@ -222,14 +245,25 @@ def run_reachability_analysis(
         # Required environment variables for Coana CLI
         env["SOCKET_ORG_SLUG"] = org_slug
         env["SOCKET_CLI_API_TOKEN"] = self.api_token
-        
-        # Optional environment variables
+
+        # Identify the calling CLI to the coana tool / backend (parity with the Node CLI).
+        env["SOCKET_CLI_VERSION"] = __version__
+        env["SOCKET_CALLER_USER_AGENT"] = _build_caller_user_agent()
+
+        # NOTE: no proxy env is set here. coana already reads HTTPS_PROXY/HTTP_PROXY itself, and
+        # we pass the full parent env above, so it inherits them. A SOCKET_CLI_API_PROXY override
+        # should only be set from an explicit --proxy flag (not yet implemented), since seeding it
+        # from HTTPS_PROXY would be a no-op (it's the same value coana already resolves).
+
+        # Optional environment variables.
+        # NOTE: repo/branch are intentionally omitted by the caller (passed as None) when they
+        # are the default sentinels, to avoid polluting coana's per-repo/branch cache buckets.
         if repo_name:
             env["SOCKET_REPO_NAME"] = repo_name
-        
+
         if branch_name:
             env["SOCKET_BRANCH_NAME"] = branch_name
-        
+
         # Set NODE_TLS_REJECT_UNAUTHORIZED=0 if allow_unverified is True
         if allow_unverified:
             env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0"
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 1849239..95a6284 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -95,6 +95,12 @@ def _write_attribution_file(config, payload: dict) -> None:
 
 DEFAULT_API_TIMEOUT = 1200
 
+# Sentinel repo/branch names used when none can be detected from git or supplied via flags.
+# When the repo/branch are these defaults we skip forwarding SOCKET_REPO_NAME/SOCKET_BRANCH_NAME
+# to the coana CLI so unrelated default-named runs don't share reachability cache buckets.
+DEFAULT_REPO_NAME = "socket-default-repo"
+DEFAULT_BRANCH_NAME = "socket-default-branch"
+
 
 def get_api_request_timeout(config: CliConfig) -> int:
     return config.timeout if config.timeout is not None else DEFAULT_API_TIMEOUT
@@ -288,16 +294,21 @@ def main_code():
     except NoSuchPathError:
         raise Exception(f"Unable to find path {config.target_path}")
 
+    # Track whether repo/branch fell back to the default sentinels so reachability can skip
+    # forwarding them as coana cache-bucket keys (computed before any workspace suffixing).
+    repo_defaulted = not config.repo
+    branch_defaulted = not config.branch
+
     if not config.repo:
-        base_repo_name = "socket-default-repo"
+        base_repo_name = DEFAULT_REPO_NAME
         if config.workspace_name:
             config.repo = f"{base_repo_name}-{config.workspace_name}"
         else:
             config.repo = base_repo_name
         log.debug(f"Using default repository name: {config.repo}")
-        
+
     if not config.branch:
-        config.branch = "socket-default-branch"
+        config.branch = DEFAULT_BRANCH_NAME
         log.debug(f"Using default branch name: {config.branch}")
 
     # Calculate the scan paths - combine target_path with sub_paths if provided
@@ -384,8 +395,8 @@ def main_code():
                     enable_analysis_splitting=config.reach_enable_analysis_splitting or False,
                     detailed_analysis_log_file=config.reach_detailed_analysis_log_file or False,
                     lazy_mode=config.reach_lazy_mode or False,
-                    repo_name=config.repo,
-                    branch_name=config.branch,
+                    repo_name=None if repo_defaulted else config.repo,
+                    branch_name=None if branch_defaulted else config.branch,
                     version=config.reach_version,
                     concurrency=config.reach_concurrency,
                     additional_params=config.reach_additional_params,
@@ -396,6 +407,8 @@ def main_code():
                     continue_on_install_errors=config.reach_continue_on_install_errors,
                     continue_on_missing_lock_files=config.reach_continue_on_missing_lock_files,
                     continue_on_no_source_files=config.reach_continue_on_no_source_files,
+                    reach_debug=config.reach_debug,
+                    disable_external_tool_checks=config.reach_disable_external_tool_checks,
                 )
                 
                 log.info("Reachability analysis completed successfully")
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 4666b71..7403005 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -166,6 +166,55 @@ def test_config_file_json_sets_defaults(self, tmp_path):
         assert config.sarif_reachability == "reachable"
 
 
+class TestReachAlignmentFlags:
+    """Tests for the reachability flag/default alignment with the Node CLI."""
+
+    BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+    def test_reach_defaults_are_unset_and_delegated_to_coana(self):
+        """memory-limit/concurrency/timeout are not hardcoded; omitted so coana applies its
+        own defaults (8192 MB / concurrency 1 / 600s), which already match what we'd set."""
+        config = CliConfig.from_args(self.BASE_ARGS + ["--reach"])
+        assert config.reach_analysis_memory_limit is None
+        assert config.reach_concurrency is None
+        assert config.reach_analysis_timeout is None
+
+    def test_reach_node_style_name_aliases(self):
+        """G8: Node-style primary names map to the same dests."""
+        config = CliConfig.from_args(
+            self.BASE_ARGS
+            + ["--reach", "--reach-analysis-timeout", "300", "--reach-analysis-memory-limit", "2048"]
+        )
+        assert config.reach_analysis_timeout == 300
+        assert config.reach_analysis_memory_limit == 2048
+
+    def test_reach_legacy_name_aliases_still_work(self):
+        """G8: pre-alignment names keep working (hidden aliases)."""
+        config = CliConfig.from_args(
+            self.BASE_ARGS + ["--reach", "--reach-timeout", "111", "--reach-memory-limit", "512"]
+        )
+        assert config.reach_analysis_timeout == 111
+        assert config.reach_analysis_memory_limit == 512
+
+    def test_reach_debug_flag(self):
+        """G9: dedicated --reach-debug flag, independent of --enable-debug."""
+        config = CliConfig.from_args(self.BASE_ARGS + ["--reach", "--reach-debug"])
+        assert config.reach_debug is True
+        assert config.enable_debug is False
+
+    def test_reach_disable_external_tool_checks_flag(self):
+        """G1: --reach-disable-external-tool-checks parses to its dest."""
+        config = CliConfig.from_args(
+            self.BASE_ARGS + ["--reach", "--reach-disable-external-tool-checks"]
+        )
+        assert config.reach_disable_external_tool_checks is True
+
+    def test_reach_new_flags_default_false(self):
+        config = CliConfig.from_args(self.BASE_ARGS + ["--reach"])
+        assert config.reach_debug is False
+        assert config.reach_disable_external_tool_checks is False
+
+
 def test_pyproject_requires_python_matches_tomllib_usage():
     pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8"))
     requires_python = pyproject["project"]["requires-python"]
diff --git a/tests/unit/test_reachability.py b/tests/unit/test_reachability.py
new file mode 100644
index 0000000..10b6d54
--- /dev/null
+++ b/tests/unit/test_reachability.py
@@ -0,0 +1,106 @@
+"""Tests for the reachability coana-CLI command/env construction (Node alignment).
+
+These cover the arg-builder and environment wiring in
+``socketsecurity.core.tools.reachability.ReachabilityAnalyzer`` without actually
+invoking npm/npx/coana: ``_ensure_coana_cli_installed`` and ``subprocess.run`` are mocked.
+"""
+from unittest.mock import MagicMock
+
+import pytest
+
+from socketsecurity import __version__
+from socketsecurity.core.tools import reachability
+from socketsecurity.core.tools.reachability import (
+    ReachabilityAnalyzer,
+    _build_caller_user_agent,
+)
+
+
+@pytest.fixture
+def analyzer():
+    return ReachabilityAnalyzer(MagicMock(), "test-api-token")
+
+
+def _run(analyzer, mocker, **kwargs):
+    """Invoke run_reachability_analysis with npm/npx/coana mocked; return (cmd, env)."""
+    mocker.patch.object(analyzer, "_ensure_coana_cli_installed", return_value="@coana-tech/cli")
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value="scan-123")
+    completed = MagicMock()
+    completed.returncode = 0
+    run_mock = mocker.patch.object(reachability.subprocess, "run", return_value=completed)
+
+    analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".", **kwargs)
+
+    cmd = run_mock.call_args.args[0]
+    env = run_mock.call_args.kwargs["env"]
+    return cmd, env
+
+
+def test_build_caller_user_agent_shape():
+    ua = _build_caller_user_agent()
+    parts = ua.split(" ")
+    assert parts[0] == f"socket/{__version__}"
+    assert parts[1].startswith("python/")
+    assert "/" in parts[2]  # platform/arch
+
+
+def test_reach_debug_appends_debug_long_flag(analyzer, mocker):
+    """G9: --reach-debug -> coana --debug; does not emit the global -d."""
+    cmd, _ = _run(analyzer, mocker, reach_debug=True)
+    assert "--debug" in cmd
+    assert "-d" not in cmd
+
+
+def test_enable_debug_still_emits_short_d(analyzer, mocker):
+    """G9: existing global --enable-debug -> -d behavior is unchanged."""
+    cmd, _ = _run(analyzer, mocker, enable_debug=True)
+    assert "-d" in cmd
+    assert "--debug" not in cmd
+
+
+def test_disable_external_tool_checks(analyzer, mocker):
+    """G1: --reach-disable-external-tool-checks -> coana --disable-external-tool-checks."""
+    cmd, _ = _run(analyzer, mocker, disable_external_tool_checks=True)
+    assert "--disable-external-tool-checks" in cmd
+
+    cmd2, _ = _run(analyzer, mocker)
+    assert "--disable-external-tool-checks" not in cmd2
+
+
+def test_concurrency_and_memory_args(analyzer, mocker):
+    """G7: explicit concurrency/memory propagate as coana args."""
+    cmd, _ = _run(analyzer, mocker, concurrency=1, memory_limit=8192)
+    assert "--concurrency" in cmd and cmd[cmd.index("--concurrency") + 1] == "1"
+    assert "--memory-limit" in cmd and cmd[cmd.index("--memory-limit") + 1] == "8192"
+
+
+def test_env_identifies_python_cli(analyzer, mocker):
+    """G5: SOCKET_CLI_VERSION + SOCKET_CALLER_USER_AGENT forwarded to coana."""
+    _, env = _run(analyzer, mocker)
+    assert env["SOCKET_CLI_VERSION"] == __version__
+    assert env["SOCKET_CALLER_USER_AGENT"].startswith("socket/")
+    assert env["SOCKET_ORG_SLUG"] == "my-org"
+    assert env["SOCKET_CLI_API_TOKEN"] == "test-api-token"
+
+
+def test_no_proxy_env_set_by_default(analyzer, mocker, monkeypatch):
+    """coana inherits HTTPS_PROXY/HTTP_PROXY from the passed env; we don't set
+    SOCKET_CLI_API_PROXY ourselves (that's reserved for a future explicit --proxy flag)."""
+    monkeypatch.delenv("SOCKET_CLI_API_PROXY", raising=False)
+    monkeypatch.setenv("HTTPS_PROXY", "http://envproxy:3128")
+    _, env = _run(analyzer, mocker)
+    # Even with HTTPS_PROXY set, we don't copy it into SOCKET_CLI_API_PROXY (coana reads it itself).
+    assert "SOCKET_CLI_API_PROXY" not in env
+
+
+def test_repo_branch_env_present_when_supplied(analyzer, mocker):
+    _, env = _run(analyzer, mocker, repo_name="acme/widget", branch_name="main")
+    assert env["SOCKET_REPO_NAME"] == "acme/widget"
+    assert env["SOCKET_BRANCH_NAME"] == "main"
+
+
+def test_repo_branch_env_absent_when_none(analyzer, mocker):
+    """G6: caller passes None for default sentinels -> env keys omitted (cache hygiene)."""
+    _, env = _run(analyzer, mocker, repo_name=None, branch_name=None)
+    assert "SOCKET_REPO_NAME" not in env
+    assert "SOCKET_BRANCH_NAME" not in env
diff --git a/tests/unit/test_tier1_finalize.py b/tests/unit/test_tier1_finalize.py
new file mode 100644
index 0000000..2577643
--- /dev/null
+++ b/tests/unit/test_tier1_finalize.py
@@ -0,0 +1,70 @@
+"""Tests for tier1 reachability finalize retry/backoff (G11, Node parity)."""
+import json
+from unittest.mock import MagicMock
+
+import pytest
+
+from socketsecurity.core import TIER1_FINALIZE_MAX_ATTEMPTS, Core
+
+
+@pytest.fixture
+def core_with_mock_sdk():
+    # Build a Core without running org setup; we only exercise finalize_tier1_scan.
+    core = Core.__new__(Core)
+    core.sdk = MagicMock()
+    return core
+
+
+@pytest.fixture
+def facts_file(tmp_path):
+    path = tmp_path / ".socket.facts.json"
+    path.write_text(json.dumps({"tier1ReachabilityScanId": "tier1-abc"}), encoding="utf-8")
+    return str(path)
+
+
+@pytest.fixture(autouse=True)
+def no_sleep(mocker):
+    return mocker.patch("socketsecurity.core.time.sleep")
+
+
+def test_finalize_succeeds_first_try(core_with_mock_sdk, facts_file, no_sleep):
+    core_with_mock_sdk.sdk.fullscans.finalize_tier1.return_value = True
+
+    assert core_with_mock_sdk.finalize_tier1_scan("full-1", facts_file) is True
+    assert core_with_mock_sdk.sdk.fullscans.finalize_tier1.call_count == 1
+    no_sleep.assert_not_called()
+
+
+def test_finalize_retries_then_succeeds(core_with_mock_sdk, facts_file, no_sleep):
+    core_with_mock_sdk.sdk.fullscans.finalize_tier1.side_effect = [
+        Exception("transient"),
+        Exception("transient"),
+        True,
+    ]
+
+    assert core_with_mock_sdk.finalize_tier1_scan("full-1", facts_file) is True
+    assert core_with_mock_sdk.sdk.fullscans.finalize_tier1.call_count == 3
+    assert no_sleep.call_count == 2  # backoff between the 3 attempts
+
+
+def test_finalize_exhausts_on_persistent_exception(core_with_mock_sdk, facts_file, no_sleep):
+    core_with_mock_sdk.sdk.fullscans.finalize_tier1.side_effect = Exception("down")
+
+    # Never raises; returns False after exhausting attempts.
+    assert core_with_mock_sdk.finalize_tier1_scan("full-1", facts_file) is False
+    assert core_with_mock_sdk.sdk.fullscans.finalize_tier1.call_count == TIER1_FINALIZE_MAX_ATTEMPTS
+
+
+def test_finalize_exhausts_on_persistent_falsy(core_with_mock_sdk, facts_file, no_sleep):
+    core_with_mock_sdk.sdk.fullscans.finalize_tier1.return_value = False
+
+    assert core_with_mock_sdk.finalize_tier1_scan("full-1", facts_file) is False
+    assert core_with_mock_sdk.sdk.fullscans.finalize_tier1.call_count == TIER1_FINALIZE_MAX_ATTEMPTS
+
+
+def test_finalize_returns_false_when_no_scan_id(core_with_mock_sdk, tmp_path):
+    path = tmp_path / ".socket.facts.json"
+    path.write_text(json.dumps({"components": []}), encoding="utf-8")
+
+    assert core_with_mock_sdk.finalize_tier1_scan("full-1", str(path)) is False
+    core_with_mock_sdk.sdk.fullscans.finalize_tier1.assert_not_called()
diff --git a/uv.lock b/uv.lock
index 06d1578..599ee37 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1270,7 +1270,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.1"
+version = "2.4.2"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 80741b7c18f52262a978b76d8411f6872303382c Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Wed, 3 Jun 2026 19:21:48 +0200
Subject: [PATCH 58/80] feat(reach): add unified --exclude-paths, deprecate
 --reach-exclude-paths (#227)

Add a single --exclude-paths flag (Node CLI parity) that filters BOTH SCA manifest
discovery and reachability analysis:

- New Core matcher: anchored micromatch-style globs compiled to regex (no new deps).
  Scan-root-relative POSIX paths, '*' does not cross '/', '**' does, each pattern P
  expanded to [P, P/**]. Threaded into find_files via cli_config; no-op when unset.
- Reach side unions --exclude-paths with the now-deprecated --reach-exclude-paths and
  forwards to coana --exclude-dirs.
- Validation mirrors Node's assertValidExcludePaths (rejects negation, absolute paths,
  '..' traversal, degenerate match-everything; trailing slash stripped so '**/' is rejected).
  Accepts comma-strings and config-file lists.
- --reach-exclude-paths soft-deprecated: still works, [DEPRECATED] in help, warns at runtime.

Docs: document --exclude-paths under 'Path and File' (it affects every scan, not just
reach), mark --reach-exclude-paths deprecated, and refresh the reachability flag table
(--reach-analysis-timeout/-memory-limit primary names, --reach-debug,
--reach-disable-external-tool-checks, defaults delegated to coana).

Adds a CHANGELOG 2.4.3 entry and tests incl. the Node parity cases, validation, and config-file paths.
---
 CHANGELOG.md                     |  14 +++
 docs/cli-reference.md            |  21 ++--
 pyproject.toml                   |   2 +-
 socketsecurity/__init__.py       |   2 +-
 socketsecurity/config.py         |  68 +++++++++++-
 socketsecurity/core/__init__.py  |  83 ++++++++++++++-
 socketsecurity/socketcli.py      |  10 +-
 tests/unit/test_exclude_paths.py | 177 +++++++++++++++++++++++++++++++
 uv.lock                          |   2 +-
 9 files changed, 363 insertions(+), 16 deletions(-)
 create mode 100644 tests/unit/test_exclude_paths.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f47b76d..10c81c0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## 2.4.3
+
+### Added: unified `--exclude-paths` for manifest discovery and reachability
+
+- New `--exclude-paths` flag (comma-separated globs) that excludes matching paths from
+  BOTH SCA manifest discovery and reachability analysis. Patterns are scan-root-relative
+  anchored globs (`*` does not cross `/`, `**` does), matching the Node CLI's behavior.
+- Pattern validation rejects unsupported forms (negation, absolute paths, `..` traversal,
+  and match-everything patterns). Patterns may be supplied on the CLI as a comma-separated
+  string or via a `--config` file list.
+- `--reach-exclude-paths` is now deprecated in favor of `--exclude-paths`. It still works
+  (and is unioned into the Coana `--exclude-dirs` argument) but is marked deprecated in
+  `--help` and warns at runtime.
+
 ## 2.4.2
 
 ### Added: reachability flag and Coana environment alignment with the Node CLI
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index c26c3a4..215ec0a 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -148,14 +148,14 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
-          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
+          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
           [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-scope {diff,full}] [--sarif-grouping {instance,alert}] [--sarif-reachability {all,reachable,potentially,reachable-or-potentially}] [--enable-gitlab-security] [--gitlab-security-file <path>]
           [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
           [--ignore-commit-files] [--disable-blocking] [--disable-ignore] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
-          [--reach] [--reach-version REACH_VERSION] [--reach-timeout REACH_ANALYSIS_TIMEOUT]
-          [--reach-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-ecosystems REACH_ECOSYSTEMS] [--reach-exclude-paths REACH_EXCLUDE_PATHS]
-          [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-output-file REACH_OUTPUT_FILE]
-          [--only-facts-file] [--version]
+          [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
+          [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS]
+          [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-debug] [--reach-disable-external-tool-checks]
+          [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version]
 ````
 
 If you don't want to provide the Socket API Token every time then you can use the environment variable `SOCKET_SECURITY_API_TOKEN`
@@ -203,6 +203,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--sub-path`                  | False    |                       | Sub-path within target-path for manifest file scanning (can be specified multiple times). All sub-paths are combined into a single workspace scan while preserving git context from target-path. Must be used with `--workspace-name` |
 | `--workspace-name`            | False    |                       | Workspace name suffix to append to repository name (repo-name-workspace_name). Must be used with `--sub-path`                                                                     |
 | `--excluded-ecosystems`       | False    | []                    | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
+| `--exclude-paths`             | False    |                       | Comma-separated paths/globs to exclude from **both** manifest discovery (every scan) **and** reachability analysis (e.g. `tests/**,packages/legacy,*.spec.ts`). Patterns are scan-root-relative, case-sensitive globs where `*` does not cross `/` and `**` does. Supersedes `--reach-exclude-paths`. |
 
 #### Branch and Scan Configuration
 | Parameter                | Required | Default | Description                                                                                           |
@@ -239,16 +240,18 @@ If you don't want to provide the Socket API Token every time then you can use th
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code                       |
 | `--reach-version`                  | False    | latest  | Version of @coana-tech/cli to use for analysis                                                                             |
-| `--reach-timeout`                  | False    | 1200    | Timeout in seconds for the reachability analysis (default: 1200 seconds / 20 minutes)                                      |
-| `--reach-memory-limit`             | False    | 4096    | Memory limit in MB for the reachability analysis (default: 4096 MB / 4 GB)                                                 |
-| `--reach-concurrency`              | False    |         | Control parallel analysis execution (must be >= 1)                                                                         |
+| `--reach-analysis-timeout`         | False    | *coana* | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own (currently 600s). Alias: `--reach-timeout` |
+| `--reach-analysis-memory-limit`    | False    | *coana* | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own (currently 8192). Alias: `--reach-memory-limit` |
+| `--reach-concurrency`              | False    | *coana* | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own (currently 1)             |
 | `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
 | `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
-| `--reach-exclude-paths`            | False    |         | Comma-separated list of file paths or patterns to exclude from reachability analysis                                       |
 | `--reach-min-severity`             | False    |         | Minimum severity level for reporting reachability results (low, medium, high, critical)                                    |
 | `--reach-skip-cache`               | False    | False   | Skip cache and force fresh reachability analysis                                                                           |
 | `--reach-disable-analytics`        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
+| `--reach-debug`                    | False    | False   | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug`                         |
+| `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`)                              |
 | `--reach-output-file`              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
+| `--reach-exclude-paths`            | False    |         | **[DEPRECATED — use `--exclude-paths`]** Comma-separated paths to exclude from reachability analysis. Still honored (unioned with `--exclude-paths`) but will be hidden in a future release |
 | `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file to an existing scan (requires --reach and a prior scan)                            |
 
 **Reachability Analysis Requirements:**
diff --git a/pyproject.toml b/pyproject.toml
index d4af492..bcce64f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.2"
+version = "2.4.3"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index e98e031..a93e557 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.2'
+__version__ = '2.4.3'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 58af7e5..3c258a3 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -55,6 +55,50 @@ def load_cli_config_file(config_path: str) -> dict:
         return scoped
     return data
 
+def normalize_exclude_paths(value) -> Optional[List[str]]:
+    """Normalize a --exclude-paths value into a clean list of patterns.
+
+    Accepts a comma-separated string (CLI) or a list/tuple (e.g. a JSON/TOML --config file
+    value), so config-file-supplied patterns flow through the same validation as CLI ones.
+    """
+    if not value:
+        return None
+    if isinstance(value, str):
+        items = value.split(",")
+    elif isinstance(value, (list, tuple)):
+        items = value
+    else:
+        return None
+    cleaned = [str(p).strip() for p in items if str(p).strip()]
+    return cleaned or None
+
+
+def validate_exclude_paths(patterns: List[str]) -> None:
+    """Validate --exclude-paths patterns (mirrors Node's assertValidExcludePaths).
+
+    Patterns are scan-root-relative globs. Reject the cases coana's --exclude-dirs / fast-glob
+    cannot honor: negation, absolute paths, ``..`` traversal, and degenerate match-everything.
+    Exits with code 1 on the first invalid pattern.
+    """
+    # Degenerate match-everything forms, compared against the trailing-slash-stripped pattern
+    # (so "**/" reduces to "**" and is rejected, matching Node's stripTrailingSlash + check).
+    degenerate = {"", ".", "**", "./**", "/**"}
+    for p in patterns:
+        norm = (p or "").strip().replace("\\", "/")
+        if norm.startswith("!"):
+            logging.error(f"--exclude-paths: negation patterns are not supported: {p!r}")
+            exit(1)
+        if norm.startswith("/"):
+            logging.error(f"--exclude-paths: patterns must be scan-root relative (no leading '/'): {p!r}")
+            exit(1)
+        if norm == ".." or norm.startswith("../") or "/../" in norm or norm.endswith("/.."):
+            logging.error(f"--exclude-paths: '..' path traversal is not allowed: {p!r}")
+            exit(1)
+        if norm.rstrip("/") in degenerate:
+            logging.error(f"--exclude-paths: pattern would exclude everything: {p!r}")
+            exit(1)
+
+
 @dataclass
 class PluginConfig:
     enabled: bool = False
@@ -106,6 +150,7 @@ class CliConfig:
     include_module_folders: bool = False
     repo_is_public: bool = False
     excluded_ecosystems: list[str] = field(default_factory=lambda: [])
+    exclude_paths: Optional[List[str]] = None
     version: str = __version__
     jira_plugin: PluginConfig = field(default_factory=PluginConfig)
     slack_plugin: PluginConfig = field(default_factory=PluginConfig)
@@ -167,6 +212,12 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
 
         args = parser.parse_args(args_list)
 
+        if args.reach_exclude_paths:
+            logging.warning(
+                "--reach-exclude-paths is deprecated; use --exclude-paths instead. "
+                "It is still honored and unioned with --exclude-paths."
+            )
+
         # Get API token from env or args (check multiple env var names)
         api_token = (
             os.getenv("SOCKET_SECURITY_API_KEY") or
@@ -258,6 +309,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_lazy_mode': args.reach_lazy_mode,
             'reach_ecosystems': args.reach_ecosystems.split(',') if args.reach_ecosystems else None,
             'reach_exclude_paths': args.reach_exclude_paths.split(',') if args.reach_exclude_paths else None,
+            'exclude_paths': normalize_exclude_paths(args.exclude_paths),
             'reach_skip_cache': args.reach_skip_cache,
             'reach_min_severity': args.reach_min_severity,
             'reach_output_file': args.reach_output_file,
@@ -361,6 +413,10 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--sarif-reachability potentially/reachable-or-potentially requires --sarif-scope full")
             exit(1)
 
+        # Validate --exclude-paths patterns up front (mirrors Node's assertValidExcludePaths).
+        if config_args.get("exclude_paths"):
+            validate_exclude_paths(config_args["exclude_paths"])
+
         # Validate that only_facts_file requires reach
         if args.only_facts_file and not args.reach:
             logging.error("--only-facts-file requires --reach to be specified")
@@ -570,6 +626,15 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="List of ecosystems to exclude from analysis (JSON array string)"
     )
 
+    path_group.add_argument(
+        "--exclude-paths",
+        dest="exclude_paths",
+        metavar="<list>",
+        help="Comma-separated paths/globs to exclude from BOTH manifest discovery and "
+             "reachability analysis (e.g. 'tests/**,packages/legacy,*.spec.ts'). "
+             "Supersedes --reach-exclude-paths."
+    )
+
     # Branch and Scan Configuration
     config_group = parser.add_argument_group('Branch and Scan Configuration')
     config_group.add_argument(
@@ -919,7 +984,8 @@ def create_argument_parser() -> argparse.ArgumentParser:
         "--reach-exclude-paths",
         dest="reach_exclude_paths",
         metavar="<list>",
-        help="Paths to exclude from reachability analysis (comma-separated)"
+        help="[DEPRECATED: use --exclude-paths] Paths to exclude from reachability analysis "
+             "(comma-separated). Still honored and unioned with --exclude-paths."
     )
     reachability_group.add_argument(
         "--reach-min-severity",
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 005dbae..20ff28f 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -213,6 +213,67 @@ def is_excluded(file_path: str, excluded_dirs: Set[str]) -> bool:
                 return True
         return False
 
+    @staticmethod
+    def _exclude_glob_to_regex(pattern: str) -> str:
+        """Translate a micromatch-style glob into an anchored regex string.
+
+        Mirrors the Node CLI's --exclude-paths matcher (src/commands/scan/exclude-paths.mts):
+        patterns are matched against scan-root-relative POSIX paths, case-sensitively, where
+        ``*`` does NOT cross ``/`` and ``**`` DOES. Patterns are anchored at the scan root, so
+        ``tests`` matches ``tests`` (not ``src/tests``); use ``**/tests`` to match at any depth.
+        """
+        i, n = 0, len(pattern)
+        out = ["^"]
+        while i < n:
+            c = pattern[i]
+            if c == "*":
+                if i + 1 < n and pattern[i + 1] == "*":
+                    if i + 2 < n and pattern[i + 2] == "/":
+                        out.append("(?:[^/]+/)*")  # '**/' -> zero or more path segments
+                        i += 3
+                    else:
+                        out.append(".*")           # '**' at end / before non-slash -> any, incl '/'
+                        i += 2
+                else:
+                    out.append("[^/]*")            # '*' -> within a single path segment
+                    i += 1
+            elif c == "?":
+                out.append("[^/]")
+                i += 1
+            else:
+                out.append(re.escape(c))
+                i += 1
+        out.append("$")
+        return "".join(out)
+
+    @staticmethod
+    def compile_exclude_paths(patterns: Optional[List[str]]) -> List["re.Pattern"]:
+        """Compile --exclude-paths globs into anchored regexes (compiled once per scan).
+
+        Each pattern ``P`` is expanded the way Node feeds fast-glob's ``ignore``: ``P`` (a file-
+        or dir-shaped exact match) plus ``P/**`` (its subtree), unless ``P`` already ends with
+        ``/**``. Validation of the patterns happens earlier, in CliConfig.from_args.
+        """
+        compiled: List["re.Pattern"] = []
+        for raw in patterns or []:
+            p = (raw or "").strip().replace("\\", "/").rstrip("/")
+            if not p:
+                continue
+            globs = [p] if p.endswith("/**") else [p, f"{p}/**"]
+            compiled.extend(re.compile(Core._exclude_glob_to_regex(g)) for g in globs)
+        return compiled
+
+    @staticmethod
+    def path_matches_exclude_regexes(rel_path: str, regexes: List["re.Pattern"]) -> bool:
+        rp = rel_path.replace(os.sep, "/").replace("\\", "/")
+        return any(r.match(rp) for r in regexes)
+
+    @staticmethod
+    def matches_exclude_paths(file_path: str, base_path: str, patterns: List[str]) -> bool:
+        """Convenience matcher (compiles patterns per call); used in tests/ad-hoc checks."""
+        rel_path = os.path.relpath(file_path, base_path).replace(os.sep, "/")
+        return Core.path_matches_exclude_regexes(rel_path, Core.compile_exclude_paths(patterns))
+
     def save_submitted_files_list(self, files: List[str], output_path: str) -> None:
         """
         Save the list of submitted file names to a JSON file for debugging.
@@ -336,6 +397,17 @@ def find_files(self, path: str, ecosystems: Optional[List[str]] = None) -> List[
         start_time = time.time()
         files: Set[str] = set()
 
+        # Unified --exclude-paths: filter discovered manifests by the same paths/globs that are
+        # forwarded to coana's --exclude-dirs. Only consulted when the user supplied the flag.
+        # Patterns are anchored to `path` (the scan root this pass walks), matching coana's
+        # target and the Node CLI's fast-glob cwd. NOTE: when scanning multiple --sub-path
+        # targets, find_files runs once per sub-path, so a pattern like `tests` anchors to each
+        # sub-path independently (Node anchors all patterns to a single scan-root cwd). This only
+        # differs for the multi-target full-scan + --exclude-paths combo; the reach flow is
+        # single-target, so it matches Node there.
+        exclude_paths = getattr(self.cli_config, "exclude_paths", None) if self.cli_config else None
+        exclude_regexes = Core.compile_exclude_paths(exclude_paths) if exclude_paths else []
+
         # Get supported patterns from the API
         patterns = self.get_supported_patterns()
 
@@ -365,8 +437,15 @@ def find_files(self, path: str, ecosystems: Optional[List[str]] = None) -> List[
 
                     for glob_file in glob_files:
                         glob_file_str = str(glob_file)
-                        if os.path.isfile(glob_file_str) and not Core.is_excluded(glob_file_str, self.config.excluded_dirs):
-                            files.add(glob_file_str.replace("\\", "/"))
+                        if not os.path.isfile(glob_file_str):
+                            continue
+                        if Core.is_excluded(glob_file_str, self.config.excluded_dirs):
+                            continue
+                        if exclude_regexes:
+                            rel = os.path.relpath(glob_file_str, path)
+                            if Core.path_matches_exclude_regexes(rel, exclude_regexes):
+                                continue
+                        files.add(glob_file_str.replace("\\", "/"))
 
                     glob_end = time.time()
                     log.debug(f"Globbing took {glob_end - glob_start:.4f} seconds")
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 95a6284..1e339ae 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -388,7 +388,15 @@ def main_code():
                     timeout=config.reach_analysis_timeout,
                     memory_limit=config.reach_analysis_memory_limit,
                     ecosystems=config.reach_ecosystems,
-                    exclude_paths=config.reach_exclude_paths,
+                    # Union the deprecated --reach-exclude-paths with the unified --exclude-paths
+                    # and forward verbatim to coana's --exclude-dirs. Patterns are scan-root
+                    # relative; coana resolves --exclude-dirs relative to its `run` target, which
+                    # here is `.` == cwd == scan root, so passthrough is correct. If a nested
+                    # target is ever supported, re-anchor patterns to the target first (see Node's
+                    # pathRelativeToTarget in exclude-paths.mts).
+                    exclude_paths=(
+                        (config.reach_exclude_paths or []) + (config.exclude_paths or [])
+                    ) or None,
                     min_severity=config.reach_min_severity,
                     skip_cache=config.reach_skip_cache or False,
                     disable_analytics=config.reach_disable_analytics or False,
diff --git a/tests/unit/test_exclude_paths.py b/tests/unit/test_exclude_paths.py
new file mode 100644
index 0000000..32271a1
--- /dev/null
+++ b/tests/unit/test_exclude_paths.py
@@ -0,0 +1,177 @@
+"""Tests for the unified --exclude-paths flag (G2, Node alignment).
+
+Covers the path matcher, config parsing + soft-deprecation of --reach-exclude-paths,
+and that --exclude-paths filters SCA manifest discovery via Core.find_files.
+"""
+import logging
+import types
+from unittest.mock import MagicMock
+
+import pytest
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core import Core
+from socketsecurity.core.socket_config import SocketConfig
+
+# ---- matcher -------------------------------------------------------------
+
+@pytest.mark.parametrize(
+    "rel, patterns, expected",
+    [
+        # directory prefix -> the directory's whole subtree
+        ("packages/legacy/package.json", ["packages/legacy"], True),
+        ("packages/keep/package.json", ["packages/legacy"], False),
+        # root-anchored: a bare name matches at the root only, NOT nested
+        ("tests/x.json", ["tests"], True),
+        ("src/tests/x.json", ["tests"], False),
+        # **/ matches at any depth
+        ("src/tests/x.json", ["**/tests"], True),
+        ("tests/unit/x.json", ["tests/**"], True),
+        ("tests", ["tests/**"], False),                # P/** is the subtree, not P itself
+        # '*' does NOT cross '/': anchored basename glob is root-level only
+        ("index.spec.ts", ["*.spec.ts"], True),
+        ("src/app/index.spec.ts", ["*.spec.ts"], False),
+        ("src/app/index.spec.ts", ["**/*.spec.ts"], True),
+        ("src/app/index.ts", ["**/*.spec.ts"], False),
+        # single-star matches exactly one path segment
+        ("packages/a/node_modules/x.json", ["packages/*/node_modules"], True),
+        ("packages/a/b/node_modules/x.json", ["packages/*/node_modules"], False),
+    ],
+)
+def test_matches_exclude_paths(rel, patterns, expected):
+    assert Core.matches_exclude_paths(rel, ".", patterns) is expected
+
+
+@pytest.mark.parametrize(
+    "pattern, excluded, kept",
+    [
+        # Node parity cases (src/commands/scan/exclude-paths.mts), anchored at scan root.
+        ("tests", "tests/pkg/package.json", "src/tests/package.json"),
+        ("package-lock.json", "package-lock.json", "packages/a/package-lock.json"),
+        ("**/node_modules", "packages/a/node_modules/dep/package.json", "src/app/package.json"),
+        ("packages/legacy", "packages/legacy/p.json", "packages/legacy-x/p.json"),
+        ("src/*.json", "src/a.json", "src/sub/a.json"),
+    ],
+)
+def test_matches_exclude_paths_node_parity(pattern, excluded, kept):
+    assert Core.matches_exclude_paths(excluded, ".", [pattern]) is True
+    assert Core.matches_exclude_paths(kept, ".", [pattern]) is False
+
+
+def test_matches_exclude_paths_empty_is_false():
+    assert Core.matches_exclude_paths("a/b.json", ".", []) is False
+    assert Core.matches_exclude_paths("a/b.json", ".", ["  "]) is False
+
+
+# ---- config parsing ------------------------------------------------------
+
+BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+
+def test_exclude_paths_parses_to_list():
+    config = CliConfig.from_args(BASE_ARGS + ["--exclude-paths", "tests/**, packages/legacy , *.spec.ts"])
+    assert config.exclude_paths == ["tests/**", "packages/legacy", "*.spec.ts"]
+
+
+def test_exclude_paths_defaults_none():
+    config = CliConfig.from_args(BASE_ARGS)
+    assert config.exclude_paths is None
+
+
+def test_reach_exclude_paths_still_works_and_warns(caplog):
+    with caplog.at_level(logging.WARNING):
+        config = CliConfig.from_args(BASE_ARGS + ["--reach", "--reach-exclude-paths", "a,b"])
+    assert config.reach_exclude_paths == ["a", "b"]
+    assert any("deprecated" in r.message for r in caplog.records)
+
+
+@pytest.mark.parametrize(
+    "bad",
+    ["!foo", "/abs/path", "..", "../escape", "a/../b", ".", "**", "**/", "/**", "./", "./**"],
+)
+def test_exclude_paths_validation_rejects(bad):
+    with pytest.raises(SystemExit) as exc:
+        CliConfig.from_args(BASE_ARGS + ["--exclude-paths", bad])
+    assert exc.value.code == 1
+
+
+def test_exclude_paths_validation_rejects_within_csv():
+    with pytest.raises(SystemExit) as exc:
+        CliConfig.from_args(BASE_ARGS + ["--exclude-paths", "src,..,tests"])
+    assert exc.value.code == 1
+
+
+def _write_config(tmp_path, value):
+    import json
+    path = tmp_path / "socketcli.json"
+    path.write_text(json.dumps({"socketcli": {"exclude_paths": value}}), encoding="utf-8")
+    return str(path)
+
+
+def test_exclude_paths_from_config_file_list(tmp_path):
+    """A JSON list in --config flows through normalization (not just CSV strings)."""
+    cfg = _write_config(tmp_path, ["tests/**", "packages/legacy"])
+    config = CliConfig.from_args(BASE_ARGS + ["--config", cfg])
+    assert config.exclude_paths == ["tests/**", "packages/legacy"]
+
+
+def test_exclude_paths_from_config_file_string(tmp_path):
+    cfg = _write_config(tmp_path, "tests/**, packages/legacy")
+    config = CliConfig.from_args(BASE_ARGS + ["--config", cfg])
+    assert config.exclude_paths == ["tests/**", "packages/legacy"]
+
+
+def test_exclude_paths_from_config_file_is_validated(tmp_path):
+    """Config-file patterns are validated too (not bypassed)."""
+    cfg = _write_config(tmp_path, ["../escape"])
+    with pytest.raises(SystemExit) as exc:
+        CliConfig.from_args(BASE_ARGS + ["--config", cfg])
+    assert exc.value.code == 1
+
+
+def test_exclude_paths_valid_globs_accepted():
+    config = CliConfig.from_args(BASE_ARGS + ["--exclude-paths", "tests/**,**/*.spec.ts,packages/legacy"])
+    assert config.exclude_paths == ["tests/**", "**/*.spec.ts", "packages/legacy"]
+
+
+# ---- find_files integration ---------------------------------------------
+
+def _make_core(exclude_paths):
+    core = Core.__new__(Core)
+    core.config = SocketConfig(api_key="test-key")
+    core.cli_config = types.SimpleNamespace(exclude_paths=exclude_paths)
+    core.sdk = MagicMock()
+    return core
+
+
+def _seed_manifests(tmp_path):
+    for rel in ("package.json", "sub/package.json", "legacy/package.json"):
+        p = tmp_path / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text("{}", encoding="utf-8")
+
+
+def test_find_files_excludes_matching_paths(tmp_path, mocker):
+    _seed_manifests(tmp_path)
+    core = _make_core(["legacy"])
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"npm": {"package.json": {"pattern": "package.json"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert any(f.endswith("/package.json") and "/legacy/" not in f for f in found)
+    assert not any("/legacy/" in f for f in found)
+
+
+def test_find_files_no_exclude_paths_keeps_all(tmp_path, mocker):
+    _seed_manifests(tmp_path)
+    core = _make_core(None)
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"npm": {"package.json": {"pattern": "package.json"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert any("/legacy/" in f for f in found)
+    assert len(found) == 3
diff --git a/uv.lock b/uv.lock
index 599ee37..561b35f 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1270,7 +1270,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.2"
+version = "2.4.3"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 448d20ce6385f8ef3a7ee90590051d554376b895 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 3 Jun 2026 13:52:05 -0400
Subject: [PATCH 59/80] chore(deps): bump socketdev floor to >=3.2.0 (CE-225)
 (#222)

Pick up socketdev 3.2.0, which adds OTHER = "other" to SocketCategory
so the backend's "other" alert category no longer triggers the
"Unknown SocketCategory" warning fallback (SDK PR #85). No CLI logic
changes. Bump CLI to 2.4.1 (on top of the 2.4.0 license-details fix).

uv.lock regenerated against socketdev 3.2.0.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 CHANGELOG.md               |  9 +++++++++
 pyproject.toml             |  4 ++--
 socketsecurity/__init__.py |  2 +-
 uv.lock                    | 10 +++++-----
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 10c81c0..57d25bb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.4.4
+
+### Changed: Bump required SDK version to `>=3.2.0`
+
+- Picks up `socketdev 3.2.0`, which adds `OTHER = "other"` to `SocketCategory`
+  so the backend's `other` alert category no longer trips the
+  "Unknown SocketCategory" warning fallback (SDK PR #85).
+- No CLI logic changes.
+
 ## 2.4.3
 
 ### Added: unified `--exclude-paths` for manifest discovery and reachability
diff --git a/pyproject.toml b/pyproject.toml
index bcce64f..fdbc17e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.3"
+version = "2.4.4"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.1.2,<4.0.0",
+    "socketdev>=3.2.0,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
     "brotli>=1.0.9; platform_python_implementation == 'CPython'",
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index a93e557..4bda66b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.3'
+__version__ = '2.4.4'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index 561b35f..dde139a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1257,20 +1257,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.1.2"
+version = "3.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/34/3c/974f11a7064d12303049ed46b2a475ff6e65c073c0985558195756d30543/socketdev-3.1.2.tar.gz", hash = "sha256:3dc46258f29f66f8ed84767ab6158237d38a7de4ecb4b28950b4f0bb0d49ff68", size = 178479, upload-time = "2026-06-02T23:33:17.251Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/00/05/0748d1a357a743f968475aecfad4d53ce109ae65fc418d177faecbb25754/socketdev-3.2.0.tar.gz", hash = "sha256:d8743e1a83135f17e8713539c656b4847ada1450315b05e48ec8df1ed984c307", size = 178440, upload-time = "2026-06-03T02:47:26.696Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/51/e9/72a8ccf2c3a20d436616e303b3c51a700e0def781806d361bd0f65ab436b/socketdev-3.1.2-py3-none-any.whl", hash = "sha256:14a4e913fa5c2bbea856820b2ebc9f7c21960c8c42e77a8fd2ae4ef626ba0f49", size = 67225, upload-time = "2026-06-02T23:33:15.714Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/b5/6a3b2bcec759d5d306f416e1b167b985f44f89e990afcd25569a2e591ffd/socketdev-3.2.0-py3-none-any.whl", hash = "sha256:e4b97bdc22ec8e12899f218c8089eaa8e9696f7556930e13f05996ad210718af", size = 67267, upload-time = "2026-06-03T02:47:24.76Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.3"
+version = "2.4.4"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
@@ -1327,7 +1327,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.1.2,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.2.0,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 62beff1cf43ad76c39f80e0ffd22aa5a6634bebc Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Wed, 3 Jun 2026 15:38:11 -0400
Subject: [PATCH 60/80] Harden dependency review checks across PR types (#224)

* ci: report e2e-* checks on fork and Dependabot PRs

The e2e job is skipped on PRs that can't access repository secrets
(forks and Dependabot). Because it's skipped via a job-level `if`, its
matrix never expands, so the required e2e-* check contexts are never
created and branch protection waits on them indefinitely, blocking merge.

Add an e2e-bypass job whose `if` is the exact negation of the e2e job's
run condition. It emits the same e2e-* check names with a passing status
for fork/Dependabot PRs, satisfying branch protection without running the
real tests. The two jobs are mutually exclusive and exhaustive: every PR
runs exactly one.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* ci: add dependency-review-gate aggregator check

The Socket Firewall enterprise smoke job is the most meaningful supply-chain
check for maintainer-added dependencies, but it can't be required directly:
it's conditional (per-manifest, and free-vs-enterprise per author), so on most
PRs it's legitimately skipped -- and a required check whose job is skipped sits
at "Expected -- Waiting for status" forever, blocking merge (the same trap
that stranded Dependabot PRs on the e2e-* checks).

Add a dependency-review-gate job that always runs and collapses every smoke
job into one pass/fail signal: it fails iff any job that ran ended in failure
or was cancelled; success and skipped both pass. This is the single check
intended to be marked required later -- it satisfies Dependabot/fork PRs (which
run Firewall-free) and maintainer PRs (Firewall-enterprise) alike, and turns a
Socket Firewall BLOCK into a merge-blocking failure instead of a non-required
job nobody is forced to run.

Scaffolding only: the gate is not yet added to branch protection's required
checks (deferred until it's merged to main and observed reporting).

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* chore: bump CLI to 2.4.5 and require socketdev>=3.2.1

Follows the 2.4.4 release (SDK >=3.2.0) by picking up socketdev 3.2.1.
Regenerates uv.lock to the published 3.2.1 release; no CLI logic changes.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 .github/workflows/dependency-review.yml | 65 +++++++++++++++++++++++++
 .github/workflows/e2e-test.yml          | 31 ++++++++++++
 CHANGELOG.md                            |  7 +++
 pyproject.toml                          |  4 +-
 socketsecurity/__init__.py              |  2 +-
 uv.lock                                 | 10 ++--
 6 files changed, 111 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 58c3f39..a39694f 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -586,3 +586,68 @@ jobs:
             echo "This PR changes workflow, composite-action, or dependabot config files."
             echo "Require explicit human review before merge."
           } >> "$GITHUB_STEP_SUMMARY"
+
+  # Single required status check that aggregates the conditional smoke jobs
+  # above. Branch protection can't require those jobs individually: each is
+  # conditional (per-manifest, and Firewall-free vs -enterprise per author), so
+  # on any given PR most are legitimately skipped -- and a required check whose
+  # job is skipped sits at "Expected -- Waiting for status to be reported"
+  # forever, blocking merge (the same trap that stranded Dependabot PRs on the
+  # e2e-* checks).
+  #
+  # This gate always runs (if: always(), so it reports even when upstream jobs
+  # are skipped or fail) and collapses them into one pass/fail signal: it FAILS
+  # if any smoke job that ran ended in failure or was cancelled, and passes when
+  # everything either succeeded or was not applicable. 'skipped' is expected and
+  # allowed -- it just means the job didn't apply to this PR.
+  #
+  # Mark THIS check (dependency-review-gate) required in branch protection. It
+  # satisfies Dependabot/fork PRs (which run the Firewall-free job) and
+  # maintainer PRs (which run Firewall-enterprise) alike, and -- crucially -- a
+  # Socket Firewall BLOCK now fails the gate and blocks merge, instead of living
+  # in a non-required enterprise job that nobody is forced to run.
+  dependency-review-gate:
+    needs:
+      - inspect
+      - python-sfw-smoke-free
+      - python-sfw-smoke-enterprise
+      - fixture-npm-sfw-smoke-free
+      - fixture-npm-sfw-smoke-enterprise
+      - fixture-pypi-sfw-smoke-free
+      - fixture-pypi-sfw-smoke-enterprise
+      - dockerfile-smoke
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - name: Verify no smoke job failed
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          echo "Upstream job results:"
+          printf '%s\n' "$RESULTS" | python3 -m json.tool
+
+          # Fail the gate if any needed job ended in failure or was cancelled.
+          # 'success' and 'skipped' both pass: skipped means the job did not
+          # apply to this PR (wrong manifest, or free-vs-enterprise mismatch).
+          failed="$(printf '%s\n' "$RESULTS" | python3 -c "
+          import json, sys
+          data = json.load(sys.stdin)
+          bad = [name for name, info in data.items()
+                 if info.get('result') in ('failure', 'cancelled')]
+          print(' '.join(sorted(bad)))
+          ")"
+
+          if [ -n "$failed" ]; then
+            echo "::error::dependency-review smoke job(s) failed: $failed"
+            {
+              echo "## Dependency Review Gate: FAILED"
+              echo "The following smoke job(s) failed or were cancelled: \`$failed\`"
+              echo "If a Socket Firewall job is listed, it likely BLOCKED an install --"
+              echo "inspect its uploaded sfw-artifacts/ report before merging."
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+
+          echo "All dependency-review smoke jobs passed or were not applicable."
+          echo "## Dependency Review Gate: PASSED" >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/e2e-test.yml b/.github/workflows/e2e-test.yml
index f233115..1dab8a8 100644
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -104,3 +104,34 @@ jobs:
         env:
           SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_CLI_API_TOKEN }}
         run: bash ${{ matrix.validate }}
+
+  # Branch protection requires the e2e-* checks, but the `e2e` job above is
+  # skipped on PRs that can't access repository secrets -- fork PRs and
+  # Dependabot PRs. A job skipped via a job-level `if` never expands its
+  # matrix, so the e2e-* check contexts are never created and the required
+  # checks sit at "Expected -- Waiting for status to be reported" forever,
+  # permanently blocking merge.
+  #
+  # This bypass reports a green status under the SAME e2e-* check names for
+  # exactly those PRs, satisfying branch protection without running the real
+  # tests (which need SOCKET_CLI_API_TOKEN). Its `if` is the precise negation
+  # of the e2e job's run condition, so the two are mutually exclusive: any
+  # given PR runs one or the other, never both, and never neither.
+  #
+  # Dependency-bump risk on these PRs is still covered by dependency-review.yml's
+  # Socket Firewall smoke jobs, which run without repository secrets.
+  e2e-bypass:
+    if: >-
+      github.event_name == 'pull_request' &&
+      (github.event.pull_request.head.repo.full_name != github.repository ||
+        github.event.pull_request.user.login == 'dependabot[bot]')
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name: [scan, sarif, reachability, gitlab, json, pypi]
+    name: e2e-${{ matrix.name }}
+    steps:
+      - name: Report skip status
+        run: |
+          echo "Skipping e2e-${{ matrix.name }} for a PR without repository secrets"
+          echo "(fork or Dependabot). Dependency risk is covered by dependency-review.yml."
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 57d25bb..b2ea93d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.4.5
+
+### Changed: Bump required SDK version to `>=3.2.1`
+
+- Picks up `socketdev 3.2.1`.
+- No CLI logic changes.
+
 ## 2.4.4
 
 ### Changed: Bump required SDK version to `>=3.2.0`
diff --git a/pyproject.toml b/pyproject.toml
index fdbc17e..12955b8 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.4"
+version = "2.4.5"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.2.0,<4.0.0",
+    "socketdev>=3.2.1,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
     "brotli>=1.0.9; platform_python_implementation == 'CPython'",
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 4bda66b..de36ffe 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.4'
+__version__ = '2.4.5'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index dde139a..0a53c6b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1257,20 +1257,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.2.0"
+version = "3.2.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/00/05/0748d1a357a743f968475aecfad4d53ce109ae65fc418d177faecbb25754/socketdev-3.2.0.tar.gz", hash = "sha256:d8743e1a83135f17e8713539c656b4847ada1450315b05e48ec8df1ed984c307", size = 178440, upload-time = "2026-06-03T02:47:26.696Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/21/65/07df2bf6e490c56544fb06e4cfde059b2572fdd5b02ff352c766b1d5f7ce/socketdev-3.2.1.tar.gz", hash = "sha256:7db910a98628473e8ec06822deb01b6bd465b385e9e8ea405f2b7526e8258074", size = 179279, upload-time = "2026-06-03T18:08:19.806Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f2/b5/6a3b2bcec759d5d306f416e1b167b985f44f89e990afcd25569a2e591ffd/socketdev-3.2.0-py3-none-any.whl", hash = "sha256:e4b97bdc22ec8e12899f218c8089eaa8e9696f7556930e13f05996ad210718af", size = 67267, upload-time = "2026-06-03T02:47:24.76Z" },
+    { url = "https://files.pythonhosted.org/packages/53/01/fff70923755b3a187ca971189fb078a2aaedcad42d682abfdd06f3445def/socketdev-3.2.1-py3-none-any.whl", hash = "sha256:6dc762d78baea8011dc22f2afe49c84c926e640a6879bd7b58c3abdd4e29e8bb", size = 67266, upload-time = "2026-06-03T18:08:18.029Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.4"
+version = "2.4.5"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
@@ -1327,7 +1327,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.2.0,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.2.1,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 47dbf42a19c91d86942a7dbfdf5396a606d1bc57 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 3 Jun 2026 17:02:27 -0400
Subject: [PATCH 61/80] chore(deps): bump the python-minor-patch group across 1
 directory with 7 updates (#223)

Bumps the python-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.10` | `3.10.2` |
| [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.3.0` | `1.4.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.14.10` | `0.15.14` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.5.1` | `4.6.0` |
| [hatch](https://github.com/pypa/hatch) | `1.16.2` | `1.16.5` |



Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](https://github.com/psf/requests/compare/v2.33.0...v2.34.2)

Updates `markdown` from 3.10 to 3.10.2
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](https://github.com/Python-Markdown/markdown/compare/3.10.0...3.10.2)

Updates `pytest-cov` from 7.0.0 to 7.1.0
- [Changelog](https://github.com/pytest-dev/pytest-cov/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest-cov/compare/v7.0.0...v7.1.0)

Updates `pytest-asyncio` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](https://github.com/pytest-dev/pytest-asyncio/compare/v1.3.0...v1.4.0)

Updates `ruff` from 0.14.10 to 0.15.14
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](https://github.com/astral-sh/ruff/compare/0.14.10...0.15.14)

Updates `pre-commit` from 4.5.1 to 4.6.0
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pre-commit/pre-commit/compare/v4.5.1...v4.6.0)

Updates `hatch` from 1.16.2 to 1.16.5
- [Release notes](https://github.com/pypa/hatch/releases)
- [Commits](https://github.com/pypa/hatch/compare/hatch-v1.16.2...hatch-v1.16.5)

---
updated-dependencies:
- dependency-name: hatch
  dependency-version: 1.16.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: markdown
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pre-commit
  dependency-version: 4.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pytest-cov
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.15.14
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 uv.lock | 106 ++++++++++++++++++++++++++++++++------------------------
 1 file changed, 60 insertions(+), 46 deletions(-)

diff --git a/uv.lock b/uv.lock
index 0a53c6b..88a9ecc 100644
--- a/uv.lock
+++ b/uv.lock
@@ -556,11 +556,11 @@ wheels = [
 
 [[package]]
 name = "filelock"
-version = "3.20.3"
+version = "3.29.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/1d/65/ce7f1b70157833bf3cb851b556a37d4547ceafc158aa9b34b36782f23696/filelock-3.20.3.tar.gz", hash = "sha256:18c57ee915c7ec61cff0ecf7f0f869936c7c30191bb0cf406f1341778d0834e1", size = 19485, upload-time = "2026-01-09T17:55:05.421Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1f/f9/f38573ed5844586db374d085911740a501ccfa373b455fc9413f09f85237/filelock-3.29.1.tar.gz", hash = "sha256:d97e6b1b9757569626c58caa07dc4beb1613f4a2938b1e8cc81afca398906c9e", size = 59335, upload-time = "2026-06-03T15:19:04.053Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b5/36/7fb70f04bf00bc646cd5bb45aa9eddb15e19437a28b8fb2b4a5249fac770/filelock-3.20.3-py3-none-any.whl", hash = "sha256:4b0dda527ee31078689fc205ec4f1c1bf7d56cf88b6dc9426c4f230e46c2dce1", size = 16701, upload-time = "2026-01-09T17:55:04.334Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/a0/614c5fe402fd88951df45f4dda2fa3b4e17a99ecd92340771929169b3b95/filelock-3.29.1-py3-none-any.whl", hash = "sha256:85199dfd706869641b72b2e8955d5416a4b2b7dc4b0e8e6d97b4cc1299a6983b", size = 40750, upload-time = "2026-06-03T15:19:02.959Z" },
 ]
 
 [[package]]
@@ -598,7 +598,7 @@ wheels = [
 
 [[package]]
 name = "hatch"
-version = "1.16.2"
+version = "1.16.5"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "backports-zstd", marker = "python_full_version < '3.14'" },
@@ -611,6 +611,7 @@ dependencies = [
     { name = "pexpect" },
     { name = "platformdirs" },
     { name = "pyproject-hooks" },
+    { name = "python-discovery" },
     { name = "rich" },
     { name = "shellingham" },
     { name = "tomli-w" },
@@ -619,9 +620,9 @@ dependencies = [
     { name = "uv" },
     { name = "virtualenv" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/b9/c1/8598996a6f264d430c530799dc65fb13942fb29092e35505039a5f2fb5dc/hatch-1.16.2.tar.gz", hash = "sha256:f288938da85b4b90e47d94788e19e9976dcd6fd53b48343ea251a2a37256a980", size = 5216569, upload-time = "2025-12-06T19:18:12.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d2/02/ce9c4c439fa3f195b21b4b5bb18b44d1076297c86477ef7e3d2de6064ec3/hatch-1.16.5.tar.gz", hash = "sha256:57bdeeaa72577859ce37091a5449583875331c06f9cb6af9077947ad40b3a1de", size = 5220741, upload-time = "2026-02-27T18:45:31.21Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d4/7c/bbed5611b1cd7b0b42b2dadb0721d9ccfa4fa9d03abc05e0f57c85a319c6/hatch-1.16.2-py3-none-any.whl", hash = "sha256:827eaf9813c63119f172b85975c5c27110a2306b07e5304c9d38527b0239052a", size = 140658, upload-time = "2025-12-06T19:18:10.573Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/8a/11ae7e271870f0ad8fa0012e4265982bebe0fdc21766b161fb8b8fc3aefc/hatch-1.16.5-py3-none-any.whl", hash = "sha256:d9b8047f2cd10d3349eb6e8f278ad728a04f91495aace305c257d5c2747188fb", size = 141269, upload-time = "2026-02-27T18:45:29.573Z" },
 ]
 
 [[package]]
@@ -795,11 +796,11 @@ wheels = [
 
 [[package]]
 name = "markdown"
-version = "3.10"
+version = "3.10.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/7d/ab/7dd27d9d863b3376fcf23a5a13cb5d024aed1db46f963f1b5735ae43b3be/markdown-3.10.tar.gz", hash = "sha256:37062d4f2aa4b2b6b32aefb80faa300f82cc790cb949a35b8caede34f2b68c0e", size = 364931, upload-time = "2025-11-03T19:51:15.007Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/2b/f4/69fa6ed85ae003c2378ffa8f6d2e3234662abd02c10d216c0ba96081a238/markdown-3.10.2.tar.gz", hash = "sha256:994d51325d25ad8aa7ce4ebaec003febcce822c3f8c911e3b17c52f7f589f950", size = 368805, upload-time = "2026-02-09T14:57:26.942Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/70/81/54e3ce63502cd085a0c556652a4e1b919c45a446bd1e5300e10c44c8c521/markdown-3.10-py3-none-any.whl", hash = "sha256:b5b99d6951e2e4948d939255596523444c0e677c669700b1d17aa4a8a464cb7c", size = 107678, upload-time = "2025-11-03T19:51:13.887Z" },
+    { url = "https://files.pythonhosted.org/packages/de/1f/77fa3081e4f66ca3576c896ae5d31c3002ac6607f9747d2e3aa49227e464/markdown-3.10.2-py3-none-any.whl", hash = "sha256:e91464b71ae3ee7afd3017d9f358ef0baf158fd9a298db92f1d4761133824c36", size = 108180, upload-time = "2026-02-09T14:57:25.787Z" },
 ]
 
 [[package]]
@@ -933,7 +934,7 @@ wheels = [
 
 [[package]]
 name = "pre-commit"
-version = "4.5.1"
+version = "4.6.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cfgv" },
@@ -942,9 +943,9 @@ dependencies = [
     { name = "pyyaml" },
     { name = "virtualenv" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/40/f1/6d86a29246dfd2e9b6237f0b5823717f60cad94d47ddc26afa916d21f525/pre_commit-4.5.1.tar.gz", hash = "sha256:eb545fcff725875197837263e977ea257a402056661f09dae08e4b149b030a61", size = 198232, upload-time = "2025-12-16T21:14:33.552Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8e/22/2de9408ac81acbb8a7d05d4cc064a152ccf33b3d480ebe0cd292153db239/pre_commit-4.6.0.tar.gz", hash = "sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9", size = 198525, upload-time = "2026-04-21T20:31:41.613Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5d/19/fd3ef348460c80af7bb4669ea7926651d1f95c23ff2df18b9d24bab4f3fa/pre_commit-4.5.1-py2.py3-none-any.whl", hash = "sha256:3b3afd891e97337708c1674210f8eba659b52a38ea5f822ff142d10786221f77", size = 226437, upload-time = "2025-12-16T21:14:32.409Z" },
+    { url = "https://files.pythonhosted.org/packages/80/6e/4b28b62ecb6aae56769c34a8ff1d661473ec1e9519e2d5f8b2c150086b26/pre_commit-4.6.0-py2.py3-none-any.whl", hash = "sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b", size = 226472, upload-time = "2026-04-21T20:31:40.092Z" },
 ]
 
 [[package]]
@@ -1013,29 +1014,29 @@ wheels = [
 
 [[package]]
 name = "pytest-asyncio"
-version = "1.3.0"
+version = "1.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pytest" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/90/2c/8af215c0f776415f3590cac4f9086ccefd6fd463befeae41cd4d3f193e5a/pytest_asyncio-1.3.0.tar.gz", hash = "sha256:d7f52f36d231b80ee124cd216ffb19369aa168fc10095013c6b014a34d3ee9e5", size = 50087, upload-time = "2025-11-10T16:07:47.256Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/7c/d36d04db312ecf4298932ef77e6e4a9e8ad017906e24e34f0b0c361a2473/pytest_asyncio-1.4.0.tar.gz", hash = "sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42", size = 58514, upload-time = "2026-05-26T09:56:04.083Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/35/f8b19922b6a25bc0880171a2f1a003eaeb93657475193ab516fd87cac9da/pytest_asyncio-1.3.0-py3-none-any.whl", hash = "sha256:611e26147c7f77640e6d0a92a38ed17c3e9848063698d5c93d5aa7aa11cebff5", size = 15075, upload-time = "2025-11-10T16:07:45.537Z" },
+    { url = "https://files.pythonhosted.org/packages/03/e2/08a497ef684b88559c9cc5f4ad53a37e7b99e727094a86d6ea32536d5d3c/pytest_asyncio-1.4.0-py3-none-any.whl", hash = "sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1", size = 16930, upload-time = "2026-05-26T09:56:02.576Z" },
 ]
 
 [[package]]
 name = "pytest-cov"
-version = "7.0.0"
+version = "7.1.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "coverage", extra = ["toml"] },
     { name = "pluggy" },
     { name = "pytest" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5e/f7/c933acc76f5208b3b00089573cf6a2bc26dc80a8aece8f52bb7d6b1855ca/pytest_cov-7.0.0.tar.gz", hash = "sha256:33c97eda2e049a0c5298e91f519302a1334c26ac65c1a483d6206fd458361af1", size = 54328, upload-time = "2025-09-09T10:57:02.113Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b1/51/a849f96e117386044471c8ec2bd6cfebacda285da9525c9106aeb28da671/pytest_cov-7.1.0.tar.gz", hash = "sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2", size = 55592, upload-time = "2026-03-21T20:11:16.284Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ee/49/1377b49de7d0c1ce41292161ea0f721913fa8722c19fb9c1e3aa0367eecb/pytest_cov-7.0.0-py3-none-any.whl", hash = "sha256:3b8e9558b16cc1479da72058bdecf8073661c7f57f7d3c5f22a1c23507f2d861", size = 22424, upload-time = "2025-09-09T10:57:00.695Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/7a/d968e294073affff457b041c2be9868a40c1c71f4a35fcc1e45e5493067b/pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678", size = 22876, upload-time = "2026-03-21T20:11:14.438Z" },
 ]
 
 [[package]]
@@ -1062,6 +1063,19 @@ dependencies = [
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/36/47/ab65fc1d682befc318c439940f81a0de1026048479f732e84fe714cd69c0/pytest-watch-4.2.0.tar.gz", hash = "sha256:06136f03d5b361718b8d0d234042f7b2f203910d8568f63df2f866b547b3d4b9", size = 16340, upload-time = "2018-05-20T19:52:16.194Z" }
 
+[[package]]
+name = "python-discovery"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "filelock" },
+    { name = "platformdirs" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a6/12/38c1a0b1e64806780c9563e3fc9f6e472251839662587cfbe9bfaf2ae10a/python_discovery-1.4.0.tar.gz", hash = "sha256:eb8bc7daad3c226c147e45bb4e970a1feb1bf4048ee178e6db59e197b8010ce3", size = 68455, upload-time = "2026-05-28T01:15:37.639Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c8/8d/3d316429f65029532bb1e28ff77b797d86b5ac3915bb44ca4e19aa283d43/python_discovery-1.4.0-py3-none-any.whl", hash = "sha256:26ed78d703e234879a66244c7d4114563fb13ec5cd30a2d1357e5fb4850782da", size = 33217, upload-time = "2026-05-28T01:15:36.573Z" },
+]
+
 [[package]]
 name = "python-dotenv"
 version = "1.2.2"
@@ -1151,7 +1165,7 @@ wheels = [
 
 [[package]]
 name = "requests"
-version = "2.33.0"
+version = "2.34.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -1159,9 +1173,9 @@ dependencies = [
     { name = "idna" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/34/64/8860370b167a9721e8956ae116825caff829224fbca0ca6e7bf8ddef8430/requests-2.33.0.tar.gz", hash = "sha256:c7ebc5e8b0f21837386ad0e1c8fe8b829fa5f544d8df3b2253bff14ef29d7652", size = 134232, upload-time = "2026-03-25T15:10:41.586Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed", size = 142856, upload-time = "2026-05-14T19:25:27.735Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/56/5d/c814546c2333ceea4ba42262d8c4d55763003e767fa169adc693bd524478/requests-2.33.0-py3-none-any.whl", hash = "sha256:3324635456fa185245e24865e810cecec7b4caf933d7eb133dcde67d48cee69b", size = 65017, upload-time = "2026-03-25T15:10:40.382Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0", size = 73075, upload-time = "2026-05-14T19:25:26.443Z" },
 ]
 
 [[package]]
@@ -1200,28 +1214,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.14.10"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/57/08/52232a877978dd8f9cf2aeddce3e611b40a63287dfca29b6b8da791f5e8d/ruff-0.14.10.tar.gz", hash = "sha256:9a2e830f075d1a42cd28420d7809ace390832a490ed0966fe373ba288e77aaf4", size = 5859763, upload-time = "2025-12-18T19:28:57.98Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/60/01/933704d69f3f05ee16ef11406b78881733c186fe14b6a46b05cfcaf6d3b2/ruff-0.14.10-py3-none-linux_armv6l.whl", hash = "sha256:7a3ce585f2ade3e1f29ec1b92df13e3da262178df8c8bdf876f48fa0e8316c49", size = 13527080, upload-time = "2025-12-18T19:29:25.642Z" },
-    { url = "https://files.pythonhosted.org/packages/df/58/a0349197a7dfa603ffb7f5b0470391efa79ddc327c1e29c4851e85b09cc5/ruff-0.14.10-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:674f9be9372907f7257c51f1d4fc902cb7cf014b9980152b802794317941f08f", size = 13797320, upload-time = "2025-12-18T19:29:02.571Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/82/36be59f00a6082e38c23536df4e71cdbc6af8d7c707eade97fcad5c98235/ruff-0.14.10-py3-none-macosx_11_0_arm64.whl", hash = "sha256:d85713d522348837ef9df8efca33ccb8bd6fcfc86a2cde3ccb4bc9d28a18003d", size = 12918434, upload-time = "2025-12-18T19:28:51.202Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/00/45c62a7f7e34da92a25804f813ebe05c88aa9e0c25e5cb5a7d23dd7450e3/ruff-0.14.10-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6987ebe0501ae4f4308d7d24e2d0fe3d7a98430f5adfd0f1fead050a740a3a77", size = 13371961, upload-time = "2025-12-18T19:29:04.991Z" },
-    { url = "https://files.pythonhosted.org/packages/40/31/a5906d60f0405f7e57045a70f2d57084a93ca7425f22e1d66904769d1628/ruff-0.14.10-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:16a01dfb7b9e4eee556fbfd5392806b1b8550c9b4a9f6acd3dbe6812b193c70a", size = 13275629, upload-time = "2025-12-18T19:29:21.381Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/60/61c0087df21894cf9d928dc04bcd4fb10e8b2e8dca7b1a276ba2155b2002/ruff-0.14.10-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:7165d31a925b7a294465fa81be8c12a0e9b60fb02bf177e79067c867e71f8b1f", size = 14029234, upload-time = "2025-12-18T19:29:00.132Z" },
-    { url = "https://files.pythonhosted.org/packages/44/84/77d911bee3b92348b6e5dab5a0c898d87084ea03ac5dc708f46d88407def/ruff-0.14.10-py3-none-manylinux_2_17_ppc64.manylinux2014_ppc64.whl", hash = "sha256:c561695675b972effb0c0a45db233f2c816ff3da8dcfbe7dfc7eed625f218935", size = 15449890, upload-time = "2025-12-18T19:28:53.573Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/36/480206eaefa24a7ec321582dda580443a8f0671fdbf6b1c80e9c3e93a16a/ruff-0.14.10-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4bb98fcbbc61725968893682fd4df8966a34611239c9fd07a1f6a07e7103d08e", size = 15123172, upload-time = "2025-12-18T19:29:23.453Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/38/68e414156015ba80cef5473d57919d27dfb62ec804b96180bafdeaf0e090/ruff-0.14.10-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f24b47993a9d8cb858429e97bdf8544c78029f09b520af615c1d261bf827001d", size = 14460260, upload-time = "2025-12-18T19:29:27.808Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/19/9e050c0dca8aba824d67cc0db69fb459c28d8cd3f6855b1405b3f29cc91d/ruff-0.14.10-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:59aabd2e2c4fd614d2862e7939c34a532c04f1084476d6833dddef4afab87e9f", size = 14229978, upload-time = "2025-12-18T19:29:11.32Z" },
-    { url = "https://files.pythonhosted.org/packages/51/eb/e8dd1dd6e05b9e695aa9dd420f4577debdd0f87a5ff2fedda33c09e9be8c/ruff-0.14.10-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:213db2b2e44be8625002dbea33bb9c60c66ea2c07c084a00d55732689d697a7f", size = 14338036, upload-time = "2025-12-18T19:29:09.184Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/12/f3e3a505db7c19303b70af370d137795fcfec136d670d5de5391e295c134/ruff-0.14.10-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:b914c40ab64865a17a9a5b67911d14df72346a634527240039eb3bd650e5979d", size = 13264051, upload-time = "2025-12-18T19:29:13.431Z" },
-    { url = "https://files.pythonhosted.org/packages/08/64/8c3a47eaccfef8ac20e0484e68e0772013eb85802f8a9f7603ca751eb166/ruff-0.14.10-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:1484983559f026788e3a5c07c81ef7d1e97c1c78ed03041a18f75df104c45405", size = 13283998, upload-time = "2025-12-18T19:29:06.994Z" },
-    { url = "https://files.pythonhosted.org/packages/12/84/534a5506f4074e5cc0529e5cd96cfc01bb480e460c7edf5af70d2bcae55e/ruff-0.14.10-py3-none-musllinux_1_2_i686.whl", hash = "sha256:c70427132db492d25f982fffc8d6c7535cc2fd2c83fc8888f05caaa248521e60", size = 13601891, upload-time = "2025-12-18T19:28:55.811Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/1e/14c916087d8598917dbad9b2921d340f7884824ad6e9c55de948a93b106d/ruff-0.14.10-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:5bcf45b681e9f1ee6445d317ce1fa9d6cba9a6049542d1c3d5b5958986be8830", size = 14336660, upload-time = "2025-12-18T19:29:16.531Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/1c/d7b67ab43f30013b47c12b42d1acd354c195351a3f7a1d67f59e54227ede/ruff-0.14.10-py3-none-win32.whl", hash = "sha256:104c49fc7ab73f3f3a758039adea978869a918f31b73280db175b43a2d9b51d6", size = 13196187, upload-time = "2025-12-18T19:29:19.006Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/9c/896c862e13886fae2af961bef3e6312db9ebc6adc2b156fe95e615dee8c1/ruff-0.14.10-py3-none-win_amd64.whl", hash = "sha256:466297bd73638c6bdf06485683e812db1c00c7ac96d4ddd0294a338c62fdc154", size = 14661283, upload-time = "2025-12-18T19:29:30.16Z" },
-    { url = "https://files.pythonhosted.org/packages/74/31/b0e29d572670dca3674eeee78e418f20bdf97fa8aa9ea71380885e175ca0/ruff-0.14.10-py3-none-win_arm64.whl", hash = "sha256:e51d046cf6dda98a4633b8a8a771451107413b0f07183b2bef03f075599e44e6", size = 13729839, upload-time = "2025-12-18T19:28:48.636Z" },
+version = "0.15.14"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/dc/8a/8bce2894573e9dae6ff4d77fe34ad727d79b9e6238ad288c5638990d90f6/ruff-0.15.14.tar.gz", hash = "sha256:48e866b165be4a9bdbf310f7d3c9a07edef2fe8cd63ffeb4e00bb590506ebf9f", size = 4700910, upload-time = "2026-05-21T14:34:55.177Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b9/c8/74a92c6ff9fcfb4f1f947126d3ebee8389276e161ecc85de5bda7cda51bd/ruff-0.15.14-py3-none-linux_armv6l.whl", hash = "sha256:8dd2db9416e487c8d4b01fa7056bb02c4d05969d4f8d17a08c229c2f4ff3c108", size = 10739177, upload-time = "2026-05-21T14:34:37.332Z" },
+    { url = "https://files.pythonhosted.org/packages/45/91/254a35c20acc38a7223c9d2d594af12e794432464f2cdeb52af1dc4a892d/ruff-0.15.14-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:be4ff55af755bd71a00ab3dc6bd7ffc467bd76e0df6881e286c2e3d23e8fb43b", size = 11144969, upload-time = "2026-05-21T14:34:43.978Z" },
+    { url = "https://files.pythonhosted.org/packages/56/9e/d13e40f83b8d0a94430e6778ce1d94a43b38cf2efe63278bdd2b4c65abbf/ruff-0.15.14-py3-none-macosx_11_0_arm64.whl", hash = "sha256:48d5909d7d06276ce7dde6d32bfa4b0d4cb2651145cd8ee4b440722cbc77832f", size = 10478207, upload-time = "2026-05-21T14:34:48.378Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/f1/b15a7839fa4f332f8acec78e20564f26bb2d866e3d21710b877fd0263000/ruff-0.15.14-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca8cbfa94c4f90984a67561978602746d4cd27103568f745fa90eee3f0d4107d", size = 10818459, upload-time = "2026-05-21T14:34:22.318Z" },
+    { url = "https://files.pythonhosted.org/packages/45/33/53d651177f84f94b400a0e27f8824eeada3dddc9d5ee8aeb048f4352a520/ruff-0.15.14-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:9a6bbc0333f1ab053423bcbf6226477d266ca7cec7738c4c8e3f55647803f3c4", size = 10541800, upload-time = "2026-05-21T14:34:20.209Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/a6/868f87e0bf9786ed24b5d0d0ad8676b8a94fd1912f42cddf9cfc7857818a/ruff-0.15.14-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8a24a4f7605d7003a6674d4387651effd939dead3fddd0f36561eb77a9a2e542", size = 11342149, upload-time = "2026-05-21T14:34:46.365Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/8b/38cd5c19faffdcc05a408d2b78edccc69492ab9720eadb49ea15ef80d768/ruff-0.15.14-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:049b5326e53ed80978f2fc041a280603f69dd6b0c95464342a2bb4572d9d9e2f", size = 12212563, upload-time = "2026-05-21T14:34:28.579Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/4d/a3c5b874a556d5731e3e657aaf04311bb76f0a5c3ec220ed43051be6b64b/ruff-0.15.14-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d4ed42e6696c8dfa5f06728e6441993901f548eb92d73bc472cb5a38d1395fbf", size = 11493299, upload-time = "2026-05-21T14:34:41.836Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/c0/56472c251d09858a53e51efbd485b09e1995d8731668b76d52e5dd6ee0f1/ruff-0.15.14-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:715c543cf450c4888251f91c52f1942a800541d9bddd7ac060aa4e6b77ae7cba", size = 11455931, upload-time = "2026-05-21T14:34:57.276Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/4a/e2e7b4d8dbf233d4eace59c75bc3435fa6d8bd3bae82d351d4e4300c0fd1/ruff-0.15.14-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:72ebab6013ec887d439d8b7593737a0a4ffb06d45d209d4e4bf2e92813082d3f", size = 11400794, upload-time = "2026-05-21T14:34:39.773Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c7/83c0539fe34c3e09136204d1e75d6052492364e0b3cb05e9465423f567d7/ruff-0.15.14-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:49072d36abdbe97a8dd7f480afe9c675699c0c495d4c84076e2c1203c4550581", size = 10804759, upload-time = "2026-05-21T14:34:31.045Z" },
+    { url = "https://files.pythonhosted.org/packages/86/a6/18f2bfc095a2ab4a78745644e428205532ce6653a5d0fa8501572891534d/ruff-0.15.14-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:958522aee105068640c2c2ceae08f413ae44d922f52a1374ac13d6a96032fc93", size = 10539517, upload-time = "2026-05-21T14:34:53.064Z" },
+    { url = "https://files.pythonhosted.org/packages/54/3a/5a8b3b69c654d4e4bf1d246ac5b49cbcdac6eaab6905925f8915f31e3b80/ruff-0.15.14-py3-none-musllinux_1_2_i686.whl", hash = "sha256:f3707da619a143a2e8830e2abab8224478d69ace2d28cb6c20543ae97c36bf61", size = 11065169, upload-time = "2026-05-21T14:34:24.484Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/c5/8864e4e7925b836ea354b31d57641ec03830564e281a8b6f061f8c3e0ec1/ruff-0.15.14-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:bb01d645694e3ec0102105d07ef2d53703970407d59c04e59d3ba0b7a1d53553", size = 11560214, upload-time = "2026-05-21T14:34:50.975Z" },
+    { url = "https://files.pythonhosted.org/packages/36/38/012bf76752e1f89ed50b77b99532d90f3a3e287bc7918e1fc0948ac866ac/ruff-0.15.14-py3-none-win32.whl", hash = "sha256:6d0c1ad2a0ab718d39b6d8fd2217981ce4d625cd96a720095f798fb47d8b13e6", size = 10805548, upload-time = "2026-05-21T14:34:33.453Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/b7/4ea2c170f10ad760fff2a5250beb18897719dc8b52b53a24cddbb9dd3f19/ruff-0.15.14-py3-none-win_amd64.whl", hash = "sha256:802342981e056db3851a7836e5b070f8f15f67d4a685ae2a6160939d364b2902", size = 11939523, upload-time = "2026-05-21T14:34:18.077Z" },
+    { url = "https://files.pythonhosted.org/packages/62/d5/bc97ff895ec35cf3925d4bd60f3b39d822f377a446906ec9bcc87405e59b/ruff-0.15.14-py3-none-win_arm64.whl", hash = "sha256:ff47b90a9ef6a40c9e2f3b479c1fb78531adf055b94c1eba0a7ba04b31951826", size = 11208607, upload-time = "2026-05-21T14:34:26.525Z" },
 ]
 
 [[package]]
@@ -1499,16 +1512,17 @@ wheels = [
 
 [[package]]
 name = "virtualenv"
-version = "20.36.1"
+version = "21.4.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "distlib" },
     { name = "filelock" },
     { name = "platformdirs" },
+    { name = "python-discovery" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/aa/a3/4d310fa5f00863544e1d0f4de93bddec248499ccf97d4791bc3122c9d4f3/virtualenv-20.36.1.tar.gz", hash = "sha256:8befb5c81842c641f8ee658481e42641c68b5eab3521d8e092d18320902466ba", size = 6032239, upload-time = "2026-01-09T18:21:01.296Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/0d/4e93c8e6d1001a75763f87d8f5ecda8ebc7f4aa2153dddfaf4ae8892821a/virtualenv-21.4.2.tar.gz", hash = "sha256:38e6ee0a555615c0ea9da2ac7e9998fe8dc3b911dd33ad8eaad2020957653b0c", size = 7613326, upload-time = "2026-05-31T17:01:22.827Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/6a/2a/dc2228b2888f51192c7dc766106cd475f1b768c10caaf9727659726f7391/virtualenv-20.36.1-py3-none-any.whl", hash = "sha256:575a8d6b124ef88f6f51d56d656132389f961062a9177016a50e4f507bbcc19f", size = 6008258, upload-time = "2026-01-09T18:20:59.425Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/c4/557dc082be035381b85fdb2b74e21d3d21b57750b74f2b47a32f3a639ff9/virtualenv-21.4.2-py3-none-any.whl", hash = "sha256:854210ca524a1a4d0d744734f4acbc721c3ffe163b85bbf5d56d14d5ae2f0fae", size = 7594079, upload-time = "2026-05-31T17:01:20.735Z" },
 ]
 
 [[package]]

From 1e8d0eb3faba5dcd8e11221ce7f83cbc58eae79e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 3 Jun 2026 17:25:32 -0400
Subject: [PATCH 62/80] chore(deps): bump packaging in the python-major group
 across 1 directory (#215)

Bumps the python-major group with 1 update in the / directory: [packaging](https://github.com/pypa/packaging).


Updates `packaging` from 25.0 to 26.2
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pypa/packaging/compare/25.0...26.2)

---
updated-dependencies:
- dependency-name: packaging
  dependency-version: '26.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: lelia <2418071+lelia@users.noreply.github.com>
---
 uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/uv.lock b/uv.lock
index 88a9ecc..67ea3b6 100644
--- a/uv.lock
+++ b/uv.lock
@@ -886,11 +886,11 @@ wheels = [
 
 [[package]]
 name = "packaging"
-version = "25.0"
+version = "26.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a1/d4/1fc4078c65507b51b96ca8f8c3ba19e6a61c8253c72794544580a7b6c24d/packaging-25.0.tar.gz", hash = "sha256:d443872c98d677bf60f6a1f2f8c1cb748e8fe762d2bf9d3148b5599295b0fc4f", size = 165727, upload-time = "2025-04-19T11:48:59.673Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/20/12/38679034af332785aac8774540895e234f4d07f7545804097de4b666afd8/packaging-25.0-py3-none-any.whl", hash = "sha256:29572ef2b1f17581046b3a2227d5c611fb25ec70ca1ba8554b24b0e69331a484", size = 66469, upload-time = "2025-04-19T11:48:57.875Z" },
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
 ]
 
 [[package]]

From 405fdc9a320f962221e2465b358cc94c43dc3aa4 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Thu, 4 Jun 2026 09:06:49 +0200
Subject: [PATCH 63/80] docs: correct remaining reachability reference gaps
 (#228)

Reachability-reference fixes layered on current main (v2.4.5):

- Document the uv + Enterprise-plan prerequisites the CLI enforces before
  running reachability (exit 3), and that per-ecosystem build toolchains are
  the analysis engine's runtime check, not a CLI pre-check.
- Correct --reach-min-severity values to info/low/moderate/high/critical.
- Document --reach-enable-analysis-splitting, --reach-detailed-analysis-log-file,
  --reach-lazy-mode, --reach-use-only-pregenerated-sboms.
- Clarify --only-facts-file submits only the facts file when creating the full
  scan (no pre-existing scan required).
- Note --reach creates a tier-1 full-application scan (scan_type=socket_tier1).

Docs-only; the version bump + uv.lock are mandated by the sync-version hook.
---
 CHANGELOG.md               | 15 +++++++++++++++
 docs/cli-reference.md      | 25 ++++++++++++++++++-------
 pyproject.toml             |  2 +-
 socketsecurity/__init__.py |  2 +-
 uv.lock                    |  2 +-
 5 files changed, 36 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2ea93d..b2f759c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.4.6
+
+### Docs: reachability reference corrections
+
+- Documented the `uv` and Enterprise-plan prerequisites the CLI enforces **before** running
+  reachability (exit code 3 if unmet), and clarified that per-ecosystem build toolchains
+  (JDK / .NET / Go / a compatible Python interpreter) are checked by the analysis engine at
+  runtime, not pre-checked by the CLI.
+- Corrected the `--reach-min-severity` values to `info, low, moderate, high, critical`.
+- Documented the previously-undocumented reachability flags: `--reach-enable-analysis-splitting`,
+  `--reach-detailed-analysis-log-file`, `--reach-lazy-mode`, and `--reach-use-only-pregenerated-sboms`.
+- Clarified that `--only-facts-file` submits only the facts file when **creating** the full scan
+  (it does not require a pre-existing scan).
+- Documentation-only; no functional code changes.
+
 ## 2.4.5
 
 ### Changed: Bump required SDK version to `>=3.2.1`
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 215ec0a..cdbf003 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -154,7 +154,8 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--ignore-commit-files] [--disable-blocking] [--disable-ignore] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
           [--reach] [--reach-version REACH_VERSION] [--reach-analysis-timeout REACH_ANALYSIS_TIMEOUT]
           [--reach-analysis-memory-limit REACH_ANALYSIS_MEMORY_LIMIT] [--reach-concurrency REACH_CONCURRENCY] [--reach-ecosystems REACH_ECOSYSTEMS]
-          [--reach-min-severity {low,medium,high,critical}] [--reach-skip-cache] [--reach-disable-analytics] [--reach-debug] [--reach-disable-external-tool-checks]
+          [--reach-min-severity <level>] [--reach-skip-cache] [--reach-disable-analytics] [--reach-enable-analysis-splitting] [--reach-detailed-analysis-log-file]
+          [--reach-lazy-mode] [--reach-use-only-pregenerated-sboms] [--reach-debug] [--reach-disable-external-tool-checks]
           [--reach-output-file REACH_OUTPUT_FILE] [--only-facts-file] [--version]
 ````
 
@@ -238,25 +239,35 @@ If you don't want to provide the Socket API Token every time then you can use th
 #### Reachability Analysis
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
-| `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code                       |
+| `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a tier-1 full-application reachability scan (`scan_type=socket_tier1`). |
 | `--reach-version`                  | False    | latest  | Version of @coana-tech/cli to use for analysis                                                                             |
 | `--reach-analysis-timeout`         | False    | *coana* | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own (currently 600s). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | *coana* | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own (currently 8192). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | *coana* | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own (currently 1)             |
 | `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
 | `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
-| `--reach-min-severity`             | False    |         | Minimum severity level for reporting reachability results (low, medium, high, critical)                                    |
+| `--reach-min-severity`             | False    |         | Minimum severity level for reporting reachability results (info, low, moderate, high, critical)                            |
 | `--reach-skip-cache`               | False    | False   | Skip cache and force fresh reachability analysis                                                                           |
 | `--reach-disable-analytics`        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
+| `--reach-enable-analysis-splitting` | False   | False   | Enable analysis splitting/bucketing (a legacy performance feature). Splitting is disabled by default.                      |
+| `--reach-detailed-analysis-log-file` | False  | False   | Write a detailed analysis log file; its path is printed to stdout                                                          |
+| `--reach-lazy-mode`                | False    | False   | Enable lazy mode (experimental performance feature)                                                                        |
+| `--reach-use-only-pregenerated-sboms` | False | False   | Build the scan only from pre-generated CycloneDX (CDX) and SPDX files in your project (requires --reach)                    |
 | `--reach-debug`                    | False    | False   | Enable coana debug output (`--debug`) for the analysis, independent of the global `--enable-debug`                         |
 | `--reach-disable-external-tool-checks` | False | False | Disable coana's external tool availability checks (passes `--disable-external-tool-checks`)                              |
 | `--reach-output-file`              | False    | .socket.facts.json | Path where reachability analysis results should be saved                                                        |
 | `--reach-exclude-paths`            | False    |         | **[DEPRECATED — use `--exclude-paths`]** Comma-separated paths to exclude from reachability analysis. Still honored (unioned with `--exclude-paths`) but will be hidden in a future release |
-| `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file to an existing scan (requires --reach and a prior scan)                            |
+| `--only-facts-file`                | False    | False   | Submit only the .socket.facts.json file when creating the full scan (requires --reach)                                     |
 
 **Reachability Analysis Requirements:**
-- `npm` - Required to install and run @coana-tech/cli
-- `npx` - Required to execute @coana-tech/cli
+
+The Python CLI verifies the following **up front** (before invoking the analysis engine) and exits with code **3** if any are unmet:
+- `npm` - Required to install and run `@coana-tech/cli` (the analysis engine)
+- `npx` - Required to execute `@coana-tech/cli`
+- `uv` - Required by the analysis engine
+- An **Enterprise** Socket organization plan (any `enterprise*` plan, including Enterprise trials)
+
+Separately, the analysis engine (coana) needs the **per-ecosystem build toolchain** for whatever languages your project uses — e.g. a compatible Python interpreter (3.11+, or PyPy) for Python, a JDK for Java/Kotlin/Scala, .NET 6+ for C#, the matching Go toolchain for Go, etc. These are validated by the engine **at analysis time** (the CLI does not pre-check them) and that validation can be skipped with `--reach-disable-external-tool-checks`.
 
 ## Config file support
 
@@ -302,7 +313,7 @@ Sample config files:
 
 For CI-specific examples and guidance, see [`ci-cd.md`](ci-cd.md).
 
-The CLI will automatically install `@coana-tech/cli` if not present. Use `--reach` to enable reachability analysis during a full scan, or use `--only-facts-file` with `--reach` to submit reachability results to an existing scan.
+The CLI will automatically install `@coana-tech/cli` if not present. Use `--reach` to enable reachability analysis during a full scan, or add `--only-facts-file` (with `--reach`) to submit only the reachability facts file (`.socket.facts.json`) when creating the full scan.
 
 #### Advanced Configuration
 | Parameter                | Required | Default | Description                                                           |
diff --git a/pyproject.toml b/pyproject.toml
index 12955b8..54cdb82 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.5"
+version = "2.4.6"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index de36ffe..7ac4760 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.5'
+__version__ = '2.4.6'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/uv.lock b/uv.lock
index 67ea3b6..d8ebc6b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.5"
+version = "2.4.6"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From f5ae591552225d212cd21275d4885ea98c5838a7 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Tue, 9 Jun 2026 14:22:16 +0200
Subject: [PATCH 64/80] Pin @coana-tech/cli version; make reachability
 auto-update opt-in (#230)

* Pin @coana-tech/cli version; make reachability auto-update opt-in

The Python CLI auto-updated the reachability (Coana) engine to the latest
published version on every --reach run via `npm install -g @coana-tech/cli`.
Automatically pulling a brand-new engine version without opting in is
undesirable for environments that need to review/approve dependency updates
before adopting them.

Run a fixed, pinned version (DEFAULT_COANA_CLI_VERSION = 15.3.22) via
`npx @coana-tech/cli@<pinned>` instead, so the engine version only changes
through a standard pip upgrade of this CLI. Opt into newest with
`--reach-version latest`; pin an explicit version with `--reach-version <semver>`.
The global `npm install -g` step is dropped entirely, so an existing global
install is never auto-updated or downgraded.

* Disable npx caching and add npm-install + node fallback for coana

Mirror the Socket Node CLI's coana launcher:
- Run the engine via `npx --yes --force` so the npx cache is bypassed; a
  corrupt or partial cache entry can no longer wedge a reachability run.
- Fall back to `npm install --no-save --prefix <tmp> @coana-tech/cli@<ver>`
  + `node <bin>` when the npx launcher is missing or dies before coana starts
  (spawn error / signal / exit >= 128). Small positive exit codes are treated
  as real coana failures and are not retried.
- Toggle with SOCKET_CLI_COANA_FORCE_NPM_INSTALL and SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK.
- Strip npm_package_* env vars before spawning coana to avoid E2BIG in large monorepos.

Kept on version 2.4.7 (same unreleased version as the pin change).

* Bump pinned @coana-tech/cli to 15.3.24

* Address PR review: per-version fallback cache, node prereq, accurate npx wording

- M2: cache the npm-install fallback's resolved script path per version for the
  process lifetime (mirrors the Node CLI's installedCoanaScriptPathsByVersion), so a
  repeated fallback installs once instead of re-installing + leaking a temp dir each call.
- M3: surface a clear error when `node` is missing in the fallback (instead of an opaque
  FileNotFoundError after a costly npm install), and add `node` to the up-front prereq check.
- M1: correct the overstated 'npx --force disables the cache' wording in docstrings, docs,
  and CHANGELOG. The code already matches the Node CLI exactly (npx --yes --force); --force
  does not force a re-download of an already-cached pinned version, so the docs now describe
  what the flags actually do rather than claiming a cache bypass.

Adds tests for per-version caching, node-missing, and real _resolve_coana_bin /
_build_coana_node_cmd parsing.

* Address review comments: Final annotation, atexit tmp cleanup, parametrized tests

- Annotate DEFAULT_COANA_CLI_VERSION with typing.Final.
- Register an atexit handler to remove the npm-install fallback's temp dirs.
- Trim the over-long --force explanation in _spawn_coana's docstring and drop the
  inline comment that duplicated it.
- Use try/finally in the cache-clearing test fixture.
- Parametrize the spec-resolution, npx-version, and launcher-failure-heuristic tests.

* Move launch-strategy rationale from the spec resolver to _spawn_coana

The 'why npx, not npm install -g' explanation describes how coana is launched, not
how a package spec string is built, so it belongs on _spawn_coana (per review). Leaves
_resolve_coana_package_spec with a minimal docstring.

* docs: show the real --reach-version default (15.3.24) in the Default column

* docs: show real reach-flag defaults from the Coana CLI implementation

Fill in the Default column for the flags whose defaults come from coana, verified
against the @coana-tech/cli source (coana-package-manager/packages/cli):
- --reach-analysis-timeout -> 600 (cli-core.ts: defaults to 600s when unset)
- --reach-analysis-memory-limit -> 8192 (index.ts --memory-limit default)
- --reach-concurrency -> 1 (index.ts --concurrency default)
- --reach-min-severity -> info (no coana default = analyze all; info is the effective floor)
---
 CHANGELOG.md                              |  21 ++
 docs/cli-reference.md                     |  21 +-
 pyproject.toml                            |   2 +-
 socketsecurity/__init__.py                |   2 +-
 socketsecurity/config.py                  |   6 +-
 socketsecurity/core/tools/reachability.py | 351 +++++++++++++++-------
 socketsecurity/socketcli.py               |   2 +-
 tests/unit/test_reachability.py           | 298 +++++++++++++++++-
 uv.lock                                   |   2 +-
 9 files changed, 575 insertions(+), 130 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2f759c..060d486 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,26 @@
 # Changelog
 
+## 2.4.7
+
+### Changed: pin @coana-tech/cli version; auto-update is now opt-in
+
+- Reachability analysis now runs a fixed `@coana-tech/cli` version pinned to this CLI release
+  (`15.3.24`) via `npx`, instead of silently pulling the latest published version on every run.
+  Engine version changes now ride with the Socket Python CLI release (standard `pip` upgrade),
+  giving advance notice of analysis-engine changes.
+- The CLI no longer runs `npm install -g @coana-tech/cli`; an existing global install is left
+  untouched (never auto-updated or downgraded).
+- Opt into always-newest with `--reach-version latest`; pin an explicit version with
+  `--reach-version <semver>` (unchanged).
+- Runs the engine via `npx --yes --force` (the same flags the Socket Node CLI passes for
+  coana); `--yes` skips npx's interactive install prompt so non-interactive/CI runs don't hang.
+- Added an `npm install` + `node` fallback for when the `npx` launcher is missing or fails
+  before the engine starts. The installed engine is cached per version for the process
+  lifetime (installs once). Tunable via `SOCKET_CLI_COANA_FORCE_NPM_INSTALL` (use the fallback
+  as the primary path) and `SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK` (never fall back). `node` is
+  now part of the up-front prerequisite check. Also strips `npm_package_*` env vars before
+  spawning the engine to avoid `E2BIG` in large monorepos.
+
 ## 2.4.6
 
 ### Docs: reachability reference corrections
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index cdbf003..adb41ca 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -240,13 +240,13 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a tier-1 full-application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | latest  | Version of @coana-tech/cli to use for analysis                                                                             |
-| `--reach-analysis-timeout`         | False    | *coana* | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own (currently 600s). Alias: `--reach-timeout` |
-| `--reach-analysis-memory-limit`    | False    | *coana* | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own (currently 8192). Alias: `--reach-memory-limit` |
-| `--reach-concurrency`              | False    | *coana* | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own (currently 1)             |
+| `--reach-version`                  | False    | 15.3.24 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-analysis-timeout`         | False    | 600     | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-timeout` |
+| `--reach-analysis-memory-limit`    | False    | 8192    | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-memory-limit` |
+| `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
 | `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
 | `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
-| `--reach-min-severity`             | False    |         | Minimum severity level for reporting reachability results (info, low, moderate, high, critical)                            |
+| `--reach-min-severity`             | False    | info    | Minimum severity of vulnerabilities to analyze (info, low, moderate, high, critical). Omitted by default, so coana analyzes all severities — equivalent to `info`, the lowest. |
 | `--reach-skip-cache`               | False    | False   | Skip cache and force fresh reachability analysis                                                                           |
 | `--reach-disable-analytics`        | False    | False   | Disable analytics collection during reachability analysis                                                                  |
 | `--reach-enable-analysis-splitting` | False   | False   | Enable analysis splitting/bucketing (a legacy performance feature). Splitting is disabled by default.                      |
@@ -262,8 +262,9 @@ If you don't want to provide the Socket API Token every time then you can use th
 **Reachability Analysis Requirements:**
 
 The Python CLI verifies the following **up front** (before invoking the analysis engine) and exits with code **3** if any are unmet:
-- `npm` - Required to install and run `@coana-tech/cli` (the analysis engine)
-- `npx` - Required to execute `@coana-tech/cli`
+- `npm` - Required (verified up front; ships alongside `npx`)
+- `npx` - Required to fetch (on first use) and run `@coana-tech/cli` (the analysis engine)
+- `node` - Required to run the engine (used directly by the `npm install` fallback)
 - `uv` - Required by the analysis engine
 - An **Enterprise** Socket organization plan (any `enterprise*` plan, including Enterprise trials)
 
@@ -313,7 +314,11 @@ Sample config files:
 
 For CI-specific examples and guidance, see [`ci-cd.md`](ci-cd.md).
 
-The CLI will automatically install `@coana-tech/cli` if not present. Use `--reach` to enable reachability analysis during a full scan, or add `--only-facts-file` (with `--reach`) to submit only the reachability facts file (`.socket.facts.json`) when creating the full scan.
+The CLI runs a pinned `@coana-tech/cli` version via `npx --yes --force` (the same flags the Socket Node CLI passes for coana); it does **not** auto-update the engine or install it globally. `--yes` skips npx's interactive install prompt so non-interactive/CI runs don't hang. If the `npx` launcher is unavailable or fails before the engine starts, the CLI falls back to `npm install`-ing the pinned version into a temp directory and running it via `node`. Pass `--reach-version latest` to opt into the newest published version. Use `--reach` to enable reachability analysis during a full scan, or add `--only-facts-file` (with `--reach`) to submit only the reachability facts file (`.socket.facts.json`) when creating the full scan.
+
+The launcher fallback can be tuned via environment variables:
+- `SOCKET_CLI_COANA_FORCE_NPM_INSTALL` — skip `npx` entirely and always use the `npm install` + `node` path (useful where `npx` is known-broken).
+- `SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK` — never fall back; surface the `npx` failure directly.
 
 #### Advanced Configuration
 | Parameter                | Required | Default | Description                                                           |
diff --git a/pyproject.toml b/pyproject.toml
index 54cdb82..6bed831 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.6"
+version = "2.4.7"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 7ac4760..91c7faf 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.6'
+__version__ = '2.4.7'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 3c258a3..9d9f62d 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -943,8 +943,10 @@ def create_argument_parser() -> argparse.ArgumentParser:
     reachability_group.add_argument(
         "--reach-version",
         dest="reach_version",
-        metavar="<version>",
-        help="Specific version of @coana-tech/cli to use (e.g., '1.2.3')"
+        metavar="<version|latest>",
+        help="Version of @coana-tech/cli to use. Defaults to the version pinned to this CLI "
+             "release; pass 'latest' to always use the newest published version (opt-in "
+             "auto-update), or an explicit version (e.g. '1.2.3') to pin it."
     )
     reachability_group.add_argument(
         "--reach-analysis-timeout",
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 008bd65..88d3105 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -1,17 +1,39 @@
 from socketdev import socketdev
-from typing import List, Optional, Dict, Any
+from typing import List, Optional, Dict, Any, Final
+import atexit
 import os
 import platform
+import shutil
 import subprocess
 import json
 import pathlib
 import logging
 import sys
+import tempfile
 
 from socketsecurity import __version__
 
 log = logging.getLogger(__name__)
 
+# Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
+# reachability engine version only changes through a standard pip upgrade (advance notice).
+# Pass --reach-version latest to opt into the newest published version instead.
+DEFAULT_COANA_CLI_VERSION: Final = "15.3.24"
+
+# Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
+# Lives for the process lifetime so repeated fallback invocations install only once
+# (mirrors the Node CLI's installedCoanaScriptPathsByVersion).
+_INSTALLED_COANA_SCRIPT_PATHS: Dict[str, str] = {}
+
+# Temp dirs created by the npm-install fallback, removed at process exit.
+_COANA_INSTALL_DIRS: List[str] = []
+
+
+@atexit.register
+def _cleanup_coana_install_dirs() -> None:
+    for install_dir in _COANA_INSTALL_DIRS:
+        shutil.rmtree(install_dir, ignore_errors=True)
+
 
 def _build_caller_user_agent() -> str:
     """Build the SOCKET_CALLER_USER_AGENT string forwarded to the coana CLI.
@@ -31,70 +53,25 @@ def __init__(self, sdk: socketdev, api_token: str):
         self.sdk = sdk
         self.api_token = api_token
     
-    def _ensure_coana_cli_installed(self, version: Optional[str] = None) -> str:
+    def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Check if @coana-tech/cli is installed, and install/update it if needed.
-        
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.3.24').
+
         Args:
-            version: Specific version to install (e.g., '1.2.3'). If None, always updates to latest.
-            
+            version: Coana CLI version to use.
+                - None: the pinned ``DEFAULT_COANA_CLI_VERSION`` (no auto-update).
+                - 'latest': always the newest published version (opt-in to auto-update).
+                - '<semver>': that exact version.
+
         Returns:
-            str: The package specifier to use with npx
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.3.24').
         """
-        # Determine the package specifier
-        package_spec = f"@coana-tech/cli@{version}" if version else "@coana-tech/cli"
-        
-        # If a specific version is requested, check if it's already installed
-        if version:
-            try:
-                check_cmd = ["npm", "list", "-g", "@coana-tech/cli", "--depth=0"]
-                result = subprocess.run(
-                    check_cmd,
-                    capture_output=True,
-                    text=True,
-                    timeout=10
-                )
-                
-                # If npm list succeeds and mentions the specific version, it's installed
-                if result.returncode == 0 and f"@coana-tech/cli@{version}" in result.stdout:
-                    log.debug(f"@coana-tech/cli@{version} is already installed globally")
-                    return package_spec
-                    
-            except Exception as e:
-                log.debug(f"Could not check for existing @coana-tech/cli installation: {e}")
-        
-        # Install or update the package
-        # When no version is specified, always try to update to latest
-        if version:
-            log.info(f"Installing reachability analysis plugin (@coana-tech/cli@{version})...")
-        else:
-            log.info("Updating reachability analysis plugin (@coana-tech/cli) to latest version...")
-        log.info("This may take a moment...")
-        
-        try:
-            install_cmd = ["npm", "install", "-g", package_spec]
-            log.debug(f"Installing with command: {' '.join(install_cmd)}")
-            
-            result = subprocess.run(
-                install_cmd,
-                capture_output=True,
-                text=True,
-                timeout=300  # 5 minute timeout for installation
-            )
-            
-            if result.returncode != 0:
-                log.warning(f"Global installation failed, npx will download on demand")
-                log.debug(f"Install stderr: {result.stderr}")
-            else:
-                log.info("Reachability analysis plugin installed successfully")
-                
-        except subprocess.TimeoutExpired:
-            log.warning("Installation timed out, npx will download on demand")
-        except Exception as e:
-            log.warning(f"Could not install globally: {e}, npx will download on demand")
-        
-        return package_spec
-    
+        return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
+
+    def _resolve_coana_version(self, version: Optional[str] = None) -> str:
+        """Resolve the effective @coana-tech/cli version string (see _resolve_coana_package_spec)."""
+        return (version or DEFAULT_COANA_CLI_VERSION).strip()
+
     
     def run_reachability_analysis(
         self,
@@ -147,7 +124,9 @@ def run_reachability_analysis(
             lazy_mode: Enable lazy mode for analysis
             repo_name: Repository name
             branch_name: Branch name
-            version: Specific version of @coana-tech/cli to use
+            version: @coana-tech/cli version to use. None uses the pinned
+                DEFAULT_COANA_CLI_VERSION (no auto-update); 'latest' opts into the newest
+                published version; '<semver>' pins an explicit version.
             concurrency: Concurrency level for analysis (must be >= 1)
             additional_params: Additional parameters to pass to coana CLI
             allow_unverified: Disable SSL certificate verification (sets NODE_TLS_REJECT_UNAUTHORIZED=0)
@@ -157,16 +136,14 @@ def run_reachability_analysis(
         Returns:
             Dict containing scan_id and report_path
         """
-        # Ensure @coana-tech/cli is installed
-        cli_package = self._ensure_coana_cli_installed(version)
-        
-        # Build CLI command arguments
-        cmd = ["npx", cli_package, "run", "."]
-        
+        # Build the coana CLI arguments (everything after the package spec). The launcher
+        # (npx, or the npm-install + node fallback) is chosen in _spawn_coana() below.
+        coana_args = ["run", "."]
+
         # Add required arguments
         output_dir = str(pathlib.Path(output_path).parent)
         log.debug(f"output_dir: {output_dir}, output_path: {output_path}")
-        cmd.extend([
+        coana_args.extend([
             "--output-dir", output_dir,
             "--socket-mode", output_path,
             "--disable-report-submission"
@@ -174,70 +151,70 @@ def run_reachability_analysis(
         
         # Add conditional arguments
         if timeout:
-            cmd.extend(["--analysis-timeout", str(timeout)])
+            coana_args.extend(["--analysis-timeout", str(timeout)])
         
         if memory_limit:
-            cmd.extend(["--memory-limit", str(memory_limit)])
+            coana_args.extend(["--memory-limit", str(memory_limit)])
         
         if disable_analytics:
-            cmd.append("--disable-analytics-sharing")
+            coana_args.append("--disable-analytics-sharing")
 
         # Analysis splitting is disabled by default; only omit the flag if explicitly enabled
         if not enable_analysis_splitting:
-            cmd.append("--disable-analysis-splitting")
+            coana_args.append("--disable-analysis-splitting")
 
         if detailed_analysis_log_file:
-            cmd.append("--print-analysis-log-file")
+            coana_args.append("--print-analysis-log-file")
 
         if lazy_mode:
-            cmd.append("--lazy-mode")
+            coana_args.append("--lazy-mode")
         
         # KEY POINT: Only add manifest tar hash if we have one
         if tar_hash:
-            cmd.extend(["--run-without-docker", "--manifests-tar-hash", tar_hash])
+            coana_args.extend(["--run-without-docker", "--manifests-tar-hash", tar_hash])
         
         if ecosystems:
-            cmd.extend(["--purl-types"] + ecosystems)
+            coana_args.extend(["--purl-types"] + ecosystems)
         
         if exclude_paths:
-            cmd.extend(["--exclude-dirs"] + exclude_paths)
+            coana_args.extend(["--exclude-dirs"] + exclude_paths)
         
         if min_severity:
-            cmd.extend(["--min-severity", min_severity])
+            coana_args.extend(["--min-severity", min_severity])
         
         if skip_cache:
-            cmd.append("--skip-cache-usage")
+            coana_args.append("--skip-cache-usage")
         
         if concurrency:
-            cmd.extend(["--concurrency", str(concurrency)])
+            coana_args.extend(["--concurrency", str(concurrency)])
         
         if enable_debug:
-            cmd.append("-d")
+            coana_args.append("-d")
 
         if reach_debug:
-            cmd.append("--debug")
+            coana_args.append("--debug")
 
         if disable_external_tool_checks:
-            cmd.append("--disable-external-tool-checks")
+            coana_args.append("--disable-external-tool-checks")
 
         if use_only_pregenerated_sboms:
-            cmd.append("--use-only-pregenerated-sboms")
+            coana_args.append("--use-only-pregenerated-sboms")
 
         if continue_on_analysis_errors:
-            cmd.append("--reach-continue-on-analysis-errors")
+            coana_args.append("--reach-continue-on-analysis-errors")
 
         if continue_on_install_errors:
-            cmd.append("--reach-continue-on-install-errors")
+            coana_args.append("--reach-continue-on-install-errors")
 
         if continue_on_missing_lock_files:
-            cmd.append("--reach-continue-on-missing-lock-files")
+            coana_args.append("--reach-continue-on-missing-lock-files")
 
         if continue_on_no_source_files:
-            cmd.append("--reach-continue-on-no-source-files")
+            coana_args.append("--reach-continue-on-no-source-files")
 
         # Add any additional parameters provided by the user
         if additional_params:
-            cmd.extend(additional_params)
+            coana_args.extend(additional_params)
         
         # Set up environment variables
         env = os.environ.copy()
@@ -268,24 +245,18 @@ def run_reachability_analysis(
         if allow_unverified:
             env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0"
         
-        # Execute CLI
+        # Execute coana
         log.info("Running reachability analysis...")
-        log.debug(f"Reachability command: {' '.join(cmd)}")
         log.debug(f"Environment: SOCKET_ORG_SLUG={org_slug}, SOCKET_REPO_NAME={repo_name or 'not set'}, SOCKET_BRANCH_NAME={branch_name or 'not set'}")
-        
+
         try:
-            # Run with output streaming to stderr (don't capture output)
-            result = subprocess.run(
-                cmd,
-                env=env,
-                cwd=target_directory,
-                stdout=sys.stderr,  # Send stdout to stderr so user sees it
-                stderr=sys.stderr,  # Send stderr to stderr
-            )
-            
-            if result.returncode != 0:
-                log.error(f"Reachability analysis failed with exit code {result.returncode}")
-                raise Exception(f"Reachability analysis failed with exit code {result.returncode}")
+            # Prefer npx (with caching disabled); fall back to `npm install` + `node`
+            # if the npx launcher fails before coana starts (parity with the Node CLI).
+            returncode = self._spawn_coana(coana_args, version, env, target_directory)
+
+            if returncode != 0:
+                log.error(f"Reachability analysis failed with exit code {returncode}")
+                raise Exception(f"Reachability analysis failed with exit code {returncode}")
             
             # Extract scan ID from output file
             scan_id = self._extract_scan_id(output_path)
@@ -303,7 +274,175 @@ def run_reachability_analysis(
         except Exception as e:
             log.error(f"Failed to run reachability analysis: {str(e)}")
             raise Exception(f"Failed to run reachability analysis: {str(e)}")
-    
+
+    @staticmethod
+    def _sanitize_coana_env(env: Dict[str, str]) -> Dict[str, str]:
+        """Drop npm-injected ``npm_package_*`` vars before spawning coana.
+
+        npm/pnpm/yarn populate one env var per leaf of the cwd's package.json
+        (``npm_package_dependencies_*`` etc.). In large monorepos this can be tens of KB
+        and push argv+env past the OS ARG_MAX, making the spawn fail with E2BIG before
+        coana even starts. coana doesn't read these, so dropping them is safe; we keep
+        ``npm_config_*`` (registry/cache/proxy) untouched. Mirrors the Node CLI.
+        """
+        return {k: v for k, v in env.items() if not k.startswith("npm_package_")}
+
+    @staticmethod
+    def _npx_launcher_failed_before_coana(returncode: int) -> bool:
+        """Heuristic: did npx fail *before* coana started (so retrying is worthwhile)?
+
+        We stream coana's output (no capture), so we classify by exit code alone, like the
+        Node CLI does with inherited stdio: signal kills (negative codes) and codes >= 128
+        are conventionally launcher/signal failures -> retry. Small positive codes (1..127)
+        are ambiguous (coana's own exit codes are small ints), so we do NOT retry.
+        """
+        return returncode < 0 or returncode >= 128
+
+    def _spawn_coana(
+        self,
+        coana_args: List[str],
+        version: Optional[str],
+        env: Dict[str, str],
+        cwd: str,
+    ) -> int:
+        """Run coana for the given args, returning the process exit code.
+
+        We run a pinned, versioned spec via npx and intentionally do NOT ``npm install -g``:
+        that would silently auto-update the engine on every run and mutate the user's global
+        install. The pinned version rides with the Python CLI release instead (see
+        ``DEFAULT_COANA_CLI_VERSION``).
+
+        Primary path: ``npx --yes --force @coana-tech/cli@<version> ...`` — the exact flags the
+        Socket Node CLI passes for coana (``--yes`` skips npx's interactive install prompt so
+        CI runs don't hang).
+
+        Fallback path: if npx is missing, or its launcher dies before coana starts, install
+        @coana-tech/cli into a temp dir via ``npm install`` and run it directly via ``node``.
+        Toggle with ``SOCKET_CLI_COANA_FORCE_NPM_INSTALL`` (use the fallback as the primary
+        path) and ``SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK`` (never fall back).
+        """
+        effective_version = self._resolve_coana_version(version)
+        coana_env = self._sanitize_coana_env(env)
+        disable_fallback = bool(os.environ.get("SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK"))
+
+        if os.environ.get("SOCKET_CLI_COANA_FORCE_NPM_INSTALL"):
+            return self._spawn_coana_via_npm_install(coana_args, effective_version, coana_env, cwd)
+
+        package_spec = f"@coana-tech/cli@{effective_version}"
+        npx_cmd = ["npx", "--yes", "--force", package_spec, *coana_args]
+        log.debug(f"Reachability command: {' '.join(npx_cmd)}")
+        try:
+            result = subprocess.run(
+                npx_cmd,
+                env=coana_env,
+                cwd=cwd,
+                stdout=sys.stderr,  # Send stdout to stderr so the user sees it
+                stderr=sys.stderr,
+            )
+        except FileNotFoundError:
+            # npx is not on PATH: the launcher provably never started coana.
+            if disable_fallback:
+                raise
+            log.warning("npx not found on PATH; retrying reachability analysis via `npm install` + `node`.")
+            return self._spawn_coana_via_npm_install(coana_args, effective_version, coana_env, cwd)
+
+        if result.returncode == 0:
+            return 0
+
+        if not disable_fallback and self._npx_launcher_failed_before_coana(result.returncode):
+            log.warning(
+                f"npx launcher failed (exit {result.returncode}) before coana started; "
+                "retrying reachability analysis via `npm install` + `node`."
+            )
+            return self._spawn_coana_via_npm_install(coana_args, effective_version, coana_env, cwd)
+
+        return result.returncode
+
+    def _spawn_coana_via_npm_install(
+        self,
+        coana_args: List[str],
+        version: str,
+        env: Dict[str, str],
+        cwd: str,
+    ) -> int:
+        """Fallback launcher: ``npm install`` @coana-tech/cli into a temp dir, run via ``node``.
+
+        Used when npx is unavailable or its launcher fails before coana boots. Mirrors the
+        Node CLI's npm-install fallback. Returns coana's exit code; raises if the install
+        itself fails or if ``node`` is unavailable.
+        """
+        script_path = self._install_coana_to_tmpdir(version, env)
+        node_cmd = self._build_coana_node_cmd(script_path, coana_args)
+        log.debug(f"Reachability fallback command: {' '.join(node_cmd)}")
+        try:
+            result = subprocess.run(node_cmd, env=env, cwd=cwd, stdout=sys.stderr, stderr=sys.stderr)
+        except FileNotFoundError as e:
+            # The fallback exists for broken-launcher environments, but it still needs node.
+            raise Exception(
+                "`node` was not found on PATH; it is required to run the reachability engine "
+                "via the npm-install fallback."
+            ) from e
+        return result.returncode
+
+    def _install_coana_to_tmpdir(self, version: str, env: Dict[str, str]) -> str:
+        """``npm install`` @coana-tech/cli@<version> into a temp dir; return its executable JS path.
+
+        Caches the resolved path per version for the process lifetime so repeated fallback
+        invocations install only once (mirrors the Node CLI's installCoanaToTmpdir). Raises if
+        the install fails.
+        """
+        cached = _INSTALLED_COANA_SCRIPT_PATHS.get(version)
+        if cached and os.path.exists(cached):
+            return cached
+
+        install_dir = tempfile.mkdtemp(prefix="socket-coana-")
+        _COANA_INSTALL_DIRS.append(install_dir)
+        npm_cmd = [
+            "npm", "install",
+            "--no-save", "--no-package-lock", "--no-audit", "--no-fund",
+            "--prefix", install_dir,
+            f"@coana-tech/cli@{version}",
+        ]
+        log.info("Installing reachability analysis engine via npm fallback...")
+        log.debug(f"npm install fallback command: {' '.join(npm_cmd)}")
+        install = subprocess.run(npm_cmd, env=env, stdout=sys.stderr, stderr=sys.stderr)
+        if install.returncode != 0:
+            raise Exception(
+                f"npm install fallback for @coana-tech/cli@{version} failed with exit code {install.returncode}"
+            )
+
+        script_path = self._resolve_coana_bin(install_dir)
+        _INSTALLED_COANA_SCRIPT_PATHS[version] = script_path
+        return script_path
+
+    @staticmethod
+    def _resolve_coana_bin(install_dir: str) -> str:
+        """Resolve @coana-tech/cli's executable JS from its installed package.json ``bin`` field."""
+        package_json_path = os.path.join(
+            install_dir, "node_modules", "@coana-tech", "cli", "package.json"
+        )
+        with open(package_json_path, "r") as f:
+            pkg = json.load(f)
+        bin_field = pkg.get("bin")
+        relative_bin = None
+        if isinstance(bin_field, str):
+            relative_bin = bin_field
+        elif isinstance(bin_field, dict):
+            # Prefer an entry named "coana"; otherwise take the first.
+            relative_bin = bin_field.get("coana") or next(iter(bin_field.values()), None)
+        if not relative_bin:
+            raise Exception(
+                f"@coana-tech/cli package.json at {package_json_path} is missing a usable bin entry"
+            )
+        return os.path.abspath(os.path.join(os.path.dirname(package_json_path), relative_bin))
+
+    @staticmethod
+    def _build_coana_node_cmd(script_path: str, coana_args: List[str]) -> List[str]:
+        """Run a .js/.mjs entry via ``node``; invoke a native binary directly (Node CLI parity)."""
+        if script_path.endswith(".js") or script_path.endswith(".mjs"):
+            return ["node", script_path, *coana_args]
+        return [script_path, *coana_args]
+
     def _extract_scan_id(self, facts_file_path: str) -> Optional[str]:
         """
         Extract tier1ReachabilityScanId from the socket facts JSON file.
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 1e339ae..1ab9e90 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -189,7 +189,7 @@ def main_code():
     # Check for required dependencies if reachability analysis is enabled
     if config.reach:
         log.info("Reachability analysis enabled, checking for required dependencies...")
-        required_deps = ["npm", "uv", "npx"]
+        required_deps = ["npm", "node", "uv", "npx"]
         missing_deps = []
         found_deps = []
         
diff --git a/tests/unit/test_reachability.py b/tests/unit/test_reachability.py
index 10b6d54..1130be3 100644
--- a/tests/unit/test_reachability.py
+++ b/tests/unit/test_reachability.py
@@ -1,8 +1,10 @@
 """Tests for the reachability coana-CLI command/env construction (Node alignment).
 
-These cover the arg-builder and environment wiring in
-``socketsecurity.core.tools.reachability.ReachabilityAnalyzer`` without actually
-invoking npm/npx/coana: ``_ensure_coana_cli_installed`` and ``subprocess.run`` are mocked.
+These cover the arg-builder, the npx launcher (caching disabled via --yes --force), the
+npm-install + node fallback, and the environment wiring in
+``socketsecurity.core.tools.reachability.ReachabilityAnalyzer`` without actually invoking
+npx/npm/node/coana: ``subprocess.run`` (and, for the fallback, ``tempfile.mkdtemp`` /
+``_resolve_coana_bin``) are mocked.
 """
 from unittest.mock import MagicMock
 
@@ -11,6 +13,7 @@
 from socketsecurity import __version__
 from socketsecurity.core.tools import reachability
 from socketsecurity.core.tools.reachability import (
+    DEFAULT_COANA_CLI_VERSION,
     ReachabilityAnalyzer,
     _build_caller_user_agent,
 )
@@ -21,19 +24,34 @@ def analyzer():
     return ReachabilityAnalyzer(MagicMock(), "test-api-token")
 
 
-def _run(analyzer, mocker, **kwargs):
-    """Invoke run_reachability_analysis with npm/npx/coana mocked; return (cmd, env)."""
-    mocker.patch.object(analyzer, "_ensure_coana_cli_installed", return_value="@coana-tech/cli")
+@pytest.fixture(autouse=True)
+def _clear_coana_install_cache():
+    """The npm-install fallback caches resolved script paths in a module-level dict; isolate tests."""
+    reachability._INSTALLED_COANA_SCRIPT_PATHS.clear()
+    try:
+        yield
+    finally:
+        reachability._INSTALLED_COANA_SCRIPT_PATHS.clear()
+
+
+def _spawn_mock(analyzer, mocker, returncode=0, **kwargs):
+    """Run run_reachability_analysis with subprocess.run mocked to a fixed exit code.
+
+    Uses the real resolver / _spawn_coana; returns the run mock for inspection.
+    """
     mocker.patch.object(analyzer, "_extract_scan_id", return_value="scan-123")
     completed = MagicMock()
-    completed.returncode = 0
+    completed.returncode = returncode
     run_mock = mocker.patch.object(reachability.subprocess, "run", return_value=completed)
 
     analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".", **kwargs)
+    return run_mock
 
-    cmd = run_mock.call_args.args[0]
-    env = run_mock.call_args.kwargs["env"]
-    return cmd, env
+
+def _run(analyzer, mocker, **kwargs):
+    """Invoke run_reachability_analysis on the happy npx path; return (npx argv, env)."""
+    run_mock = _spawn_mock(analyzer, mocker, **kwargs)
+    return run_mock.call_args.args[0], run_mock.call_args.kwargs["env"]
 
 
 def test_build_caller_user_agent_shape():
@@ -104,3 +122,263 @@ def test_repo_branch_env_absent_when_none(analyzer, mocker):
     _, env = _run(analyzer, mocker, repo_name=None, branch_name=None)
     assert "SOCKET_REPO_NAME" not in env
     assert "SOCKET_BRANCH_NAME" not in env
+
+
+# --- Coana package-spec resolution (pinned by default, latest is opt-in) ---
+
+
+@pytest.mark.parametrize(
+    ("version", "expected"),
+    [
+        # No --reach-version -> pinned default (no auto-update).
+        (None, f"@coana-tech/cli@{DEFAULT_COANA_CLI_VERSION}"),
+        # Explicit version pinned through.
+        ("1.2.3", "@coana-tech/cli@1.2.3"),
+        # 'latest' opts into the newest published version.
+        ("latest", "@coana-tech/cli@latest"),
+        # Surrounding whitespace is stripped; always versioned (never bare '@coana-tech/cli').
+        (" 1.2.3 ", "@coana-tech/cli@1.2.3"),
+    ],
+)
+def test_resolve_coana_package_spec(analyzer, version, expected):
+    assert analyzer._resolve_coana_package_spec(version) == expected
+
+
+def _spec_in(cmd):
+    """The @coana-tech/cli@<version> spec from an npx argv (it follows the npx flags)."""
+    return next(a for a in cmd if a.startswith("@coana-tech/cli@"))
+
+
+def test_npx_uses_yes_and_force_flags(analyzer, mocker):
+    """npx is invoked with --yes --force — the exact flags the Node CLI passes for coana."""
+    cmd, _ = _run(analyzer, mocker)
+    assert cmd[0] == "npx"
+    assert "--yes" in cmd
+    assert "--force" in cmd
+
+
+@pytest.mark.parametrize(
+    ("version", "expected_spec"),
+    [
+        (None, f"@coana-tech/cli@{DEFAULT_COANA_CLI_VERSION}"),  # pinned default
+        ("9.9.9", "@coana-tech/cli@9.9.9"),                     # explicit pin
+        ("latest", "@coana-tech/cli@latest"),                  # opt-in to newest
+    ],
+)
+def test_npx_runs_resolved_version(analyzer, mocker, version, expected_spec):
+    cmd, _ = _run(analyzer, mocker, version=version)
+    assert _spec_in(cmd) == expected_spec
+
+
+def test_default_path_never_runs_npm_install(analyzer, mocker):
+    """On the happy path we use npx only — no `npm install` (no global mutation)."""
+    run_mock = _spawn_mock(analyzer, mocker)
+    for call in run_mock.call_args_list:
+        assert call.args[0][:2] != ["npm", "install"]
+
+
+def test_env_strips_npm_package_vars(analyzer, mocker, monkeypatch):
+    """npm_package_* dropped (E2BIG guard); npm_config_* kept. Parity with the Node CLI."""
+    monkeypatch.setenv("npm_package_dependencies_foo", "1.0.0")
+    monkeypatch.setenv("npm_config_registry", "https://example.test")
+    _, env = _run(analyzer, mocker)
+    assert "npm_package_dependencies_foo" not in env
+    assert env.get("npm_config_registry") == "https://example.test"
+
+
+# --- npm-install + node fallback (when the npx launcher fails before coana starts) ---
+
+
+@pytest.mark.parametrize(
+    ("returncode", "is_launcher_failure"),
+    [
+        # Signal kills / >=128 -> launcher failure -> retry.
+        (-9, True),    # killed by signal
+        (137, True),   # 128 + SIGKILL
+        (249, True),   # observed npx launcher failure
+        # Small positive exit codes are ambiguous (coana's own codes) -> do NOT retry.
+        (1, False),
+        (2, False),
+        (127, False),
+    ],
+)
+def test_launcher_failure_heuristic(returncode, is_launcher_failure):
+    f = ReachabilityAnalyzer._npx_launcher_failed_before_coana
+    assert f(returncode) is is_launcher_failure
+
+
+def _capture_spawns(analyzer, mocker, npx_behavior, **kwargs):
+    """Drive run_reachability_analysis capturing each spawned argv.
+
+    ``npx_behavior`` is applied when argv[0] == 'npx': an int return code, or a
+    callable raising (e.g. FileNotFoundError). npm/node spawns always succeed.
+    """
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value="scan-123")
+    mocker.patch.object(reachability.tempfile, "mkdtemp", return_value="/tmp/socket-coana-x")
+    mocker.patch.object(
+        analyzer,
+        "_resolve_coana_bin",
+        return_value="/tmp/socket-coana-x/node_modules/@coana-tech/cli/coana.js",
+    )
+    calls = []
+
+    def fake_run(argv, **_kw):
+        calls.append(argv)
+        if argv[0] == "npx" and callable(npx_behavior):
+            npx_behavior()
+        m = MagicMock()
+        m.returncode = npx_behavior if (argv[0] == "npx" and isinstance(npx_behavior, int)) else 0
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".", **kwargs)
+    return calls
+
+
+def test_falls_back_to_npm_install_when_npx_launcher_fails(analyzer, mocker):
+    """npx exits >=128 (launcher died) -> npm install + node run coana directly."""
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=137)
+    assert calls[0][0] == "npx"
+    assert calls[1][:2] == ["npm", "install"]
+    assert f"@coana-tech/cli@{DEFAULT_COANA_CLI_VERSION}" in calls[1]
+    assert calls[2][0] == "node"
+    assert calls[2][1] == "/tmp/socket-coana-x/node_modules/@coana-tech/cli/coana.js"
+    assert calls[2][2:4] == ["run", "."]
+
+
+def test_falls_back_when_npx_missing(analyzer, mocker):
+    """npx not on PATH (FileNotFoundError) -> npm install + node fallback."""
+    def raise_enoent():
+        raise FileNotFoundError("npx")
+
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=raise_enoent)
+    assert calls[0][0] == "npx"
+    assert calls[1][:2] == ["npm", "install"]
+    assert calls[2][0] == "node"
+
+
+def test_no_fallback_on_ambiguous_exit_code(analyzer, mocker):
+    """A small positive npx exit (coana's own failure) does NOT trigger the npm fallback."""
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value=None)
+    calls = []
+
+    def fake_run(argv, **_kw):
+        calls.append(argv)
+        m = MagicMock()
+        m.returncode = 1
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    with pytest.raises(Exception):
+        analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+    assert calls[0][0] == "npx"
+    assert all(c[:2] != ["npm", "install"] for c in calls)
+
+
+def test_force_npm_install_skips_npx(analyzer, mocker, monkeypatch):
+    """SOCKET_CLI_COANA_FORCE_NPM_INSTALL routes straight to npm install + node."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_FORCE_NPM_INSTALL", "1")
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=0)
+    assert all(c[0] != "npx" for c in calls)
+    assert calls[0][:2] == ["npm", "install"]
+    assert calls[1][0] == "node"
+
+
+def test_disable_fallback_propagates_npx_failure(analyzer, mocker, monkeypatch):
+    """SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK: a launcher failure is NOT retried via npm."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK", "1")
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value=None)
+    calls = []
+
+    def fake_run(argv, **_kw):
+        calls.append(argv)
+        m = MagicMock()
+        m.returncode = 137
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    with pytest.raises(Exception):
+        analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+    assert all(c[:2] != ["npm", "install"] for c in calls)
+
+
+def test_fallback_installs_once_per_version(analyzer, mocker):
+    """A second in-process fallback for the same version reuses the install (no re-install)."""
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value="scan-123")
+    mocker.patch.object(reachability.tempfile, "mkdtemp", return_value="/tmp/socket-coana-cache")
+    mocker.patch.object(
+        analyzer,
+        "_resolve_coana_bin",
+        return_value="/tmp/socket-coana-cache/node_modules/@coana-tech/cli/coana.js",
+    )
+    # The cached script path must "exist" for the 2nd run to reuse it.
+    mocker.patch.object(reachability.os.path, "exists", return_value=True)
+    calls = []
+
+    def fake_run(argv, **_kw):
+        calls.append(argv)
+        m = MagicMock()
+        m.returncode = 137 if argv[0] == "npx" else 0
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+    analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+
+    npm_installs = [c for c in calls if c[:2] == ["npm", "install"]]
+    assert len(npm_installs) == 1  # installed once, reused on the second fallback
+
+
+def test_fallback_node_missing_raises_clear_error(analyzer, mocker):
+    """If `node` is missing in the fallback, surface a clear error (not opaque FileNotFoundError)."""
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value=None)
+    mocker.patch.object(reachability.tempfile, "mkdtemp", return_value="/tmp/socket-coana-n")
+    mocker.patch.object(
+        analyzer,
+        "_resolve_coana_bin",
+        return_value="/tmp/socket-coana-n/node_modules/@coana-tech/cli/coana.js",
+    )
+
+    def fake_run(argv, **_kw):
+        if argv[0] == "npx":
+            m = MagicMock()
+            m.returncode = 137
+            return m
+        if argv[0] == "node":
+            raise FileNotFoundError("node")
+        m = MagicMock()  # npm install succeeds
+        m.returncode = 0
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    with pytest.raises(Exception, match="node"):
+        analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+
+
+def test_build_coana_node_cmd_js_vs_binary():
+    f = ReachabilityAnalyzer._build_coana_node_cmd
+    assert f("/x/coana.js", ["run", "."]) == ["node", "/x/coana.js", "run", "."]
+    assert f("/x/coana.mjs", ["run"]) == ["node", "/x/coana.mjs", "run"]
+    assert f("/x/coana", ["run", "."]) == ["/x/coana", "run", "."]
+
+
+def test_resolve_coana_bin_parses_package_json(analyzer, tmp_path):
+    pkg_dir = tmp_path / "node_modules" / "@coana-tech" / "cli"
+    pkg_dir.mkdir(parents=True)
+
+    # string bin
+    (pkg_dir / "package.json").write_text('{"bin": "dist/coana.js"}')
+    assert analyzer._resolve_coana_bin(str(tmp_path)) == str(pkg_dir / "dist" / "coana.js")
+
+    # dict bin, prefer the "coana" entry
+    (pkg_dir / "package.json").write_text('{"bin": {"coana": "dist/c.js", "other": "x.js"}}')
+    assert analyzer._resolve_coana_bin(str(tmp_path)) == str(pkg_dir / "dist" / "c.js")
+
+    # dict bin without "coana" -> first value
+    (pkg_dir / "package.json").write_text('{"bin": {"other": "x.js"}}')
+    assert analyzer._resolve_coana_bin(str(tmp_path)) == str(pkg_dir / "x.js")
+
+    # missing bin -> raises
+    (pkg_dir / "package.json").write_text("{}")
+    with pytest.raises(Exception, match="bin"):
+        analyzer._resolve_coana_bin(str(tmp_path))
diff --git a/uv.lock b/uv.lock
index d8ebc6b..29cd641 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.6"
+version = "2.4.7"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 1af7934bfd99a6a34e2912e98329775f37ae53cb Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Wed, 10 Jun 2026 13:59:31 +0200
Subject: [PATCH 65/80] Retry transient full-scan upload failures
 (502/503/504/408, dropped connections) (#232)

* Retry transient full-scan upload failures (502/503/504/408, dropped connections)

A full-scan upload can fail transiently at the gateway/connection level -
an HTTP 502/503/504/408, a dropped or reset connection, or a client-side
timeout - without the server having created the scan. The CLI previously
made exactly one attempt, so an entire run (including a completed
reachability analysis) died on a single transient failure even though a
retried upload almost always succeeds.

create_full_scan now retries the fullscans POST up to 3 total attempts with
increasing waits (~10s, then ~30s, plus jitter) on transient failures only:
APIBadGateway (502), APIConnectionError, APITimeout, and catch-all APIFailure
whose embedded original_status_code is 408/503/504. Dedicated 4xx classes,
catch-all 400s, and error payloads are never retried. In these failure modes
the server never finished reading the request body, so no scan was created
and a retry does not duplicate one; in the rare case where a gateway timeout
races a request the server later completes, the extra scan is benign and
superseded by the retry (as if the CLI had run twice).

The retry loop lives inside the existing try/finally so the brotli-compressed
.socket.facts.json.br temp files survive until every attempt has finished;
fullscans.post rebuilds its lazy file loaders from the plain paths on every
call, so re-invoking it per attempt is safe.

Assisted-by: Claude Code:claude-opus-4-8

* docs: drop the 'retry almost always succeeds' claim from retry comments

* Move transient-error classification into the SDK; simplify retry loop

Address review feedback on the upload retry:

- The retry decision now delegates to APIFailure.is_transient_error()
  (socketdev>=3.3.0, SocketDev/socket-sdk-python#93), which classifies
  by the HTTP status code the SDK records when raising. The CLI no
  longer encodes the SDK's exception hierarchy or parses status codes
  out of message text, so SDK restructuring can't silently break the
  classification.
- The backoff schedule is now the single source of truth for the loop:
  FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS = (10.0, 30.0, None), where
  each entry is the wait before the next attempt and the final None
  re-raises instead of retrying. FULL_SCAN_UPLOAD_MAX_ATTEMPTS is
  computed from its length.

Note: uv.lock is intentionally not regenerated yet - socketdev 3.3.0
must be released to PyPI first (blocked on socket-sdk-python#93).

* Lock socketdev 3.3.0

socketdev 3.3.0 is now released, unblocking the >=3.3.0 floor bump.
---
 CHANGELOG.md                       |  19 ++
 pyproject.toml                     |   4 +-
 socketsecurity/__init__.py         |   2 +-
 socketsecurity/core/__init__.py    |  44 ++++-
 tests/unit/test_full_scan_retry.py | 285 +++++++++++++++++++++++++++++
 uv.lock                            |  10 +-
 6 files changed, 355 insertions(+), 9 deletions(-)
 create mode 100644 tests/unit/test_full_scan_retry.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 060d486..e8d3d05 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## 2.4.8
+
+### Fixed: retry transient full-scan upload failures
+
+- The full-scan upload (`POST /orgs/<org>/full-scans`) now retries transient
+  gateway/connection failures — HTTP 502/503/504/408, dropped or reset connections, and
+  request timeouts — up to 3 total attempts with increasing waits (~10s, then ~30s, plus
+  jitter). Such failures are intermittent and a retried upload almost always succeeds.
+  In these failure modes the server never finished reading the request body, so no scan
+  was created and a retry does not duplicate one; in the rare case where a gateway
+  timeout races a request the server later completes, the extra scan is benign and
+  superseded by the retried one (as if the CLI had run twice).
+  Non-transient errors (400/401/403/404/429 and error payloads) are never retried. Each
+  retry logs a warning explaining what failed and when the next attempt happens.
+- Requires `socketdev>=3.3.0`: the SDK now records the HTTP status code on the exceptions
+  it raises and owns the transient-vs-deterministic classification
+  (`APIFailure.is_transient_error()`), so the CLI no longer parses status codes out of
+  exception message text.
+
 ## 2.4.7
 
 ### Changed: pin @coana-tech/cli version; auto-update is now opt-in
diff --git a/pyproject.toml b/pyproject.toml
index 6bed831..7876f8d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.7"
+version = "2.4.8"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
@@ -16,7 +16,7 @@ dependencies = [
     'GitPython',
     'packaging',
     'python-dotenv',
-    "socketdev>=3.2.1,<4.0.0",
+    "socketdev>=3.3.0,<4.0.0",
     "bs4>=0.0.2",
     "markdown>=3.10",
     "brotli>=1.0.9; platform_python_implementation == 'CPython'",
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 91c7faf..9f1797f 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.7'
+__version__ = '2.4.8'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 20ff28f..4e6c032 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1,5 +1,6 @@
 import logging
 import os
+import random
 import re
 import sys
 import tarfile
@@ -76,6 +77,21 @@
 TIER1_FINALIZE_MAX_ATTEMPTS = 3
 TIER1_FINALIZE_BACKOFF_SECONDS = 1.0
 
+# Full scan upload retry policy. An upload can fail transiently at the gateway/connection
+# level (an HTTP 502/503/504/408, a dropped or reset connection, or a client-side timeout)
+# without the server having created the scan; the SDK classifies those failures via
+# APIFailure.is_transient_error() (socketdev>=3.3.0). In these failure modes no scan was
+# created, so a retry does not duplicate one. (A duplicate is possible only if a gateway
+# timeout races a request the server later completes; that is benign - the retried scan
+# supersedes the orphaned one, same as running the CLI twice.)
+#
+# Each schedule entry is the wait before the next attempt once the current one fails (plus
+# a little jitter so a fleet of CI jobs hitting the same failure doesn't retry in
+# lock-step); the final None means the last attempt's failure is re-raised, not retried.
+FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS = (10.0, 30.0, None)
+FULL_SCAN_UPLOAD_MAX_ATTEMPTS = len(FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS)
+FULL_SCAN_UPLOAD_BACKOFF_JITTER_SECONDS = 2.0
+
 
 def _humanize_alert_type(alert_type: str) -> str:
     """Convert a camelCase/PascalCase alert type into a Title-Cased label.
@@ -787,7 +803,33 @@ def create_full_scan(self, files: List[str], params: FullScanParams, base_paths:
         # facts file under the per-file upload size cap. See _compress_facts_files_for_upload.
         upload_files, compressed_temp_files = self._compress_facts_files_for_upload(files)
         try:
-            res = self.sdk.fullscans.post(upload_files, params, use_types=True, use_lazy_loading=True, max_open_files=50, base_paths=base_paths)
+            # Retry transient gateway/timeout failures (502/503/504/408, dropped connections,
+            # timeouts) with increasing waits. In these failure modes the server never finished
+            # reading the request body, so no scan was created and a retry does not duplicate
+            # one (see the retry-policy comment above FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS).
+            # fullscans.post() rebuilds its lazy file loaders from the plain paths in
+            # upload_files on every call, so simply calling it again per attempt is safe. The
+            # loop must stay inside this try so the temp .br files (cleaned up in the finally
+            # below) outlive every attempt.
+            for attempt, backoff_seconds in enumerate(FULL_SCAN_UPLOAD_BACKOFF_SCHEDULE_SECONDS, start=1):
+                try:
+                    res = self.sdk.fullscans.post(upload_files, params, use_types=True, use_lazy_loading=True, max_open_files=50, base_paths=base_paths)
+                    break
+                except APIFailure as error:
+                    if backoff_seconds is None or not error.is_transient_error():
+                        raise
+                    wait_seconds = backoff_seconds + random.uniform(
+                        0, FULL_SCAN_UPLOAD_BACKOFF_JITTER_SECONDS
+                    )
+                    # SDK error messages can span many lines (path + response headers); the
+                    # first line carries the status, which is all the warning needs.
+                    error_summary = str(error).strip().splitlines()[0] if str(error).strip() else ""
+                    log.warning(
+                        f"Full scan upload failed with {type(error).__name__}({error_summary}), "
+                        f"retrying in {wait_seconds:.0f}s "
+                        f"(attempt {attempt + 1}/{FULL_SCAN_UPLOAD_MAX_ATTEMPTS})"
+                    )
+                    time.sleep(wait_seconds)
         finally:
             for temp_file in compressed_temp_files:
                 try:
diff --git a/tests/unit/test_full_scan_retry.py b/tests/unit/test_full_scan_retry.py
new file mode 100644
index 0000000..b31bb11
--- /dev/null
+++ b/tests/unit/test_full_scan_retry.py
@@ -0,0 +1,285 @@
+"""Tests for the full-scan upload retry on transient gateway/connection failures.
+
+A `POST /orgs/<org>/full-scans` upload can fail transiently (an HTTP 502/503/504/408, a
+dropped or reset connection, or a timeout) without the server having created the scan.
+`Core.create_full_scan` retries the failures the SDK classifies as transient
+(`APIFailure.is_transient_error()`, socketdev>=3.3.0); these tests cover the retry
+decision, the loop bounds, and that the temporary brotli-compressed facts files survive
+until every attempt has finished.
+"""
+
+import logging
+from unittest.mock import MagicMock
+
+import pytest
+from socketdev.exceptions import (
+    APIAccessDenied,
+    APIBadGateway,
+    APIConnectionError,
+    APIFailure,
+    APIResourceNotFound,
+    APITimeout,
+)
+from socketdev.fullscans import FullScanMetadata
+
+from socketsecurity.core import (
+    FULL_SCAN_UPLOAD_MAX_ATTEMPTS,
+    SOCKET_FACTS_BROTLI_FILENAME,
+    SOCKET_FACTS_FILENAME,
+    Core,
+)
+
+
+def _success_response():
+    metadata = FullScanMetadata(
+        id="scan-1",
+        created_at="2026-01-01T00:00:00Z",
+        updated_at="2026-01-01T00:00:00Z",
+        organization_id="org-1",
+        repository_id="repo-1",
+        branch="main",
+        html_report_url="https://socket.dev/report",
+    )
+    response = MagicMock()
+    response.success = True
+    response.data = metadata
+    return response
+
+
+# Catch-all APIFailure as the SDK raises it for statuses without a dedicated class
+# (socketdev/core/api.py); the recorded status_code drives is_transient_error().
+def _catch_all_failure(status_code: int) -> APIFailure:
+    return APIFailure(
+        f"Bad Request: HTTP original_status_code:{status_code}\n"
+        f"Path: https://api.socket.dev/v0/orgs/org/full-scans\n\n"
+        f"Headers:\ncf-ray: abc123",
+        status_code=status_code,
+    )
+
+
+@pytest.fixture
+def core_with_mock_sdk():
+    # Build a Core without running org setup; we only exercise create_full_scan.
+    core = Core.__new__(Core)
+    core.sdk = MagicMock()
+    core.cli_config = None  # skip the tier1 finalize branch
+    return core
+
+
+@pytest.fixture(autouse=True)
+def no_sleep(mocker):
+    return mocker.patch("socketsecurity.core.time.sleep")
+
+
+def test_upload_succeeds_first_try(core_with_mock_sdk, tmp_path, no_sleep):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.return_value = _success_response()
+
+    full_scan = core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert full_scan.id == "scan-1"
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 1
+    no_sleep.assert_not_called()
+
+
+def test_upload_retries_on_502_then_succeeds(
+    core_with_mock_sdk, tmp_path, no_sleep, caplog
+):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = [
+        APIBadGateway(),
+        APIBadGateway(),
+        _success_response(),
+    ]
+
+    with caplog.at_level(logging.WARNING, logger="socketdev"):
+        full_scan = core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert full_scan.id == "scan-1"
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 3
+    assert no_sleep.call_count == 2  # waits before attempts 2 and 3
+    retry_warnings = [r for r in caplog.records if "retrying in" in r.message]
+    assert len(retry_warnings) == 2
+    assert "APIBadGateway" in retry_warnings[0].message
+    assert f"(attempt 2/{FULL_SCAN_UPLOAD_MAX_ATTEMPTS})" in retry_warnings[0].message
+
+
+def test_upload_raises_after_exhausting_attempts(
+    core_with_mock_sdk, tmp_path, no_sleep
+):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = APIBadGateway()
+
+    with pytest.raises(APIBadGateway):
+        core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert (
+        core_with_mock_sdk.sdk.fullscans.post.call_count
+        == FULL_SCAN_UPLOAD_MAX_ATTEMPTS
+    )
+
+
+@pytest.mark.parametrize("status_code", [408, 503, 504])
+def test_upload_retries_on_catch_all_transient_statuses(
+    core_with_mock_sdk, tmp_path, no_sleep, status_code
+):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = [
+        _catch_all_failure(status_code),
+        _success_response(),
+    ]
+
+    full_scan = core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert full_scan.id == "scan-1"
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 2
+
+
+@pytest.mark.parametrize("error_class", [APIConnectionError, APITimeout])
+def test_upload_retries_on_connection_level_errors(
+    core_with_mock_sdk, tmp_path, no_sleep, error_class
+):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = [
+        error_class(),
+        _success_response(),
+    ]
+
+    full_scan = core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert full_scan.id == "scan-1"
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 2
+
+
+def test_upload_does_not_retry_on_400(core_with_mock_sdk, tmp_path, no_sleep):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = _catch_all_failure(400)
+
+    with pytest.raises(APIFailure):
+        core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 1
+    no_sleep.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "error_class,status_code", [(APIAccessDenied, 401), (APIResourceNotFound, 404)]
+)
+def test_upload_does_not_retry_on_dedicated_4xx_classes(
+    core_with_mock_sdk, tmp_path, no_sleep, error_class, status_code
+):
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = error_class(
+        status_code=status_code
+    )
+
+    with pytest.raises(error_class):
+        core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 1
+    no_sleep.assert_not_called()
+
+
+def test_upload_does_not_retry_on_error_payload(core_with_mock_sdk, tmp_path, no_sleep):
+    # A response that came back but reports failure (res.success False) is not transient.
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    failed = MagicMock()
+    failed.success = False
+    failed.message = "tarball too large"
+    failed.status = 200
+    core_with_mock_sdk.sdk.fullscans.post.return_value = failed
+
+    with pytest.raises(Exception, match="tarball too large"):
+        core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == 1
+    no_sleep.assert_not_called()
+
+
+def test_temp_br_file_survives_retries_and_is_cleaned_after(
+    core_with_mock_sdk, tmp_path, no_sleep
+):
+    # The brotli-compressed facts sibling must stay on disk across every retry attempt
+    # (the SDK re-reads it per call) and only be deleted once all attempts finished.
+    facts = tmp_path / SOCKET_FACTS_FILENAME
+    facts.write_text('{"components": []}')
+    compressed = tmp_path / SOCKET_FACTS_BROTLI_FILENAME
+    br_present_per_attempt = []
+
+    def post_side_effect(upload_files, *args, **kwargs):
+        br_present_per_attempt.append(compressed.is_file())
+        assert str(compressed) in upload_files
+        if len(br_present_per_attempt) < 3:
+            raise APIBadGateway()
+        return _success_response()
+
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = post_side_effect
+
+    full_scan = core_with_mock_sdk.create_full_scan([str(facts)], MagicMock())
+
+    assert full_scan.id == "scan-1"
+    assert br_present_per_attempt == [True, True, True]
+    assert not compressed.exists()  # cleaned up after the attempts finished
+    assert facts.is_file()  # the original facts file is never touched
+
+
+def test_temp_br_file_cleaned_after_exhausted_retries(
+    core_with_mock_sdk, tmp_path, no_sleep
+):
+    facts = tmp_path / SOCKET_FACTS_FILENAME
+    facts.write_text('{"components": []}')
+    compressed = tmp_path / SOCKET_FACTS_BROTLI_FILENAME
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = APIBadGateway()
+
+    with pytest.raises(APIBadGateway):
+        core_with_mock_sdk.create_full_scan([str(facts)], MagicMock())
+
+    assert (
+        core_with_mock_sdk.sdk.fullscans.post.call_count
+        == FULL_SCAN_UPLOAD_MAX_ATTEMPTS
+    )
+    assert not compressed.exists()
+
+
+class _StubFailure(APIFailure):
+    """An APIFailure whose transience is fixed, regardless of class or status code."""
+
+    def __init__(self, transient: bool):
+        super().__init__("stub failure")
+        self._transient = transient
+
+    def is_transient_error(self) -> bool:
+        return self._transient
+
+
+@pytest.mark.parametrize("transient,expected_calls", [(True, 2), (False, 1)])
+def test_retry_decision_delegates_to_sdk_classification(
+    core_with_mock_sdk, tmp_path, no_sleep, transient, expected_calls
+):
+    # The CLI encodes no knowledge of the SDK's exception hierarchy or status codes:
+    # the retry decision is exactly APIFailure.is_transient_error(). (The transient /
+    # non-transient truth table itself is tested in the SDK, next to the code that
+    # raises the exceptions.)
+    manifest = tmp_path / "package.json"
+    manifest.write_text("{}")
+    core_with_mock_sdk.sdk.fullscans.post.side_effect = [
+        _StubFailure(transient),
+        _success_response(),
+    ]
+
+    if transient:
+        full_scan = core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+        assert full_scan.id == "scan-1"
+    else:
+        with pytest.raises(_StubFailure):
+            core_with_mock_sdk.create_full_scan([str(manifest)], MagicMock())
+
+    assert core_with_mock_sdk.sdk.fullscans.post.call_count == expected_calls
diff --git a/uv.lock b/uv.lock
index 29cd641..0ed1361 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1270,20 +1270,20 @@ wheels = [
 
 [[package]]
 name = "socketdev"
-version = "3.2.1"
+version = "3.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/21/65/07df2bf6e490c56544fb06e4cfde059b2572fdd5b02ff352c766b1d5f7ce/socketdev-3.2.1.tar.gz", hash = "sha256:7db910a98628473e8ec06822deb01b6bd465b385e9e8ea405f2b7526e8258074", size = 179279, upload-time = "2026-06-03T18:08:19.806Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/25/30/16155f7f27d18274f364b3bd3506ee45d17f53fc8938aaea9a618054449b/socketdev-3.3.0.tar.gz", hash = "sha256:3d60bd4ac3201e9d581b1fe02bf2e6aef1b90c13ae75d15a8664aa9ef966734e", size = 181519, upload-time = "2026-06-10T11:41:17.942Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/53/01/fff70923755b3a187ca971189fb078a2aaedcad42d682abfdd06f3445def/socketdev-3.2.1-py3-none-any.whl", hash = "sha256:6dc762d78baea8011dc22f2afe49c84c926e640a6879bd7b58c3abdd4e29e8bb", size = 67266, upload-time = "2026-06-03T18:08:18.029Z" },
+    { url = "https://files.pythonhosted.org/packages/33/dd/25622e033182e8c744d2420bb4f056206edc096a1e5ce8e4af4b0a0c0791/socketdev-3.3.0-py3-none-any.whl", hash = "sha256:513c045ce42bdd6cc2bb66a527f5863e0c399e56dbdcb1832cd5d94a5fb1a5e4", size = 67956, upload-time = "2026-06-10T11:41:16.534Z" },
 ]
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.7"
+version = "2.4.8"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
@@ -1340,7 +1340,7 @@ requires-dist = [
     { name = "python-dotenv" },
     { name = "requests" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.3.0" },
-    { name = "socketdev", specifier = ">=3.2.1,<4.0.0" },
+    { name = "socketdev", specifier = ">=3.3.0,<4.0.0" },
     { name = "twine", marker = "extra == 'dev'" },
     { name = "uv", marker = "extra == 'dev'", specifier = ">=0.1.0" },
 ]

From 82a47568f2a602a8600db5610bd032382ce6ffa3 Mon Sep 17 00:00:00 2001
From: Benjamin Barslev Nielsen <benjaminbarslev@gmail.com>
Date: Fri, 12 Jun 2026 10:17:37 +0200
Subject: [PATCH 66/80] feat: stream CLI log transcripts and run status to
 Socket backend (#201)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: stream CLI logs to /python-cli-runs/* lifecycle endpoints

Buffer the CLI's own log records and POST them in 5s batches to a new
register/upload/finalize lifecycle so the admin dashboard renders what
the user saw in their terminal alongside the run's terminal status.

New modules:
- core/cli_run.py — register_cli_run / finalize_cli_run helpers
- core/log_uploader.py — BatchedLogUploader (daemon-thread flusher,
  chunked under the 256KB cap, swallows network errors, drains on
  shutdown) and UploadingLogHandler routing log records to it
- core/streaming.py — setup_streaming() wires both into the socketcli
  and socketdev loggers, forces them to DEBUG so uploads capture the
  full history regardless of local terminal verbosity, and returns a
  teardown callable for the caller to register with atexit
- set_run_status() propagates the terminal status through the teardown;
  socketcli.py exception handlers call it for KeyboardInterrupt
  (cancelled), uncaught Exception (failure), and any SystemExit with a
  non-zero code (failure) so sys.exit() paths inside main_code surface
  correctly instead of defaulting to success

Best-effort end-to-end: registration failures fall back to no-streaming
and never block the scan. Opt out with --disable-server-log-streaming.

Tested against local depscan with the matching /v0/python-cli-runs/*
endpoints; 173 unit tests pass.

* chore: drop per-batch size chunking to match upstream uploader

The 256 KB ceiling I added speculatively when the server cap was 256 KB
no longer matches the reference implementation we're mirroring, which
sends each flush as a single POST regardless of size. With the server
cap now well above any plausible single-flush volume, chunking is
unnecessary and divergent — drop it.

Removes _chunk_by_size, _MAX_BATCH_BYTES, and the four chunking tests.
_flush now POSTs the entire buffered batch as one request.

* chore: drop integration field from cli-run register payload

The server-side handler now rejects unknown fields and the integration
column has been removed from the schema (it was plumbed end-to-end but
never displayed, filtered, or grouped on). Stop sending it.

Removes the integration parameter from register_cli_run and
setup_streaming, drops the corresponding wiring in socketcli.py, and
prunes the now-pointless test_register_cli_run_omits_integration_when_falsy
case.

* feat: link cli-run to its full_scan via report_run_id on finalize

The depscan side now joins cli_run → full_scans → repositories via the
report_run_id field to surface the scanned repo in the admin dashboard
view of each CLI run. Wire the CLI to send the full_scan_id (== the
report_run_id depscan expects) when it has one.

- finalize_cli_run accepts an optional report_run_id and includes it
  (nullable) in the POST body.
- streaming.py adds a module-level _report_run_id holder and a
  set_report_run_id() setter; teardown passes it through to finalize.
- socketcli.py captures diff.id at a single chokepoint after the
  diff-producing branches converge, guarded against the NO_DIFF_RAN /
  NO_SCAN_RAN sentinel values.

The field is nullable end-to-end so CLI invocations that fail before
producing a diff (or are run in modes that don't create one) still
finalize cleanly.

* chore: bump version to 2.2.87 for streaming logs feature

- socketsecurity/__init__.py: __version__ → 2.2.87
- pyproject.toml: version → 2.2.87
- CHANGELOG.md: new 2.2.87 entry describing the streaming-logs feature

Required by .github/workflows/version-check.yml, which fails the PR if
the version isn't incremented relative to main.

* feat: flip streaming logs to opt-in via --upload-logs

The Socket backend changed its register contract so that log streaming
is now opt-in rather than default-on. The CLI always calls register
(cheap, lets the server force-enable for specific orgs) and gates the
downstream upload/finalize lifecycle on the response.

Wire changes:
- POST /v0/python-cli-runs body adds a required `share_logs` field.
- Response: { log_streaming_enabled: bool, run_id: <uuid|null> }.
  When log_streaming_enabled is false, run_id is null and the CLI
  skips the upload + finalize calls entirely.

CLI changes:
- New `--upload-logs` flag (default off). When set, the CLI sends
  share_logs=true on register.
- Removed `--disable-server-log-streaming` — default is off, so an
  opt-out flag no longer makes sense.
- register_cli_run takes a required share_logs arg and returns None
  whenever log_streaming_enabled is false (whatever the reason: client
  opted out, server denied, server unreachable).

Bumps version to 2.2.88 and updates the CHANGELOG entry to reflect
the opt-in shape.

* chore: regenerate uv.lock for version 2.4.8

The version-check workflow added in main now requires uv.lock to be
updated whenever pyproject.toml changes, and the SFW smoke jobs run
`uv sync --locked`, which fails on an out-of-sync lockfile.

* feat: add --no-upload-logs to explicitly decline log upload

Backend now distinguishes "user wants out" from "user said nothing":
- `decline_logs: true` (the new flag) overrides every other signal
  including the server-side org-level override, so users with a
  legal/consent reason for no upload get a guaranteed off.
- `share_logs: true` (the existing --upload-logs) opts in.
- Otherwise the server applies its own policy.

Argparse enforces that --upload-logs and --no-upload-logs are mutually
exclusive (post-parse check via parser.error so dash/underscore aliases
on either side still coexist with the same dests).

register_cli_run now sends both `share_logs` and `decline_logs` in the
payload; setup_streaming forwards both. CHANGELOG 2.4.8 entry updated
to call out --no-upload-logs alongside --upload-logs.

* chore: bump version to 2.4.9

2.4.8 already shipped with the full-scan retry fix; this release adds
the opt-in --upload-logs streaming channel.

* chore: bump __version__ to 2.4.9

version-check reads socketsecurity/__init__.py; the previous bump
only touched pyproject.toml.

* refactor: address PR review on streaming logs

- collapse upload_logs/decline_logs config fields into a single
  Optional[bool] (tri-state); projection to share_logs/decline_logs
  happens at the setup_streaming call site.
- streaming.py: replace module-level globals + atexit teardown with a
  StreamingLogs context manager. set_run_status disappears entirely —
  __exit__ infers the run status from the exception that closed the
  with block. set_report_run_id is now an instance method. Logger
  handler wiring iterates over (cli_logger, sdk_logger) instead of
  repeating itself.
- log_uploader.py: drop _LEVEL_MAP, use logging.getLevelName directly.
  Wire format changes WARN/ERROR-for-CRITICAL to WARNING/CRITICAL.
- log_uploader.py: tidy BatchedLogUploader.stop so the final _flush
  always runs and the thread shutdown only runs when there is a thread.
- socketcli.py: wrap main_code body in 'with setup_streaming(...) as
  streaming:'; cli()'s exception handlers no longer need to set status
  before re-raising.
- tests updated for the CM API and the new level strings.

* test(log_uploader): cover cross-thread emit during active flush

Adds a deterministic regression test that parks the uploader thread
inside _flush() via a threading.Event, emits a real log record from
the main thread while _FLUSH_GUARD.active is set on the uploader
thread, and asserts the record lands in the next batch (not dropped).
Documents that the thread-local guard only blocks recursive emits on
the uploader thread itself.

* refactor(config): use store_const + mutually exclusive group for log-upload flags

--upload-logs and --no-upload-logs now share dest='upload_logs' via
store_const (True/False) in an argparse mutually exclusive group.
argparse handles the conflict natively; drop the manual mutex check
and the tri-state mapping in from_args. args.upload_logs is now
Optional[bool] directly.

The undocumented --upload_logs / --no_upload_logs snake_case aliases
are dropped (introduced earlier in this same unreleased branch; no
users to break).

* refactor: push upload_logs tri-state down to the API boundary

- register_cli_run now takes upload_logs: Optional[bool] directly and
  projects to share_logs/decline_logs only when building the JSON
  payload. The invalid (share=True, decline=True) state is now
  unrepresentable above the wire boundary.
- StreamingLogs.__init__ takes upload_logs instead of the two
  booleans; the call site in socketcli.py just passes
  config.upload_logs through.
- Drop the setup_streaming alias; call sites use StreamingLogs
  directly.
- Drop the dead 'except SystemExit: raise' in cli() — re-raising is
  the default for an unhandled exception path.
- Tests updated for the new signatures.

* fix(cli_run): broaden register exception handling to honor 'never break the scan'

The earlier register_cli_run only caught APIFailure on the request and
ValueError/JSONDecodeError on resp.json(). If the server returned JSON
that parsed but wasn't an object (e.g. a list), body.get(...) would
raise AttributeError and propagate out of StreamingLogs.__enter__,
crashing the CLI before the scan even starts.

Collapse the request + parse + field-extraction into a single try with
a broad except so any unexpected failure — known or otherwise — falls
back to no-streaming, matching the module docstring's promise.

Add regression tests for non-dict JSON bodies and arbitrary unexpected
exceptions from client.request.
---
 CHANGELOG.md                        |    8 +
 pyproject.toml                      |    2 +-
 socketsecurity/__init__.py          |    2 +-
 socketsecurity/config.py            |   24 +
 socketsecurity/core/cli_run.py      |   79 ++
 socketsecurity/core/log_uploader.py |  112 +++
 socketsecurity/core/streaming.py    |  112 +++
 socketsecurity/socketcli.py         | 1337 ++++++++++++++-------------
 tests/unit/test_cli_run.py          |  125 +++
 tests/unit/test_log_uploader.py     |  192 ++++
 tests/unit/test_streaming.py        |  123 +++
 uv.lock                             |    2 +-
 12 files changed, 1453 insertions(+), 665 deletions(-)
 create mode 100644 socketsecurity/core/cli_run.py
 create mode 100644 socketsecurity/core/log_uploader.py
 create mode 100644 socketsecurity/core/streaming.py
 create mode 100644 tests/unit/test_cli_run.py
 create mode 100644 tests/unit/test_log_uploader.py
 create mode 100644 tests/unit/test_streaming.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8d3d05..d83963d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.9
+
+### Added: opt-in streaming log channel via `--upload-logs`
+
+- New `--upload-logs` flag (default off). When set, each CLI invocation registers a run, reports a per-run status (`in_progress` / `success` / `failure` / `cancelled`), and uploads a transcript of its own log output to the Socket backend for that run, visible in the Socket admin views. The transcript is captured regardless of the local `--enable-debug` state; the existing terminal verbosity is unchanged.
+- New `--no-upload-logs` flag (mutually exclusive with `--upload-logs`) explicitly opts the run out of uploading logs, even when an org-level override would otherwise enable it. Use this when you need a guaranteed no-upload guarantee (e.g. legal/consent reasons).
+- The Socket backend can also force-enable streaming for specific orgs in the absence of an explicit opt-out. The feature is best-effort — registration or upload failures silently degrade and never block the scan.
+
 ## 2.4.8
 
 ### Fixed: retry transient full-scan upload failures
diff --git a/pyproject.toml b/pyproject.toml
index 7876f8d..acff1fb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.8"
+version = "2.4.9"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 9f1797f..cc95834 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.8'
+__version__ = '2.4.9'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 9d9f62d..bad7ed6 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -139,6 +139,9 @@ class CliConfig:
     ignore_commit_files: bool = False
     disable_blocking: bool = False
     disable_ignore: bool = False
+    # Tri-state log-upload preference: True = --upload-logs, False = --no-upload-logs,
+    # None = neither (server-side override decides).
+    upload_logs: Optional[bool] = None
     strict_blocking: bool = False
     integration_type: IntegrationType = "api"
     integration_org_slug: Optional[str] = None
@@ -282,6 +285,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'ignore_commit_files': args.ignore_commit_files,
             'disable_blocking': args.disable_blocking,
             'disable_ignore': args.disable_ignore,
+            'upload_logs': args.upload_logs,
             'strict_blocking': args.strict_blocking,
             'integration_type': args.integration,
             'pending_head': args.pending_head,
@@ -866,6 +870,26 @@ def create_argument_parser() -> argparse.ArgumentParser:
         action="store_true",
         help=argparse.SUPPRESS
     )
+    log_upload_group = advanced_group.add_mutually_exclusive_group()
+    log_upload_group.add_argument(
+        "--upload-logs",
+        dest="upload_logs",
+        action="store_const",
+        const=True,
+        help="Upload the CLI's log output to the Socket backend for this run. "
+             "When set, the CLI registers the run with share_logs=true and streams "
+             "its log records in 5s batches. Default off. Mutually exclusive with "
+             "--no-upload-logs."
+    )
+    log_upload_group.add_argument(
+        "--no-upload-logs",
+        dest="upload_logs",
+        action="store_const",
+        const=False,
+        help="Explicitly opt out of uploading CLI logs to the Socket backend, even "
+             "when an org-level override would otherwise enable it. Mutually "
+             "exclusive with --upload-logs."
+    )
     advanced_group.add_argument(
         "--strict-blocking",
         dest="strict_blocking",
diff --git a/socketsecurity/core/cli_run.py b/socketsecurity/core/cli_run.py
new file mode 100644
index 0000000..cea3bfb
--- /dev/null
+++ b/socketsecurity/core/cli_run.py
@@ -0,0 +1,79 @@
+"""Lifecycle helpers for a CLI run on the Socket backend.
+
+A "run" represents a single CLI invocation. `register_cli_run` opens it and
+returns a server-issued `run_id` when streaming is enabled; `finalize_cli_run`
+closes it on exit. The run_id keys the rows that `BatchedLogUploader` POSTs to
+`/python-cli-runs/<run_id>/logs` during the run so the dashboard can show
+what the user saw in their terminal.
+
+Streaming is opt-in via the `share_logs` field on register. The server may
+also force-enable streaming for an org regardless of the client's request,
+so the CLI always calls register and gates on the response's
+`log_streaming_enabled` flag rather than the client's intent.
+
+Both calls are best-effort: failures fall back to no-streaming and never
+prevent the scan from running.
+"""
+
+import json
+import logging
+from typing import Optional
+
+from .cli_client import CliClient
+
+log = logging.getLogger("socketcli")
+
+
+def register_cli_run(
+    client: CliClient,
+    client_version: str,
+    upload_logs: Optional[bool],
+) -> Optional[str]:
+    """Register a CLI run with the backend.
+
+    `upload_logs` is the user's tri-state preference (True / False / None);
+    it's projected to the wire-format `share_logs` and `decline_logs`
+    booleans here, at the API boundary.
+
+    Best-effort: any failure (network, malformed response, unexpected JSON
+    shape, etc.) falls back to no-streaming and must never prevent the
+    scan from running. The single broad except is intentional.
+    """
+    try:
+        resp = client.request(
+            path="python-cli-runs",
+            method="POST",
+            payload=json.dumps({
+                "client_version": client_version,
+                "share_logs": upload_logs is True,
+                "decline_logs": upload_logs is False,
+            }),
+        )
+        body = resp.json()
+        if not body.get("log_streaming_enabled"):
+            log.debug("cli-run register: log streaming not enabled by server")
+            return None
+        run_id = body.get("run_id")
+        if not isinstance(run_id, str) or not run_id:
+            log.debug(f"cli-run register: enabled but missing run_id in response: {body!r}")
+            return None
+        return run_id
+    except Exception as e:
+        log.debug(f"cli-run register failed (streaming disabled): {e}")
+        return None
+
+
+def finalize_cli_run(
+    client: CliClient,
+    run_id: str,
+    status: str = "success",
+    report_run_id: Optional[str] = None,
+) -> None:
+    try:
+        client.request(
+            path=f"python-cli-runs/{run_id}/finalize",
+            method="POST",
+            payload=json.dumps({"status": status, "report_run_id": report_run_id}),
+        )
+    except Exception as e:
+        log.debug(f"cli-run finalize failed (swallowed): {e}")
diff --git a/socketsecurity/core/log_uploader.py b/socketsecurity/core/log_uploader.py
new file mode 100644
index 0000000..de57df4
--- /dev/null
+++ b/socketsecurity/core/log_uploader.py
@@ -0,0 +1,112 @@
+"""Buffer the CLI's local log records and POST them in batches to
+/python-cli-runs/<run_id>/logs so the dashboard's view of a CLI run
+mirrors what the user sees in their terminal.
+
+Behavior:
+- daemon thread, 5s flush
+- swallow all network errors (debug log only)
+- skip empty buffers
+- drain on shutdown
+- at-most-once semantics (failed batches dropped, not retried)
+
+A thread-local recursion guard prevents the uploader's own request-error
+log lines (emitted by `cli_client.py`'s `socketdev` logger) from being
+re-enqueued during a flush.
+"""
+
+import json
+import logging
+import threading
+from datetime import datetime, timezone
+from typing import Optional
+
+from .cli_client import CliClient
+
+log = logging.getLogger(__name__)
+
+_FLUSH_GUARD = threading.local()
+
+
+def _now_str() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M:%S.%f")[:-3]
+
+
+class BatchedLogUploader:
+    def __init__(
+        self,
+        client: CliClient,
+        run_id: str,
+        flush_interval: float = 5.0,
+    ):
+        self._client = client
+        self._run_id = run_id
+        self._flush_interval = flush_interval
+        self._buf: list = []
+        self._lock = threading.Lock()
+        self._stop = threading.Event()
+        self._thread: Optional[threading.Thread] = None
+
+    def add(self, entry: dict) -> None:
+        with self._lock:
+            self._buf.append(entry)
+
+    def start(self) -> None:
+        if self._thread is not None:
+            return
+        self._thread = threading.Thread(
+            target=self._run,
+            name=f"socket-log-uploader-{self._run_id[:8]}",
+            daemon=True,
+        )
+        self._thread.start()
+
+    def stop(self, timeout: float = 2.0) -> None:
+        if self._thread is not None:
+            self._stop.set()
+            self._thread.join(timeout=timeout)
+            self._thread = None
+        self._flush()
+
+    def _run(self) -> None:
+        while not self._stop.is_set():
+            self._flush()
+            self._stop.wait(self._flush_interval)
+
+    def _flush(self) -> None:
+        with self._lock:
+            if not self._buf:
+                return
+            batch = self._buf
+            self._buf = []
+
+        _FLUSH_GUARD.active = True
+        try:
+            self._client.request(
+                path=f"python-cli-runs/{self._run_id}/logs",
+                method="POST",
+                payload=json.dumps({"logs": batch}),
+            )
+        except Exception as e:
+            log.debug(f"log upload failed (swallowed, {len(batch)} entries dropped): {e}")
+        finally:
+            _FLUSH_GUARD.active = False
+
+
+class UploadingLogHandler(logging.Handler):
+    def __init__(self, uploader: BatchedLogUploader, context: str = "socket-python-cli"):
+        super().__init__()
+        self._uploader = uploader
+        self._context = context
+
+    def emit(self, record: logging.LogRecord) -> None:
+        if getattr(_FLUSH_GUARD, "active", False):
+            return
+        try:
+            self._uploader.add({
+                "timestamp": _now_str(),
+                "level": logging.getLevelName(record.levelno),
+                "message": self.format(record),
+                "context": self._context,
+            })
+        except Exception:
+            self.handleError(record)
diff --git a/socketsecurity/core/streaming.py b/socketsecurity/core/streaming.py
new file mode 100644
index 0000000..20b45ea
--- /dev/null
+++ b/socketsecurity/core/streaming.py
@@ -0,0 +1,112 @@
+"""Server log streaming pipeline for one CLI run.
+
+`StreamingLogs` is a context manager. On enter it registers a run with the
+backend, attaches handlers that route the CLI's own log output through both
+the local terminal and a batched uploader, and forces the loggers into DEBUG
+so the upload captures everything regardless of local terminal verbosity.
+On exit it tears the handlers back down and finalizes the run; the status
+sent to finalize is inferred from the exception that closed the `with`
+block (success / failure / cancelled).
+
+If registration fails the manager becomes a no-op — nothing is wired up and
+__exit__ does nothing.
+"""
+
+import logging
+from typing import Optional
+
+from .cli_client import CliClient
+from .cli_run import finalize_cli_run, register_cli_run
+from .log_uploader import BatchedLogUploader, UploadingLogHandler
+
+
+class StreamingLogs:
+    def __init__(
+        self,
+        *,
+        client: CliClient,
+        cli_logger: logging.Logger,
+        sdk_logger: logging.Logger,
+        client_version: str,
+        upload_logs: Optional[bool],
+        enable_debug: bool,
+    ):
+        self._client = client
+        self._loggers = (cli_logger, sdk_logger)
+        self._client_version = client_version
+        self._upload_logs = upload_logs
+        self._enable_debug = enable_debug
+
+        self._run_id: Optional[str] = None
+        self._report_run_id: Optional[str] = None
+        self._uploader: Optional[BatchedLogUploader] = None
+        self._upload_handler: Optional[UploadingLogHandler] = None
+        self._terminal_handler: Optional[logging.StreamHandler] = None
+        self._saved_levels: tuple = ()
+        self._saved_propagate: tuple = ()
+
+    def set_report_run_id(self, report_run_id: Optional[str]) -> None:
+        self._report_run_id = report_run_id
+
+    def __enter__(self) -> "StreamingLogs":
+        self._run_id = register_cli_run(
+            self._client,
+            client_version=self._client_version,
+            upload_logs=self._upload_logs,
+        )
+        cli_logger = self._loggers[0]
+        if not self._run_id:
+            cli_logger.debug("server log streaming not active for this run")
+            return self
+
+        self._uploader = BatchedLogUploader(self._client, self._run_id)
+        self._uploader.start()
+        self._upload_handler = UploadingLogHandler(self._uploader, context="socket-python-cli")
+        self._upload_handler.setFormatter(logging.Formatter("%(message)s"))
+
+        self._terminal_handler = logging.StreamHandler()
+        self._terminal_handler.setLevel(logging.DEBUG if self._enable_debug else logging.INFO)
+        self._terminal_handler.setFormatter(logging.Formatter("%(asctime)s: %(message)s"))
+
+        self._saved_levels = tuple(lg.level for lg in self._loggers)
+        self._saved_propagate = tuple(lg.propagate for lg in self._loggers)
+        for lg in self._loggers:
+            lg.setLevel(logging.DEBUG)
+            lg.propagate = False
+            lg.addHandler(self._terminal_handler)
+            lg.addHandler(self._upload_handler)
+
+        cli_logger.debug(f"server log streaming enabled (run_id={self._run_id})")
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb) -> bool:
+        if self._run_id is None:
+            return False
+
+        status = self._status_for_exit(exc_type, exc_val)
+        for lg in self._loggers:
+            lg.removeHandler(self._upload_handler)
+        self._uploader.stop()
+        finalize_cli_run(
+            self._client,
+            self._run_id,
+            status=status,
+            report_run_id=self._report_run_id,
+        )
+        for lg in self._loggers:
+            lg.removeHandler(self._terminal_handler)
+        for lg, level, propagate in zip(self._loggers, self._saved_levels, self._saved_propagate):
+            lg.setLevel(level)
+            lg.propagate = propagate
+        return False
+
+    @staticmethod
+    def _status_for_exit(exc_type, exc_val) -> str:
+        if exc_type is None:
+            return "success"
+        if issubclass(exc_type, KeyboardInterrupt):
+            return "cancelled"
+        # SystemExit with code 0 / None is a clean exit; non-zero codes signal failure.
+        if issubclass(exc_type, SystemExit) and not getattr(exc_val, "code", None):
+            return "success"
+        return "failure"
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 1ab9e90..7eeabbd 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -20,6 +20,7 @@
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
 from socketsecurity.core.socket_config import SocketConfig
+from socketsecurity.core.streaming import StreamingLogs
 from socketsecurity.fossa_compat import build_fossa_attribution_payload
 from socketsecurity.output import OutputHandler
 
@@ -183,644 +184,632 @@ def main_code():
     client = CliClient(socket_config)
     sdk.api.api_url = socket_config.api_url
     log.debug("loaded client")
-    core = Core(socket_config, sdk, config)
-    log.debug("loaded core")
-    
-    # Check for required dependencies if reachability analysis is enabled
-    if config.reach:
-        log.info("Reachability analysis enabled, checking for required dependencies...")
-        required_deps = ["npm", "node", "uv", "npx"]
-        missing_deps = []
-        found_deps = []
-        
-        for dep in required_deps:
-            if shutil.which(dep):
-                found_deps.append(dep)
-                log.debug(f"Found required dependency: {dep}")
-            else:
-                missing_deps.append(dep)
-        
-        if missing_deps:
-            log.error(f"Reachability analysis requires the following dependencies: {', '.join(required_deps)}")
-            log.error(f"Missing dependencies: {', '.join(missing_deps)}")
-            log.error("Please install the missing dependencies and try again.")
-            sys.exit(3)
-        
-        log.info(f"All required dependencies found: {', '.join(found_deps)}")
-        
-        # Check if organization has an enterprise plan
-        log.info("Checking organization plan for reachability analysis eligibility...")
-        org_response = sdk.org.get(use_types=True)
-        organizations = org_response.get("organizations", {})
+
+    with StreamingLogs(
+        client=client,
+        cli_logger=log,
+        sdk_logger=socket_logger,
+        client_version=config.version,
+        upload_logs=config.upload_logs,
+        enable_debug=config.enable_debug,
+    ) as streaming:
+        core = Core(socket_config, sdk, config)
+        log.debug("loaded core")
         
-        if organizations:
-            org_id = next(iter(organizations))
-            org_plan = organizations[org_id].get('plan', '')
+        # Check for required dependencies if reachability analysis is enabled
+        if config.reach:
+            log.info("Reachability analysis enabled, checking for required dependencies...")
+            required_deps = ["npm", "node", "uv", "npx"]
+            missing_deps = []
+            found_deps = []
+            
+            for dep in required_deps:
+                if shutil.which(dep):
+                    found_deps.append(dep)
+                    log.debug(f"Found required dependency: {dep}")
+                else:
+                    missing_deps.append(dep)
             
-            # Check if plan matches enterprise* pattern (enterprise, enterprise_trial, etc.)
-            if not org_plan.startswith('enterprise'):
-                log.error("Reachability analysis is only available for enterprise plans.")
-                log.error(f"Your organization plan is: {org_plan}")
-                log.error("Please upgrade to an enterprise plan to use reachability analysis.")
+            if missing_deps:
+                log.error(f"Reachability analysis requires the following dependencies: {', '.join(required_deps)}")
+                log.error(f"Missing dependencies: {', '.join(missing_deps)}")
+                log.error("Please install the missing dependencies and try again.")
                 sys.exit(3)
             
-            log.info(f"Organization plan verified: {org_plan}")
-        else:
-            log.error("Unable to retrieve organization information for plan verification.")
-            sys.exit(3)
-    
-    # Parse files argument
-    try:
-        if isinstance(config.files, list):
-            # Already a list, use as-is
-            specified_files = config.files
-        elif isinstance(config.files, str):
-            # Handle different string formats
-            files_str = config.files.strip()
+            log.info(f"All required dependencies found: {', '.join(found_deps)}")
             
-            # If the string is wrapped in extra quotes, strip them
-            if ((files_str.startswith('"') and files_str.endswith('"')) or 
-                (files_str.startswith("'") and files_str.endswith("'"))):
-                # Check if the inner content looks like JSON
-                inner_str = files_str[1:-1]
-                if inner_str.startswith('[') and inner_str.endswith(']'):
-                    files_str = inner_str
+            # Check if organization has an enterprise plan
+            log.info("Checking organization plan for reachability analysis eligibility...")
+            org_response = sdk.org.get(use_types=True)
+            organizations = org_response.get("organizations", {})
             
-            # Try to parse as JSON
-            try:
-                specified_files = json.loads(files_str)
-            except json.JSONDecodeError:
-                # If JSON parsing fails, try replacing single quotes with double quotes
-                files_str = files_str.replace("'", '"')
-                specified_files = json.loads(files_str)
-        else:
-            # Default to empty list
-            specified_files = []
-    except Exception as error:
-        log.error(f"Unable to parse files argument: {config.files}")
-        log.error(f"Error details: {error}")
-        log.debug(f"Files type: {type(config.files)}")
-        log.debug(f"Files repr: {repr(config.files)}")
-        sys.exit(3)
+            if organizations:
+                org_id = next(iter(organizations))
+                org_plan = organizations[org_id].get('plan', '')
+                
+                # Check if plan matches enterprise* pattern (enterprise, enterprise_trial, etc.)
+                if not org_plan.startswith('enterprise'):
+                    log.error("Reachability analysis is only available for enterprise plans.")
+                    log.error(f"Your organization plan is: {org_plan}")
+                    log.error("Please upgrade to an enterprise plan to use reachability analysis.")
+                    sys.exit(3)
+                
+                log.info(f"Organization plan verified: {org_plan}")
+            else:
+                log.error("Unable to retrieve organization information for plan verification.")
+                sys.exit(3)
+        
+        # Parse files argument
+        try:
+            if isinstance(config.files, list):
+                # Already a list, use as-is
+                specified_files = config.files
+            elif isinstance(config.files, str):
+                # Handle different string formats
+                files_str = config.files.strip()
+                
+                # If the string is wrapped in extra quotes, strip them
+                if ((files_str.startswith('"') and files_str.endswith('"')) or 
+                    (files_str.startswith("'") and files_str.endswith("'"))):
+                    # Check if the inner content looks like JSON
+                    inner_str = files_str[1:-1]
+                    if inner_str.startswith('[') and inner_str.endswith(']'):
+                        files_str = inner_str
+                
+                # Try to parse as JSON
+                try:
+                    specified_files = json.loads(files_str)
+                except json.JSONDecodeError:
+                    # If JSON parsing fails, try replacing single quotes with double quotes
+                    files_str = files_str.replace("'", '"')
+                    specified_files = json.loads(files_str)
+            else:
+                # Default to empty list
+                specified_files = []
+        except Exception as error:
+            log.error(f"Unable to parse files argument: {config.files}")
+            log.error(f"Error details: {error}")
+            log.debug(f"Files type: {type(config.files)}")
+            log.debug(f"Files repr: {repr(config.files)}")
+            sys.exit(3)
 
-    # Determine if files were explicitly specified
-    files_explicitly_specified = config.files != "[]" and len(specified_files) > 0
-    
-    # Variable to track if we need to override files with facts file
-    facts_file_to_submit = None
-    # Variable to track SBOM files to submit when using --reach-use-only-pregenerated-sboms
-    sbom_files_to_submit = None
-    
-    # Git setup
-    is_repo = False
-    git_repo: Git
-    try:
-        git_repo = Git(config.target_path)
-        is_repo = True
-        if not config.repo:
-            config.repo = git_repo.repo_name
-        if not config.commit_sha:
-            config.commit_sha = git_repo.commit_str
-        if not config.branch:
-            config.branch = git_repo.branch
-        if not config.committers:
-            config.committers = [git_repo.get_formatted_committer()]
-        if not config.commit_message:
-            config.commit_message = git_repo.commit_message
-    except InvalidGitRepositoryError:
+        # Determine if files were explicitly specified
+        files_explicitly_specified = config.files != "[]" and len(specified_files) > 0
+        
+        # Variable to track if we need to override files with facts file
+        facts_file_to_submit = None
+        # Variable to track SBOM files to submit when using --reach-use-only-pregenerated-sboms
+        sbom_files_to_submit = None
+        
+        # Git setup
         is_repo = False
-        log.debug("Not a git repository, setting ignore_commit_files=True")
-        config.ignore_commit_files = True
-    except NoSuchPathError:
-        raise Exception(f"Unable to find path {config.target_path}")
-
-    # Track whether repo/branch fell back to the default sentinels so reachability can skip
-    # forwarding them as coana cache-bucket keys (computed before any workspace suffixing).
-    repo_defaulted = not config.repo
-    branch_defaulted = not config.branch
-
-    if not config.repo:
-        base_repo_name = DEFAULT_REPO_NAME
-        if config.workspace_name:
-            config.repo = f"{base_repo_name}-{config.workspace_name}"
-        else:
-            config.repo = base_repo_name
-        log.debug(f"Using default repository name: {config.repo}")
+        git_repo: Git
+        try:
+            git_repo = Git(config.target_path)
+            is_repo = True
+            if not config.repo:
+                config.repo = git_repo.repo_name
+            if not config.commit_sha:
+                config.commit_sha = git_repo.commit_str
+            if not config.branch:
+                config.branch = git_repo.branch
+            if not config.committers:
+                config.committers = [git_repo.get_formatted_committer()]
+            if not config.commit_message:
+                config.commit_message = git_repo.commit_message
+        except InvalidGitRepositoryError:
+            is_repo = False
+            log.debug("Not a git repository, setting ignore_commit_files=True")
+            config.ignore_commit_files = True
+        except NoSuchPathError:
+            raise Exception(f"Unable to find path {config.target_path}")
+
+        # Track whether repo/branch fell back to the default sentinels so reachability can skip
+        # forwarding them as coana cache-bucket keys (computed before any workspace suffixing).
+        repo_defaulted = not config.repo
+        branch_defaulted = not config.branch
 
-    if not config.branch:
-        config.branch = DEFAULT_BRANCH_NAME
-        log.debug(f"Using default branch name: {config.branch}")
+        if not config.repo:
+            base_repo_name = DEFAULT_REPO_NAME
+            if config.workspace_name:
+                config.repo = f"{base_repo_name}-{config.workspace_name}"
+            else:
+                config.repo = base_repo_name
+            log.debug(f"Using default repository name: {config.repo}")
 
-    # Calculate the scan paths - combine target_path with sub_paths if provided
-    scan_paths = []
-    base_paths = [config.target_path]  # Always use target_path as the single base path
-    
-    if config.sub_paths:
-        for sub_path in config.sub_paths:
-            full_scan_path = os.path.join(config.target_path, sub_path)
-            log.debug(f"Using sub-path for scanning: {full_scan_path}")
-            # Verify the scan path exists
-            if not os.path.exists(full_scan_path):
-                raise Exception(f"Sub-path does not exist: {full_scan_path}")
-            scan_paths.append(full_scan_path)
-    else:
-        # Use the target path as the single scan path
-        scan_paths = [config.target_path]
-
-    # Modify repository name if workspace_name is provided
-    if config.workspace_name and config.repo:
-        config.repo = f"{config.repo}-{config.workspace_name}"
-        log.debug(f"Modified repository name with workspace suffix: {config.repo}")
-    elif config.workspace_name and not config.repo:
-        # If no repo name was set but workspace_name is provided, we'll use it later
-        log.debug(f"Workspace name provided: {config.workspace_name}")
-
-    # Run reachability analysis if enabled
-    if config.reach:
-        from socketsecurity.core.tools.reachability import ReachabilityAnalyzer
-
-        log.info("Starting reachability analysis...")
-
-        # Find manifest files in scan paths (excluding .socket.facts.json to avoid circular dependency)
-        log.info("Finding manifest files for reachability analysis...")
-        manifest_files = []
-
-        # Always find all manifest files for the tar hash upload
-        for scan_path in scan_paths:
-            scan_manifests = core.find_files(scan_path)
-            # Filter out .socket.facts.json files from manifest upload
-            scan_manifests = [f for f in scan_manifests if not f.endswith('.socket.facts.json')]
-            manifest_files.extend(scan_manifests)
+        if not config.branch:
+            config.branch = DEFAULT_BRANCH_NAME
+            log.debug(f"Using default branch name: {config.branch}")
+
+        # Calculate the scan paths - combine target_path with sub_paths if provided
+        scan_paths = []
+        base_paths = [config.target_path]  # Always use target_path as the single base path
         
-        if not manifest_files:
-            log.warning("No manifest files found for reachability analysis")
+        if config.sub_paths:
+            for sub_path in config.sub_paths:
+                full_scan_path = os.path.join(config.target_path, sub_path)
+                log.debug(f"Using sub-path for scanning: {full_scan_path}")
+                # Verify the scan path exists
+                if not os.path.exists(full_scan_path):
+                    raise Exception(f"Sub-path does not exist: {full_scan_path}")
+                scan_paths.append(full_scan_path)
         else:
-            log.info(f"Found {len(manifest_files)} manifest files for reachability upload")
+            # Use the target path as the single scan path
+            scan_paths = [config.target_path]
+
+        # Modify repository name if workspace_name is provided
+        if config.workspace_name and config.repo:
+            config.repo = f"{config.repo}-{config.workspace_name}"
+            log.debug(f"Modified repository name with workspace suffix: {config.repo}")
+        elif config.workspace_name and not config.repo:
+            # If no repo name was set but workspace_name is provided, we'll use it later
+            log.debug(f"Workspace name provided: {config.workspace_name}")
+
+        # Run reachability analysis if enabled
+        if config.reach:
+            from socketsecurity.core.tools.reachability import ReachabilityAnalyzer
+
+            log.info("Starting reachability analysis...")
+
+            # Find manifest files in scan paths (excluding .socket.facts.json to avoid circular dependency)
+            log.info("Finding manifest files for reachability analysis...")
+            manifest_files = []
+
+            # Always find all manifest files for the tar hash upload
+            for scan_path in scan_paths:
+                scan_manifests = core.find_files(scan_path)
+                # Filter out .socket.facts.json files from manifest upload
+                scan_manifests = [f for f in scan_manifests if not f.endswith('.socket.facts.json')]
+                manifest_files.extend(scan_manifests)
             
-            # Upload manifests and get tar hash
-            log.info("Uploading manifest files...")
-            try:
-                # Get org_slug early (we'll need it)
-                org_slug = core.config.org_slug
-                
-                # Upload manifest files
-                tar_hash = sdk.uploadmanifests.upload_manifest_files(
-                    org_slug=org_slug,
-                    file_paths=manifest_files,
-                    workspace=config.repo or "default-workspace",
-                    base_paths=[config.target_path],
-                    use_lazy_loading=False
-                )
-                log.info(f"Manifest upload successful, tar hash: {tar_hash}")
-                
-                # Initialize and run reachability analyzer
-                analyzer = ReachabilityAnalyzer(sdk, config.api_token)
-                
-                # Determine output path
-                output_path = config.reach_output_file or ".socket.facts.json"
-                
-                # Run the analysis
-                result = analyzer.run_reachability_analysis(
-                    org_slug=org_slug,
-                    target_directory=config.target_path,
-                    tar_hash=tar_hash,
-                    output_path=output_path,
-                    timeout=config.reach_analysis_timeout,
-                    memory_limit=config.reach_analysis_memory_limit,
-                    ecosystems=config.reach_ecosystems,
-                    # Union the deprecated --reach-exclude-paths with the unified --exclude-paths
-                    # and forward verbatim to coana's --exclude-dirs. Patterns are scan-root
-                    # relative; coana resolves --exclude-dirs relative to its `run` target, which
-                    # here is `.` == cwd == scan root, so passthrough is correct. If a nested
-                    # target is ever supported, re-anchor patterns to the target first (see Node's
-                    # pathRelativeToTarget in exclude-paths.mts).
-                    exclude_paths=(
-                        (config.reach_exclude_paths or []) + (config.exclude_paths or [])
-                    ) or None,
-                    min_severity=config.reach_min_severity,
-                    skip_cache=config.reach_skip_cache or False,
-                    disable_analytics=config.reach_disable_analytics or False,
-                    enable_analysis_splitting=config.reach_enable_analysis_splitting or False,
-                    detailed_analysis_log_file=config.reach_detailed_analysis_log_file or False,
-                    lazy_mode=config.reach_lazy_mode or False,
-                    repo_name=None if repo_defaulted else config.repo,
-                    branch_name=None if branch_defaulted else config.branch,
-                    version=config.reach_version,
-                    concurrency=config.reach_concurrency,
-                    additional_params=config.reach_additional_params,
-                    allow_unverified=config.allow_unverified,
-                    enable_debug=config.enable_debug,
-                    use_only_pregenerated_sboms=config.reach_use_only_pregenerated_sboms,
-                    continue_on_analysis_errors=config.reach_continue_on_analysis_errors,
-                    continue_on_install_errors=config.reach_continue_on_install_errors,
-                    continue_on_missing_lock_files=config.reach_continue_on_missing_lock_files,
-                    continue_on_no_source_files=config.reach_continue_on_no_source_files,
-                    reach_debug=config.reach_debug,
-                    disable_external_tool_checks=config.reach_disable_external_tool_checks,
-                )
-                
-                log.info("Reachability analysis completed successfully")
-                log.info(f"Results written to: {result['report_path']}")
-                if result.get('scan_id'):
-                    log.info(f"Reachability scan ID: {result['scan_id']}")
-                
-                # If only-facts-file mode, mark the facts file for submission
-                if config.only_facts_file:
-                    facts_file_to_submit = os.path.abspath(output_path)
-                    log.info(f"Only-facts-file mode: will submit only {facts_file_to_submit}")
-
-                # If reach-use-only-pregenerated-sboms mode, submit CDX, SPDX, and facts file
-                if config.reach_use_only_pregenerated_sboms:
-                    # Find only CDX and SPDX files for the final scan submission
-                    sbom_files_to_submit = []
-                    for scan_path in scan_paths:
-                        sbom_files_to_submit.extend(core.find_sbom_files(scan_path))
-                    # Use relative path for facts file
-                    if os.path.exists(output_path):
-                        sbom_files_to_submit.append(output_path)
-                    log.info(f"Pre-generated SBOMs mode: will submit {len(sbom_files_to_submit)} files (CDX, SPDX, and facts file)")
+            if not manifest_files:
+                log.warning("No manifest files found for reachability analysis")
+            else:
+                log.info(f"Found {len(manifest_files)} manifest files for reachability upload")
                 
-            except Exception as e:
-                log.error(f"Reachability analysis failed: {str(e)}")
-                if not config.disable_blocking:
-                    sys.exit(3)
-        
-        log.info("Continuing with normal scan flow...")
-
-    scm = None
-    if config.scm == "github":
-        from socketsecurity.core.scm.github import Github, GithubConfig
-        # Only pass pr_number if it's not "0" (the default)
-        pr_number = config.pr_number if config.pr_number != "0" else None
-        github_config = GithubConfig.from_env(pr_number=pr_number)
-        scm = Github(client=client, config=github_config)
-    elif config.scm == 'gitlab':
-        from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
-        gitlab_config = GitlabConfig.from_env()
-        scm = Gitlab(client=client, config=gitlab_config)
-    # Don't override config.default_branch if it was explicitly set via --default-branch flag
-    # Only use SCM detection if --default-branch wasn't provided
-    if scm is not None and not config.default_branch:
-        config.default_branch = scm.config.is_default_branch
-
-    # Override files if only-facts-file mode is active
-    if facts_file_to_submit:
-        specified_files = [facts_file_to_submit]
-        files_explicitly_specified = True
-        log.debug(f"Overriding files to only submit facts file: {facts_file_to_submit}")
-
-    # Override files if reach-use-only-pregenerated-sboms mode is active
-    if sbom_files_to_submit:
-        specified_files = sbom_files_to_submit
-        files_explicitly_specified = True
-        log.debug(f"Overriding files to submit only SBOM files (CDX, SPDX, and facts): {sbom_files_to_submit}")
-
-    # Determine files to check based on the new logic
-    files_to_check = []
-    force_api_mode = False
-    force_diff_mode = False
-    
-    if files_explicitly_specified:
-        # Case 2: Files are specified - use them and don't check commit details
-        files_to_check = specified_files
-        log.debug(f"Using explicitly specified files: {files_to_check}")
-    elif not config.ignore_commit_files and is_repo:
-        # Case 1: Files not specified and --ignore-commit-files not set - try to find changed files from commit
-        files_to_check = git_repo.changed_files
-        log.debug(f"Using changed files from commit: {files_to_check}")
-    elif config.ignore_commit_files and is_repo:
-        # Case 3: Git repo with --ignore-commit-files - force diff mode
-        files_to_check = []
-        force_diff_mode = True
-        log.debug("Git repo with --ignore-commit-files: forcing diff mode")
-    else:
-        # Case 4: Not a git repo (ignore_commit_files was auto-set to True)
+                # Upload manifests and get tar hash
+                log.info("Uploading manifest files...")
+                try:
+                    # Get org_slug early (we'll need it)
+                    org_slug = core.config.org_slug
+                    
+                    # Upload manifest files
+                    tar_hash = sdk.uploadmanifests.upload_manifest_files(
+                        org_slug=org_slug,
+                        file_paths=manifest_files,
+                        workspace=config.repo or "default-workspace",
+                        base_paths=[config.target_path],
+                        use_lazy_loading=False
+                    )
+                    log.info(f"Manifest upload successful, tar hash: {tar_hash}")
+                    
+                    # Initialize and run reachability analyzer
+                    analyzer = ReachabilityAnalyzer(sdk, config.api_token)
+                    
+                    # Determine output path
+                    output_path = config.reach_output_file or ".socket.facts.json"
+                    
+                    # Run the analysis
+                    result = analyzer.run_reachability_analysis(
+                        org_slug=org_slug,
+                        target_directory=config.target_path,
+                        tar_hash=tar_hash,
+                        output_path=output_path,
+                        timeout=config.reach_analysis_timeout,
+                        memory_limit=config.reach_analysis_memory_limit,
+                        ecosystems=config.reach_ecosystems,
+                        # Union the deprecated --reach-exclude-paths with the unified --exclude-paths
+                        # and forward verbatim to coana's --exclude-dirs. Patterns are scan-root
+                        # relative; coana resolves --exclude-dirs relative to its `run` target, which
+                        # here is `.` == cwd == scan root, so passthrough is correct. If a nested
+                        # target is ever supported, re-anchor patterns to the target first (see Node's
+                        # pathRelativeToTarget in exclude-paths.mts).
+                        exclude_paths=(
+                            (config.reach_exclude_paths or []) + (config.exclude_paths or [])
+                        ) or None,
+                        min_severity=config.reach_min_severity,
+                        skip_cache=config.reach_skip_cache or False,
+                        disable_analytics=config.reach_disable_analytics or False,
+                        enable_analysis_splitting=config.reach_enable_analysis_splitting or False,
+                        detailed_analysis_log_file=config.reach_detailed_analysis_log_file or False,
+                        lazy_mode=config.reach_lazy_mode or False,
+                        repo_name=None if repo_defaulted else config.repo,
+                        branch_name=None if branch_defaulted else config.branch,
+                        version=config.reach_version,
+                        concurrency=config.reach_concurrency,
+                        additional_params=config.reach_additional_params,
+                        allow_unverified=config.allow_unverified,
+                        enable_debug=config.enable_debug,
+                        use_only_pregenerated_sboms=config.reach_use_only_pregenerated_sboms,
+                        continue_on_analysis_errors=config.reach_continue_on_analysis_errors,
+                        continue_on_install_errors=config.reach_continue_on_install_errors,
+                        continue_on_missing_lock_files=config.reach_continue_on_missing_lock_files,
+                        continue_on_no_source_files=config.reach_continue_on_no_source_files,
+                        reach_debug=config.reach_debug,
+                        disable_external_tool_checks=config.reach_disable_external_tool_checks,
+                    )
+                    
+                    log.info("Reachability analysis completed successfully")
+                    log.info(f"Results written to: {result['report_path']}")
+                    if result.get('scan_id'):
+                        log.info(f"Reachability scan ID: {result['scan_id']}")
+                    
+                    # If only-facts-file mode, mark the facts file for submission
+                    if config.only_facts_file:
+                        facts_file_to_submit = os.path.abspath(output_path)
+                        log.info(f"Only-facts-file mode: will submit only {facts_file_to_submit}")
+
+                    # If reach-use-only-pregenerated-sboms mode, submit CDX, SPDX, and facts file
+                    if config.reach_use_only_pregenerated_sboms:
+                        # Find only CDX and SPDX files for the final scan submission
+                        sbom_files_to_submit = []
+                        for scan_path in scan_paths:
+                            sbom_files_to_submit.extend(core.find_sbom_files(scan_path))
+                        # Use relative path for facts file
+                        if os.path.exists(output_path):
+                            sbom_files_to_submit.append(output_path)
+                        log.info(f"Pre-generated SBOMs mode: will submit {len(sbom_files_to_submit)} files (CDX, SPDX, and facts file)")
+                    
+                except Exception as e:
+                    log.error(f"Reachability analysis failed: {str(e)}")
+                    if not config.disable_blocking:
+                        sys.exit(3)
+            
+            log.info("Continuing with normal scan flow...")
+
+        scm = None
+        if config.scm == "github":
+            from socketsecurity.core.scm.github import Github, GithubConfig
+            # Only pass pr_number if it's not "0" (the default)
+            pr_number = config.pr_number if config.pr_number != "0" else None
+            github_config = GithubConfig.from_env(pr_number=pr_number)
+            scm = Github(client=client, config=github_config)
+        elif config.scm == 'gitlab':
+            from socketsecurity.core.scm.gitlab import Gitlab, GitlabConfig
+            gitlab_config = GitlabConfig.from_env()
+            scm = Gitlab(client=client, config=gitlab_config)
+        # Don't override config.default_branch if it was explicitly set via --default-branch flag
+        # Only use SCM detection if --default-branch wasn't provided
+        if scm is not None and not config.default_branch:
+            config.default_branch = scm.config.is_default_branch
+
+        # Override files if only-facts-file mode is active
+        if facts_file_to_submit:
+            specified_files = [facts_file_to_submit]
+            files_explicitly_specified = True
+            log.debug(f"Overriding files to only submit facts file: {facts_file_to_submit}")
+
+        # Override files if reach-use-only-pregenerated-sboms mode is active
+        if sbom_files_to_submit:
+            specified_files = sbom_files_to_submit
+            files_explicitly_specified = True
+            log.debug(f"Overriding files to submit only SBOM files (CDX, SPDX, and facts): {sbom_files_to_submit}")
+
+        # Determine files to check based on the new logic
         files_to_check = []
-        # If --enable-diff is set, force diff mode for non-git repos
-        log.debug(f"Case 4: Non-git repo - config.enable_diff={config.enable_diff}, type={type(config.enable_diff)}")
-        if config.enable_diff:
+        force_api_mode = False
+        force_diff_mode = False
+        
+        if files_explicitly_specified:
+            # Case 2: Files are specified - use them and don't check commit details
+            files_to_check = specified_files
+            log.debug(f"Using explicitly specified files: {files_to_check}")
+        elif not config.ignore_commit_files and is_repo:
+            # Case 1: Files not specified and --ignore-commit-files not set - try to find changed files from commit
+            files_to_check = git_repo.changed_files
+            log.debug(f"Using changed files from commit: {files_to_check}")
+        elif config.ignore_commit_files and is_repo:
+            # Case 3: Git repo with --ignore-commit-files - force diff mode
+            files_to_check = []
             force_diff_mode = True
-            log.debug("Non-git repo with --enable-diff: forcing diff mode")
+            log.debug("Git repo with --ignore-commit-files: forcing diff mode")
         else:
-            log.debug("Non-git repo without --enable-diff: will use full scan mode")
+            # Case 4: Not a git repo (ignore_commit_files was auto-set to True)
+            files_to_check = []
+            # If --enable-diff is set, force diff mode for non-git repos
+            log.debug(f"Case 4: Non-git repo - config.enable_diff={config.enable_diff}, type={type(config.enable_diff)}")
+            if config.enable_diff:
+                force_diff_mode = True
+                log.debug("Non-git repo with --enable-diff: forcing diff mode")
+            else:
+                log.debug("Non-git repo without --enable-diff: will use full scan mode")
 
-    # Check if we have supported manifest files
-    has_supported_files = files_to_check and core.has_manifest_files(files_to_check)
-    
-    # If using sub_paths, we need to check if manifest files exist in the scan paths
-    if config.sub_paths and not files_explicitly_specified:
-        # Override file checking to look in the scan paths instead
-        # Get manifest files from all scan paths
+        # Check if we have supported manifest files
+        has_supported_files = files_to_check and core.has_manifest_files(files_to_check)
+        
+        # If using sub_paths, we need to check if manifest files exist in the scan paths
+        if config.sub_paths and not files_explicitly_specified:
+            # Override file checking to look in the scan paths instead
+            # Get manifest files from all scan paths
+            try:
+                all_scan_files = []
+                for scan_path in scan_paths:
+                    scan_files = core.find_files(scan_path)
+                    all_scan_files.extend(scan_files)
+                has_supported_files = len(all_scan_files) > 0
+                log.debug(f"Found {len(all_scan_files)} manifest files across {len(scan_paths)} scan paths")
+            except Exception as e:
+                log.debug(f"Error finding files in scan paths: {e}")
+                has_supported_files = False
+        
+        # Case 3: If no supported files or files are empty, force API mode (no PR comments)
+        # BUT: Don't force API mode if we're in force_diff_mode
+        log.debug(f"files_to_check={files_to_check}, has_supported_files={has_supported_files}, force_diff_mode={force_diff_mode}, config.enable_diff={config.enable_diff}")
+        if not has_supported_files and not force_diff_mode:
+            force_api_mode = True
+            log.debug("No supported manifest files found, forcing API mode")
+        log.debug(f"force_api_mode={force_api_mode}")
+        
+        # Determine scan behavior
+        should_skip_scan = False  # Always perform scan, but behavior changes based on supported files
+        if not has_supported_files and not force_diff_mode:
+            # No supported files and not forcing diff - still scan but in API mode
+            should_skip_scan = False
+            log.debug("No supported files but will scan in API mode")
+        else:
+            log.debug("Found supported manifest files or forcing diff mode, proceeding with normal scan")
+
+        org_slug = core.config.org_slug
+        if config.repo_is_public:
+            core.config.repo_visibility = "public"
+        if config.excluded_ecosystems and len(config.excluded_ecosystems) > 0:
+            core.config.excluded_ecosystems = config.excluded_ecosystems
+        integration_type = config.integration_type
+        integration_org_slug = config.integration_org_slug or org_slug
         try:
-            all_scan_files = []
-            for scan_path in scan_paths:
-                scan_files = core.find_files(scan_path)
-                all_scan_files.extend(scan_files)
-            has_supported_files = len(all_scan_files) > 0
-            log.debug(f"Found {len(all_scan_files)} manifest files across {len(scan_paths)} scan paths")
-        except Exception as e:
-            log.debug(f"Error finding files in scan paths: {e}")
-            has_supported_files = False
-    
-    # Case 3: If no supported files or files are empty, force API mode (no PR comments)
-    # BUT: Don't force API mode if we're in force_diff_mode
-    log.debug(f"files_to_check={files_to_check}, has_supported_files={has_supported_files}, force_diff_mode={force_diff_mode}, config.enable_diff={config.enable_diff}")
-    if not has_supported_files and not force_diff_mode:
-        force_api_mode = True
-        log.debug("No supported manifest files found, forcing API mode")
-    log.debug(f"force_api_mode={force_api_mode}")
-    
-    # Determine scan behavior
-    should_skip_scan = False  # Always perform scan, but behavior changes based on supported files
-    if not has_supported_files and not force_diff_mode:
-        # No supported files and not forcing diff - still scan but in API mode
-        should_skip_scan = False
-        log.debug("No supported files but will scan in API mode")
-    else:
-        log.debug("Found supported manifest files or forcing diff mode, proceeding with normal scan")
-
-    org_slug = core.config.org_slug
-    if config.repo_is_public:
-        core.config.repo_visibility = "public"
-    if config.excluded_ecosystems and len(config.excluded_ecosystems) > 0:
-        core.config.excluded_ecosystems = config.excluded_ecosystems
-    integration_type = config.integration_type
-    integration_org_slug = config.integration_org_slug or org_slug
-    try:
-        pr_number = int(config.pr_number)
-    except (ValueError, TypeError):
-        pr_number = 0
-
-    # Determine if this should be treated as default branch
-    # Priority order:
-    # 1. If --default-branch flag is explicitly set to True, use that
-    # 2. If SCM detected it's the default branch, use that
-    # 3. If it's a git repo, use git_repo.is_default_branch
-    # 4. Otherwise, default to False
-    if config.default_branch:
-        is_default_branch = True
-    elif scm is not None and hasattr(scm.config, 'is_default_branch') and scm.config.is_default_branch:
-        is_default_branch = True
-    elif is_repo and git_repo.is_default_branch:
-        is_default_branch = True
-    else:
-        is_default_branch = False
-
-    params = FullScanParams(
-        org_slug=org_slug,
-        integration_type=integration_type,
-        integration_org_slug=integration_org_slug,
-        repo=config.repo,
-        branch=config.branch,
-        commit_message=config.commit_message,
-        commit_hash=config.commit_sha,
-        pull_request=pr_number,
-        committers=config.committers,
-        make_default_branch=is_default_branch,
-        set_as_pending_head=is_default_branch,
-        tmp=False,
-        scan_type='socket_tier1' if config.reach else 'socket',
-        workspace=config.workspace or None,
-    )
-
-    params.include_license_details = not config.exclude_license_details
-
-    # Initialize diff
-    diff = Diff()
-    diff.id = "NO_DIFF_RAN"
-    diff.diff_url = ""
-    diff.report_url = ""
-
-    # Handle SCM-specific flows
-    log.debug(f"Flow decision: scm={scm is not None}, force_diff_mode={force_diff_mode}, force_api_mode={force_api_mode}, enable_diff={config.enable_diff}")
-
-    def _is_unprocessed(c):
-        """Check if an ignore comment has not yet been marked with '+1' reaction.
-        For GitHub, reactions['+1'] is already in the comment response (no extra call).
-        For GitLab, has_thumbsup_reaction() makes a lazy API call per comment."""
-        if getattr(c, "reactions", {}).get("+1"):
-            return False
-        if hasattr(scm, "has_thumbsup_reaction") and scm.has_thumbsup_reaction(c.id):
-            return False
-        return True
-
-    if scm is not None and scm.check_event_type() == "comment":
-        # FIXME: This entire flow should be a separate command called "filter_ignored_alerts_in_comments"
-        # It's not related to scanning or diff generation - it just:
-        # 1. Triggers on comments in GitHub/GitLab
-        # 2. If comment was from Socket, checks for ignore reactions
-        # 3. Updates the comment to remove ignored alerts
-        # This is completely separate from the main scanning functionality
-        log.info("Comment initiated flow")
-
-        if not config.disable_ignore:
-            comments = scm.get_comments_for_pr()
-
-            # Emit telemetry for ignore comments before +1 reaction is added.
-            # The +1 reaction (added by remove_comment_alerts) serves as the "processed" marker.
-            if "ignore" in comments:
-                unprocessed = [c for c in comments["ignore"] if _is_unprocessed(c)]
-                if unprocessed:
-                    try:
-                        events = []
-                        for c in unprocessed:
-                            single = {"ignore": [c]}
-                            ignore_all, ignore_commands = Comments.get_ignore_options(single)
-                            user = getattr(c, "user", None) or getattr(c, "author", None) or {}
-                            now = datetime.now(timezone.utc).isoformat()
-                            shared_fields = {
-                                "event_kind": "user-action",
-                                "client_action": "ignore",
-                                "alert_action": "error",
-                                "event_sender_created_at": now,
-                                "vcs_provider": integration_type,
-                                "owner": config.repo.split("/")[0] if "/" in config.repo else "",
-                                "repo": config.repo,
-                                "pr_number": pr_number,
-                                "ignore_all": ignore_all,
-                                "sender_name": user.get("login") or user.get("username", ""),
-                                "sender_id": str(user.get("id", "")),
-                            }
-                            if ignore_commands:
-                                for name, version in ignore_commands:
-                                    events.append({**shared_fields, "event_id": str(uuid4()), "artifact_input": f"{name}@{version}"})
-                            elif ignore_all:
-                                events.append({**shared_fields, "event_id": str(uuid4())})
-
-                        if events:
-                            log.debug(f"Ignore telemetry: {len(events)} events to send")
-                            client.post_telemetry_events(org_slug, events)
-                    except Exception as e:
-                        log.warning(f"Failed to send ignore telemetry: {e}")
-
-            log.debug("Removing comment alerts")
-            scm.remove_comment_alerts(comments)
+            pr_number = int(config.pr_number)
+        except (ValueError, TypeError):
+            pr_number = 0
+
+        # Determine if this should be treated as default branch
+        # Priority order:
+        # 1. If --default-branch flag is explicitly set to True, use that
+        # 2. If SCM detected it's the default branch, use that
+        # 3. If it's a git repo, use git_repo.is_default_branch
+        # 4. Otherwise, default to False
+        if config.default_branch:
+            is_default_branch = True
+        elif scm is not None and hasattr(scm.config, 'is_default_branch') and scm.config.is_default_branch:
+            is_default_branch = True
+        elif is_repo and git_repo.is_default_branch:
+            is_default_branch = True
         else:
-            log.info("Ignore commands disabled (--disable-ignore), skipping comment processing")
-    
-    elif scm is not None and scm.check_event_type() != "comment" and not force_api_mode:
-        log.info("Push initiated flow")
-        if scm.check_event_type() == "diff":
-            log.info("Starting comment logic for PR/MR event")
-            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
-            comments = scm.get_comments_for_pr()
+            is_default_branch = False
+
+        params = FullScanParams(
+            org_slug=org_slug,
+            integration_type=integration_type,
+            integration_org_slug=integration_org_slug,
+            repo=config.repo,
+            branch=config.branch,
+            commit_message=config.commit_message,
+            commit_hash=config.commit_sha,
+            pull_request=pr_number,
+            committers=config.committers,
+            make_default_branch=is_default_branch,
+            set_as_pending_head=is_default_branch,
+            tmp=False,
+            scan_type='socket_tier1' if config.reach else 'socket',
+            workspace=config.workspace or None,
+        )
+
+        params.include_license_details = not config.exclude_license_details
+
+        # Initialize diff
+        diff = Diff()
+        diff.id = "NO_DIFF_RAN"
+        diff.diff_url = ""
+        diff.report_url = ""
+
+        # Handle SCM-specific flows
+        log.debug(f"Flow decision: scm={scm is not None}, force_diff_mode={force_diff_mode}, force_api_mode={force_api_mode}, enable_diff={config.enable_diff}")
+
+        def _is_unprocessed(c):
+            """Check if an ignore comment has not yet been marked with '+1' reaction.
+            For GitHub, reactions['+1'] is already in the comment response (no extra call).
+            For GitLab, has_thumbsup_reaction() makes a lazy API call per comment."""
+            if getattr(c, "reactions", {}).get("+1"):
+                return False
+            if hasattr(scm, "has_thumbsup_reaction") and scm.has_thumbsup_reaction(c.id):
+                return False
+            return True
+
+        if scm is not None and scm.check_event_type() == "comment":
+            # FIXME: This entire flow should be a separate command called "filter_ignored_alerts_in_comments"
+            # It's not related to scanning or diff generation - it just:
+            # 1. Triggers on comments in GitHub/GitLab
+            # 2. If comment was from Socket, checks for ignore reactions
+            # 3. Updates the comment to remove ignored alerts
+            # This is completely separate from the main scanning functionality
+            log.info("Comment initiated flow")
 
-            # FIXME: this overwrites diff.new_alerts, which was previously populated by Core.create_issue_alerts
             if not config.disable_ignore:
+                comments = scm.get_comments_for_pr()
+
+                # Emit telemetry for ignore comments before +1 reaction is added.
+                # The +1 reaction (added by remove_comment_alerts) serves as the "processed" marker.
+                if "ignore" in comments:
+                    unprocessed = [c for c in comments["ignore"] if _is_unprocessed(c)]
+                    if unprocessed:
+                        try:
+                            events = []
+                            for c in unprocessed:
+                                single = {"ignore": [c]}
+                                ignore_all, ignore_commands = Comments.get_ignore_options(single)
+                                user = getattr(c, "user", None) or getattr(c, "author", None) or {}
+                                now = datetime.now(timezone.utc).isoformat()
+                                shared_fields = {
+                                    "event_kind": "user-action",
+                                    "client_action": "ignore",
+                                    "alert_action": "error",
+                                    "event_sender_created_at": now,
+                                    "vcs_provider": integration_type,
+                                    "owner": config.repo.split("/")[0] if "/" in config.repo else "",
+                                    "repo": config.repo,
+                                    "pr_number": pr_number,
+                                    "ignore_all": ignore_all,
+                                    "sender_name": user.get("login") or user.get("username", ""),
+                                    "sender_id": str(user.get("id", "")),
+                                }
+                                if ignore_commands:
+                                    for name, version in ignore_commands:
+                                        events.append({**shared_fields, "event_id": str(uuid4()), "artifact_input": f"{name}@{version}"})
+                                elif ignore_all:
+                                    events.append({**shared_fields, "event_id": str(uuid4())})
+
+                            if events:
+                                log.debug(f"Ignore telemetry: {len(events)} events to send")
+                                client.post_telemetry_events(org_slug, events)
+                        except Exception as e:
+                            log.warning(f"Failed to send ignore telemetry: {e}")
+
                 log.debug("Removing comment alerts")
-                alerts_before = list(diff.new_alerts)
-                diff.new_alerts = Comments.remove_alerts(comments, diff.new_alerts)
-
-                ignored_alerts = [a for a in alerts_before if a not in diff.new_alerts]
-                # Emit telemetry per-comment so each event carries the comment author.
-                unprocessed_ignore = [
-                    c for c in comments.get("ignore", [])
-                    if _is_unprocessed(c)
-                ]
-                if ignored_alerts and unprocessed_ignore:
-                    try:
-                        events = []
-                        now = datetime.now(timezone.utc).isoformat()
-                        for c in unprocessed_ignore:
-                            single = {"ignore": [c]}
-                            c_ignore_all, c_ignore_commands = Comments.get_ignore_options(single)
-                            user = getattr(c, "user", None) or getattr(c, "author", None) or {}
-                            sender_name = user.get("login") or user.get("username", "")
-                            sender_id = str(user.get("id", ""))
-
-                            # Match this comment's targets to the actual ignored alerts
-                            matched_alerts = []
-                            if c_ignore_all:
-                                matched_alerts = ignored_alerts
-                            else:
-                                for alert in ignored_alerts:
-                                    full_name = f"{alert.pkg_type}/{alert.pkg_name}"
-                                    purl = (full_name, alert.pkg_version)
-                                    purl_star = (full_name, "*")
-                                    if purl in c_ignore_commands or purl_star in c_ignore_commands:
-                                        matched_alerts.append(alert)
-
-                            shared_fields = {
-                                "event_kind": "user-action",
-                                "client_action": "ignore",
-                                "event_sender_created_at": now,
-                                "vcs_provider": integration_type,
-                                "owner": config.repo.split("/")[0] if "/" in config.repo else "",
-                                "repo": config.repo,
-                                "pr_number": pr_number,
-                                "ignore_all": c_ignore_all,
-                                "sender_name": sender_name,
-                                "sender_id": sender_id,
-                            }
-                            if matched_alerts:
-                                for alert in matched_alerts:
-                                    # Derive alert_action from the alert's resolved action flags
-                                    if getattr(alert, "error", False):
-                                        alert_action = "error"
-                                    elif getattr(alert, "warn", False):
-                                        alert_action = "warn"
-                                    elif getattr(alert, "monitor", False):
-                                        alert_action = "monitor"
-                                    else:
-                                        alert_action = "error"
-                                    events.append({**shared_fields, "alert_action": alert_action, "event_id": str(uuid4()), "artifact_purl": alert.purl})
-                            elif c_ignore_all:
-                                events.append({**shared_fields, "event_id": str(uuid4())})
-
-                        if events:
-                            client.post_telemetry_events(org_slug, events)
-
-                        # Mark ignore comments as processed with +1 reaction
-                        if hasattr(scm, "handle_ignore_reactions"):
-                            scm.handle_ignore_reactions(comments)
-                    except Exception as e:
-                        log.warning(f"Failed to send ignore telemetry: {e}")
+                scm.remove_comment_alerts(comments)
             else:
-                log.info("Ignore commands disabled (--disable-ignore), all alerts will be reported")
-
-            log.debug("Creating Dependency Overview Comment")
-            
-            overview_comment = Messages.dependency_overview_template(diff)
-            log.debug("Creating Security Issues Comment")
-            
-            security_comment = Messages.security_comment_template(diff, config)
-            
-            new_security_comment = True
-            new_overview_comment = True
-            
-            update_old_security_comment = (
-                security_comment is None or
-                security_comment == "" or
-                (len(comments) != 0 and comments.get("security") is not None)
-            )
-            
-            update_old_overview_comment = (
-                overview_comment is None or
-                overview_comment == "" or
-                (len(comments) != 0 and comments.get("overview") is not None)
-            )
-            
-            if len(diff.new_alerts) == 0 or config.disable_security_issue:
-                if not update_old_security_comment:
-                    new_security_comment = False
-                    log.debug("No new alerts or security issue comment disabled")
-                else:
-                    log.debug("Updated security comment with no new alerts")
-            
-            # FIXME: diff.new_packages is never populated, neither is removed_packages
-            if (len(diff.new_packages) == 0) or config.disable_overview:
-                if not update_old_overview_comment:
-                    new_overview_comment = False
-                    log.debug("No new/removed packages or Dependency Overview comment disabled")
+                log.info("Ignore commands disabled (--disable-ignore), skipping comment processing")
+        
+        elif scm is not None and scm.check_event_type() != "comment" and not force_api_mode:
+            log.info("Push initiated flow")
+            if scm.check_event_type() == "diff":
+                log.info("Starting comment logic for PR/MR event")
+                diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
+                comments = scm.get_comments_for_pr()
+
+                # FIXME: this overwrites diff.new_alerts, which was previously populated by Core.create_issue_alerts
+                if not config.disable_ignore:
+                    log.debug("Removing comment alerts")
+                    alerts_before = list(diff.new_alerts)
+                    diff.new_alerts = Comments.remove_alerts(comments, diff.new_alerts)
+
+                    ignored_alerts = [a for a in alerts_before if a not in diff.new_alerts]
+                    # Emit telemetry per-comment so each event carries the comment author.
+                    unprocessed_ignore = [
+                        c for c in comments.get("ignore", [])
+                        if _is_unprocessed(c)
+                    ]
+                    if ignored_alerts and unprocessed_ignore:
+                        try:
+                            events = []
+                            now = datetime.now(timezone.utc).isoformat()
+                            for c in unprocessed_ignore:
+                                single = {"ignore": [c]}
+                                c_ignore_all, c_ignore_commands = Comments.get_ignore_options(single)
+                                user = getattr(c, "user", None) or getattr(c, "author", None) or {}
+                                sender_name = user.get("login") or user.get("username", "")
+                                sender_id = str(user.get("id", ""))
+
+                                # Match this comment's targets to the actual ignored alerts
+                                matched_alerts = []
+                                if c_ignore_all:
+                                    matched_alerts = ignored_alerts
+                                else:
+                                    for alert in ignored_alerts:
+                                        full_name = f"{alert.pkg_type}/{alert.pkg_name}"
+                                        purl = (full_name, alert.pkg_version)
+                                        purl_star = (full_name, "*")
+                                        if purl in c_ignore_commands or purl_star in c_ignore_commands:
+                                            matched_alerts.append(alert)
+
+                                shared_fields = {
+                                    "event_kind": "user-action",
+                                    "client_action": "ignore",
+                                    "event_sender_created_at": now,
+                                    "vcs_provider": integration_type,
+                                    "owner": config.repo.split("/")[0] if "/" in config.repo else "",
+                                    "repo": config.repo,
+                                    "pr_number": pr_number,
+                                    "ignore_all": c_ignore_all,
+                                    "sender_name": sender_name,
+                                    "sender_id": sender_id,
+                                }
+                                if matched_alerts:
+                                    for alert in matched_alerts:
+                                        # Derive alert_action from the alert's resolved action flags
+                                        if getattr(alert, "error", False):
+                                            alert_action = "error"
+                                        elif getattr(alert, "warn", False):
+                                            alert_action = "warn"
+                                        elif getattr(alert, "monitor", False):
+                                            alert_action = "monitor"
+                                        else:
+                                            alert_action = "error"
+                                        events.append({**shared_fields, "alert_action": alert_action, "event_id": str(uuid4()), "artifact_purl": alert.purl})
+                                elif c_ignore_all:
+                                    events.append({**shared_fields, "event_id": str(uuid4())})
+
+                            if events:
+                                client.post_telemetry_events(org_slug, events)
+
+                            # Mark ignore comments as processed with +1 reaction
+                            if hasattr(scm, "handle_ignore_reactions"):
+                                scm.handle_ignore_reactions(comments)
+                        except Exception as e:
+                            log.warning(f"Failed to send ignore telemetry: {e}")
                 else:
-                    log.debug("Updated overview comment with no dependencies")
-            
-            log.debug(f"Adding comments for {config.scm}")
-            scm.add_socket_comments(
-                security_comment,
-                overview_comment,
-                comments,
-                new_security_comment,
-                new_overview_comment
-            )
-        else:
-            log.info("Starting non-PR/MR flow")
-            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
+                    log.info("Ignore commands disabled (--disable-ignore), all alerts will be reported")
 
-        output_handler.handle_output(diff)
+                log.debug("Creating Dependency Overview Comment")
+                
+                overview_comment = Messages.dependency_overview_template(diff)
+                log.debug("Creating Security Issues Comment")
+                
+                security_comment = Messages.security_comment_template(diff, config)
+                
+                new_security_comment = True
+                new_overview_comment = True
+                
+                update_old_security_comment = (
+                    security_comment is None or
+                    security_comment == "" or
+                    (len(comments) != 0 and comments.get("security") is not None)
+                )
+                
+                update_old_overview_comment = (
+                    overview_comment is None or
+                    overview_comment == "" or
+                    (len(comments) != 0 and comments.get("overview") is not None)
+                )
+                
+                if len(diff.new_alerts) == 0 or config.disable_security_issue:
+                    if not update_old_security_comment:
+                        new_security_comment = False
+                        log.debug("No new alerts or security issue comment disabled")
+                    else:
+                        log.debug("Updated security comment with no new alerts")
+                
+                # FIXME: diff.new_packages is never populated, neither is removed_packages
+                if (len(diff.new_packages) == 0) or config.disable_overview:
+                    if not update_old_overview_comment:
+                        new_overview_comment = False
+                        log.debug("No new/removed packages or Dependency Overview comment disabled")
+                    else:
+                        log.debug("Updated overview comment with no dependencies")
+                
+                log.debug(f"Adding comments for {config.scm}")
+                scm.add_socket_comments(
+                    security_comment,
+                    overview_comment,
+                    comments,
+                    new_security_comment,
+                    new_overview_comment
+                )
+            else:
+                log.info("Starting non-PR/MR flow")
+                diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
 
-    elif (config.enable_diff or force_diff_mode) and not force_api_mode:
-        # New logic: --enable-diff or force_diff_mode (from --ignore-commit-files in git repos) forces diff mode
-        log.info("Diff mode enabled without SCM integration")
-        diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
-        output_handler.handle_output(diff)
-    
-    elif (config.enable_diff or force_diff_mode) and force_api_mode:
-        # User requested diff mode but no manifest files were detected - this should not happen with new logic
-        # but keeping as a safety net
-        log.warning("--enable-diff was specified but no supported manifest files were detected in the changed files. Falling back to full scan mode.")
-        log.info("Creating Socket Report (full scan)")
-        serializable_params = {
-            key: value if isinstance(value, (int, float, str, list, dict, bool, type(None))) else str(value)
-            for key, value in params.__dict__.items()
-        }
-        log.debug(f"params={serializable_params}")
-        diff = core.create_full_scan_with_report_url(
-            scan_paths,
-            params,
-            no_change=should_skip_scan,
-            save_files_list_path=config.save_submitted_files_list,
-            save_manifest_tar_path=config.save_manifest_tar,
-            base_paths=base_paths,
-            explicit_files=sbom_files_to_submit
-        )
-        log.info(f"Full scan created with ID: {diff.id}")
-        log.info(f"Full scan report URL: {diff.report_url}")
-        output_handler.handle_output(diff)
+            output_handler.handle_output(diff)
 
-    else:
-        if force_api_mode:
-            log.info("No Manifest files changed, creating Socket Report")
+        elif (config.enable_diff or force_diff_mode) and not force_api_mode:
+            # New logic: --enable-diff or force_diff_mode (from --ignore-commit-files in git repos) forces diff mode
+            log.info("Diff mode enabled without SCM integration")
+            diff = core.create_new_diff(scan_paths, params, no_change=should_skip_scan, save_files_list_path=config.save_submitted_files_list, save_manifest_tar_path=config.save_manifest_tar, base_paths=base_paths, explicit_files=sbom_files_to_submit)
+            output_handler.handle_output(diff)
+        
+        elif (config.enable_diff or force_diff_mode) and force_api_mode:
+            # User requested diff mode but no manifest files were detected - this should not happen with new logic
+            # but keeping as a safety net
+            log.warning("--enable-diff was specified but no supported manifest files were detected in the changed files. Falling back to full scan mode.")
+            log.info("Creating Socket Report (full scan)")
             serializable_params = {
                 key: value if isinstance(value, (int, float, str, list, dict, bool, type(None))) else str(value)
                 for key, value in params.__dict__.items()
@@ -838,61 +827,85 @@ def _is_unprocessed(c):
             log.info(f"Full scan created with ID: {diff.id}")
             log.info(f"Full scan report URL: {diff.report_url}")
             output_handler.handle_output(diff)
+
         else:
-            log.info("API Mode")
-            diff = core.create_new_diff(
-                scan_paths, params,
-                no_change=should_skip_scan,
-                save_files_list_path=config.save_submitted_files_list,
-                save_manifest_tar_path=config.save_manifest_tar,
-                base_paths=base_paths,
-                explicit_files=sbom_files_to_submit
-            )
-            output_handler.handle_output(diff)
+            if force_api_mode:
+                log.info("No Manifest files changed, creating Socket Report")
+                serializable_params = {
+                    key: value if isinstance(value, (int, float, str, list, dict, bool, type(None))) else str(value)
+                    for key, value in params.__dict__.items()
+                }
+                log.debug(f"params={serializable_params}")
+                diff = core.create_full_scan_with_report_url(
+                    scan_paths,
+                    params,
+                    no_change=should_skip_scan,
+                    save_files_list_path=config.save_submitted_files_list,
+                    save_manifest_tar_path=config.save_manifest_tar,
+                    base_paths=base_paths,
+                    explicit_files=sbom_files_to_submit
+                )
+                log.info(f"Full scan created with ID: {diff.id}")
+                log.info(f"Full scan report URL: {diff.report_url}")
+                output_handler.handle_output(diff)
+            else:
+                log.info("API Mode")
+                diff = core.create_new_diff(
+                    scan_paths, params,
+                    no_change=should_skip_scan,
+                    save_files_list_path=config.save_submitted_files_list,
+                    save_manifest_tar_path=config.save_manifest_tar,
+                    base_paths=base_paths,
+                    explicit_files=sbom_files_to_submit
+                )
+                output_handler.handle_output(diff)
 
-    # Handle license generation
-    if not should_skip_scan and diff.id != "NO_DIFF_RAN" and diff.id != "NO_SCAN_RAN" and config.generate_license:
-        all_packages = build_license_artifact_payload(
-            diff,
-            legal_format=getattr(config, "legal_format", "socket"),
-            config=config,
-        )
-        _write_attribution_file(config, all_packages)
+        if diff.id not in ("NO_DIFF_RAN", "NO_SCAN_RAN"):
+            streaming.set_report_run_id(diff.id)
 
-    # If we forced API mode due to no supported files, behave as if --disable-blocking was set
-    if force_api_mode:
-        if config.strict_blocking:
-            log.warning("--strict-blocking is only supported in diff mode. "
-                       "API mode (no diff) cannot evaluate existing violations.")
-        if not config.disable_blocking:
-            log.debug("Temporarily enabling disable_blocking due to no supported manifest files")
-            config.disable_blocking = True
-
-    # Post commit status to GitLab if enabled
-    if config.enable_commit_status and scm is not None:
-        from socketsecurity.core.scm.gitlab import Gitlab
-        if isinstance(scm, Gitlab) and scm.config.mr_project_id:
-            scm.enable_merge_pipeline_check()
-            passed = output_handler.report_pass(diff)
-            state = "success" if passed else "failed"
-            new_blocking = sum(1 for a in diff.new_alerts if a.error)
-            unchanged_blocking = 0
-            if config.strict_blocking and hasattr(diff, 'unchanged_alerts'):
-                unchanged_blocking = sum(1 for a in diff.unchanged_alerts if a.error)
-            blocking_count = new_blocking + unchanged_blocking
-            if passed:
-                description = "No blocking issues"
-            else:
-                parts = []
-                if new_blocking:
-                    parts.append(f"{new_blocking} new")
-                if unchanged_blocking:
-                    parts.append(f"{unchanged_blocking} existing")
-                description = f"{blocking_count} blocking alert(s) found ({', '.join(parts)})"
-            target_url = diff.report_url or diff.diff_url or ""
-            scm.set_commit_status(state, description, target_url)
-
-    sys.exit(output_handler.return_exit_code(diff))
+        # Handle license generation
+        if not should_skip_scan and diff.id != "NO_DIFF_RAN" and diff.id != "NO_SCAN_RAN" and config.generate_license:
+            all_packages = build_license_artifact_payload(
+                diff,
+                legal_format=getattr(config, "legal_format", "socket"),
+                config=config,
+            )
+            _write_attribution_file(config, all_packages)
+
+        # If we forced API mode due to no supported files, behave as if --disable-blocking was set
+        if force_api_mode:
+            if config.strict_blocking:
+                log.warning("--strict-blocking is only supported in diff mode. "
+                           "API mode (no diff) cannot evaluate existing violations.")
+            if not config.disable_blocking:
+                log.debug("Temporarily enabling disable_blocking due to no supported manifest files")
+                config.disable_blocking = True
+
+        # Post commit status to GitLab if enabled
+        if config.enable_commit_status and scm is not None:
+            from socketsecurity.core.scm.gitlab import Gitlab
+            if isinstance(scm, Gitlab) and scm.config.mr_project_id:
+                scm.enable_merge_pipeline_check()
+                passed = output_handler.report_pass(diff)
+                state = "success" if passed else "failed"
+                new_blocking = sum(1 for a in diff.new_alerts if a.error)
+                unchanged_blocking = 0
+                if config.strict_blocking and hasattr(diff, 'unchanged_alerts'):
+                    unchanged_blocking = sum(1 for a in diff.unchanged_alerts if a.error)
+                blocking_count = new_blocking + unchanged_blocking
+                if passed:
+                    description = "No blocking issues"
+                else:
+                    parts = []
+                    if new_blocking:
+                        parts.append(f"{new_blocking} new")
+                    if unchanged_blocking:
+                        parts.append(f"{unchanged_blocking} existing")
+                    description = f"{blocking_count} blocking alert(s) found ({', '.join(parts)})"
+                target_url = diff.report_url or diff.diff_url or ""
+                scm.set_commit_status(state, description, target_url)
+
+        sys.exit(output_handler.return_exit_code(diff))
 
 
 if __name__ == '__main__':
diff --git a/tests/unit/test_cli_run.py b/tests/unit/test_cli_run.py
new file mode 100644
index 0000000..82754e1
--- /dev/null
+++ b/tests/unit/test_cli_run.py
@@ -0,0 +1,125 @@
+import json
+from unittest.mock import Mock
+
+from socketsecurity.core.cli_client import CliClient
+from socketsecurity.core.cli_run import finalize_cli_run, register_cli_run
+from socketsecurity.core.exceptions import APIFailure
+
+
+def _resp(payload):
+    r = Mock()
+    r.json.return_value = payload
+    return r
+
+
+def test_register_cli_run_returns_run_id_when_enabled():
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp({
+        "log_streaming_enabled": True,
+        "run_id": "srv-issued-123",
+    })
+
+    run_id = register_cli_run(client, client_version="1.2.3", upload_logs=True)
+
+    assert run_id == "srv-issued-123"
+    args, kwargs = client.request.call_args
+    assert kwargs["path"] == "python-cli-runs"
+    assert kwargs["method"] == "POST"
+    body = json.loads(kwargs["payload"])
+    assert body == {"client_version": "1.2.3", "share_logs": True, "decline_logs": False}
+
+
+def test_register_cli_run_returns_none_when_disabled_by_server():
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp({
+        "log_streaming_enabled": False,
+        "run_id": None,
+    })
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=None) is None
+
+
+def test_register_cli_run_sends_both_false_when_unset():
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp({"log_streaming_enabled": False, "run_id": None})
+
+    register_cli_run(client, client_version="1.0.0", upload_logs=None)
+
+    body = json.loads(client.request.call_args.kwargs["payload"])
+    assert body == {"client_version": "1.0.0", "share_logs": False, "decline_logs": False}
+
+
+def test_register_cli_run_sends_decline_logs_true_when_opted_out():
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp({"log_streaming_enabled": False, "run_id": None})
+
+    register_cli_run(client, client_version="1.0.0", upload_logs=False)
+
+    body = json.loads(client.request.call_args.kwargs["payload"])
+    assert body == {"client_version": "1.0.0", "share_logs": False, "decline_logs": True}
+
+
+def test_register_cli_run_returns_none_on_api_failure():
+    client = Mock(spec=CliClient)
+    client.request.side_effect = APIFailure("network down")
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=True) is None
+
+
+def test_register_cli_run_returns_none_on_missing_run_id_when_enabled():
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp({"log_streaming_enabled": True})
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=True) is None
+
+
+def test_register_cli_run_returns_none_on_bad_json():
+    bad = Mock()
+    bad.json.side_effect = ValueError("not json")
+    client = Mock(spec=CliClient)
+    client.request.return_value = bad
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=True) is None
+
+
+def test_register_cli_run_returns_none_on_non_dict_json_body():
+    # Server (mis)behavior: JSON parses but isn't an object. body.get(...) would
+    # raise AttributeError; the broad except must catch it so the scan continues.
+    client = Mock(spec=CliClient)
+    client.request.return_value = _resp([1, 2, 3])
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=True) is None
+
+
+def test_register_cli_run_returns_none_on_unexpected_exception():
+    # Defense-in-depth: any unexpected exception from client.request must be
+    # swallowed so streaming registration can never break the scan.
+    client = Mock(spec=CliClient)
+    client.request.side_effect = RuntimeError("boom")
+
+    assert register_cli_run(client, client_version="1.0.0", upload_logs=True) is None
+
+
+def test_finalize_cli_run_posts_status_and_null_report_run_id_by_default():
+    client = Mock(spec=CliClient)
+    finalize_cli_run(client, "run-x", status="failure")
+
+    args, kwargs = client.request.call_args
+    assert kwargs["path"] == "python-cli-runs/run-x/finalize"
+    assert kwargs["method"] == "POST"
+    assert json.loads(kwargs["payload"]) == {"status": "failure", "report_run_id": None}
+
+
+def test_finalize_cli_run_includes_report_run_id_when_provided():
+    client = Mock(spec=CliClient)
+    finalize_cli_run(client, "run-x", status="success", report_run_id="fs-abc")
+
+    body = json.loads(client.request.call_args.kwargs["payload"])
+    assert body == {"status": "success", "report_run_id": "fs-abc"}
+
+
+def test_finalize_cli_run_swallows_errors():
+    client = Mock(spec=CliClient)
+    client.request.side_effect = APIFailure("network down")
+
+    finalize_cli_run(client, "run-x")  # must not raise
diff --git a/tests/unit/test_log_uploader.py b/tests/unit/test_log_uploader.py
new file mode 100644
index 0000000..81c0311
--- /dev/null
+++ b/tests/unit/test_log_uploader.py
@@ -0,0 +1,192 @@
+import json
+import logging
+import threading
+import time
+from unittest.mock import Mock
+
+import pytest
+
+from socketsecurity.core.cli_client import CliClient
+from socketsecurity.core.exceptions import APIFailure
+from socketsecurity.core.log_uploader import (
+    BatchedLogUploader,
+    UploadingLogHandler,
+)
+from socketsecurity.core.socket_config import SocketConfig
+
+
+@pytest.fixture
+def config():
+    return SocketConfig(api_key="k", timeout=30)
+
+
+def test_add_buffers_until_flush():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-x", flush_interval=10)
+    u.add({"timestamp": "t", "level": "INFO", "message": "a", "context": "c"})
+    u.add({"timestamp": "t", "level": "INFO", "message": "b", "context": "c"})
+    client.request.assert_not_called()
+    assert len(u._buf) == 2
+
+
+def test_flush_posts_batch_and_clears_buffer():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-y", flush_interval=10)
+    u.add({"timestamp": "t", "level": "INFO", "message": "a", "context": "c"})
+    u.add({"timestamp": "t", "level": "WARNING", "message": "b", "context": "c"})
+
+    u._flush()
+
+    args, kwargs = client.request.call_args
+    assert kwargs["path"] == "python-cli-runs/run-y/logs"
+    assert kwargs["method"] == "POST"
+    body = json.loads(kwargs["payload"])
+    assert len(body["logs"]) == 2
+    assert body["logs"][0]["message"] == "a"
+    assert u._buf == []
+
+
+def test_flush_skips_empty_buffer():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-z", flush_interval=10)
+    u._flush()
+    client.request.assert_not_called()
+
+
+def test_flush_swallows_api_failure_and_drops_batch():
+    client = Mock(spec=CliClient)
+    client.request.side_effect = APIFailure("net down")
+    u = BatchedLogUploader(client, "run-e", flush_interval=10)
+    u.add({"timestamp": "t", "level": "INFO", "message": "x", "context": "c"})
+
+    u._flush()  # must not raise
+    assert u._buf == []  # batch is dropped, not retried
+
+
+def test_stop_drains_remaining_buffer():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-d", flush_interval=10)
+    u.start()
+    u.add({"timestamp": "t", "level": "INFO", "message": "tail", "context": "c"})
+    u.stop(timeout=2.0)
+
+    assert client.request.called
+    body = json.loads(client.request.call_args.kwargs["payload"])
+    assert body["logs"][-1]["message"] == "tail"
+
+
+def test_handler_emit_enqueues_record(caplog):
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-h", flush_interval=10)
+    h = UploadingLogHandler(u)
+
+    rec = logging.LogRecord(
+        name="socketcli", level=logging.WARNING, pathname=__file__,
+        lineno=1, msg="watch out", args=(), exc_info=None,
+    )
+    h.emit(rec)
+
+    assert len(u._buf) == 1
+    e = u._buf[0]
+    assert e["level"] == "WARNING"
+    assert e["message"] == "watch out"
+    assert e["context"] == "socket-python-cli"
+
+
+def test_handler_skips_during_active_flush():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-g", flush_interval=10)
+    h = UploadingLogHandler(u)
+
+    captured = {}
+
+    def fake_request(**kwargs):
+        rec = logging.LogRecord(
+            name="socketdev", level=logging.ERROR, pathname=__file__,
+            lineno=1, msg="recursive!", args=(), exc_info=None,
+        )
+        h.emit(rec)
+        captured["buf_len_during_flush"] = len(u._buf)
+        return Mock()
+
+    client.request.side_effect = fake_request
+    u.add({"timestamp": "t", "level": "INFO", "message": "real", "context": "c"})
+    u._flush()
+
+    assert captured["buf_len_during_flush"] == 0  # recursive emit was skipped
+    assert u._buf == []
+
+
+def test_levels_map_correctly():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-l", flush_interval=10)
+    h = UploadingLogHandler(u)
+
+    for py_level in (logging.DEBUG, logging.INFO, logging.WARNING, logging.ERROR, logging.CRITICAL):
+        rec = logging.LogRecord(
+            name="t", level=py_level, pathname=__file__,
+            lineno=1, msg="m", args=(), exc_info=None,
+        )
+        h.emit(rec)
+
+    levels = [e["level"] for e in u._buf]
+    assert levels == ["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"]
+
+
+def test_emit_during_active_flush_on_another_thread_is_not_dropped():
+    # Race scenario: the uploader thread is mid-flush (request in flight, _FLUSH_GUARD
+    # active on the uploader thread) while a real log record is emitted from a different
+    # thread. The thread-local guard must NOT block the other thread's emit; the record
+    # must land in the new buffer and ship on the next flush.
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-race", flush_interval=10)
+    h = UploadingLogHandler(u)
+
+    flush_in_flight = threading.Event()
+    release_flush = threading.Event()
+    request_bodies: list = []
+
+    def blocking_request(**kwargs):
+        request_bodies.append(json.loads(kwargs["payload"]))
+        flush_in_flight.set()
+        release_flush.wait(timeout=2.0)
+        return Mock()
+
+    client.request.side_effect = blocking_request
+
+    # Seed the first batch and start a flush on a worker thread so the main thread can
+    # observe + interleave with it.
+    u.add({"timestamp": "t", "level": "INFO", "message": "first", "context": "c"})
+    flusher = threading.Thread(target=u._flush, daemon=True)
+    flusher.start()
+    assert flush_in_flight.wait(timeout=2.0), "uploader never entered _flush"
+
+    # While the uploader is parked inside _flush() with _FLUSH_GUARD.active set on its
+    # own thread, emit a real log from the main thread. The guard is thread-local, so
+    # this emit must proceed and land in the freshly-swapped buffer.
+    rec = logging.LogRecord(
+        name="socketcli", level=logging.INFO, pathname=__file__,
+        lineno=1, msg="emitted-during-flush", args=(), exc_info=None,
+    )
+    h.emit(rec)
+    assert len(u._buf) == 1
+    assert u._buf[0]["message"] == "emitted-during-flush"
+
+    # Let the in-flight flush finish, then drain — the record must ship.
+    release_flush.set()
+    flusher.join(timeout=2.0)
+    u._flush()
+
+    assert len(request_bodies) == 2
+    assert request_bodies[0]["logs"][0]["message"] == "first"
+    assert request_bodies[1]["logs"][0]["message"] == "emitted-during-flush"
+
+
+def test_run_thread_flushes_periodically_then_exits():
+    client = Mock(spec=CliClient)
+    u = BatchedLogUploader(client, "run-t", flush_interval=0.05)
+    u.add({"timestamp": "t", "level": "INFO", "message": "first", "context": "c"})
+    u.start()
+    time.sleep(0.2)  # allow at least one flush tick
+    u.stop(timeout=1.0)
+    assert client.request.called
diff --git a/tests/unit/test_streaming.py b/tests/unit/test_streaming.py
new file mode 100644
index 0000000..999b44a
--- /dev/null
+++ b/tests/unit/test_streaming.py
@@ -0,0 +1,123 @@
+import logging
+from unittest.mock import patch
+
+import socketsecurity.core.streaming as streaming_mod
+from socketsecurity.core.streaming import StreamingLogs
+
+
+def _make(**overrides):
+    kwargs = dict(
+        client=object(),
+        cli_logger=logging.getLogger(overrides.pop("cli_name", "t-cli")),
+        sdk_logger=logging.getLogger(overrides.pop("sdk_name", "t-sdk")),
+        client_version="1.0",
+        upload_logs=True,
+        enable_debug=False,
+    )
+    kwargs.update(overrides)
+    return StreamingLogs(**kwargs)
+
+
+def test_setup_streaming_is_noop_when_register_fails():
+    finalize_calls = []
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value=None), \
+         patch("socketsecurity.core.streaming.finalize_cli_run", side_effect=lambda *a, **k: finalize_calls.append(k)):
+        with _make(cli_name="t-fail-cli", sdk_name="t-fail-sdk") as streaming:
+            assert isinstance(streaming, StreamingLogs)
+    # No run was registered → finalize must not be called.
+    assert finalize_calls == []
+
+
+def test_clean_exit_reports_success():
+    finalize_calls = []
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value="run-ok"), \
+         patch("socketsecurity.core.streaming.finalize_cli_run", side_effect=lambda c, r, status, report_run_id: finalize_calls.append((status, report_run_id))), \
+         patch.object(streaming_mod.BatchedLogUploader, "start"), \
+         patch.object(streaming_mod.BatchedLogUploader, "stop"):
+        with _make(cli_name="t-ok-cli", sdk_name="t-ok-sdk"):
+            pass
+    assert finalize_calls == [("success", None)]
+
+
+def test_exception_reports_failure_and_propagates():
+    finalize_calls = []
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value="run-x"), \
+         patch("socketsecurity.core.streaming.finalize_cli_run", side_effect=lambda c, r, status, report_run_id: finalize_calls.append((status, report_run_id))), \
+         patch.object(streaming_mod.BatchedLogUploader, "start"), \
+         patch.object(streaming_mod.BatchedLogUploader, "stop"):
+        raised = False
+        try:
+            with _make(cli_name="t-exc-cli", sdk_name="t-exc-sdk") as streaming:
+                streaming.set_report_run_id("fs-1")
+                raise RuntimeError("boom")
+        except RuntimeError:
+            raised = True
+    assert raised  # exception not swallowed
+    assert finalize_calls == [("failure", "fs-1")]
+
+
+def test_keyboard_interrupt_reports_cancelled():
+    finalize_calls = []
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value="run-ki"), \
+         patch("socketsecurity.core.streaming.finalize_cli_run", side_effect=lambda c, r, status, report_run_id: finalize_calls.append((status, report_run_id))), \
+         patch.object(streaming_mod.BatchedLogUploader, "start"), \
+         patch.object(streaming_mod.BatchedLogUploader, "stop"):
+        try:
+            with _make(cli_name="t-ki-cli", sdk_name="t-ki-sdk"):
+                raise KeyboardInterrupt
+        except KeyboardInterrupt:
+            pass
+    assert finalize_calls == [("cancelled", None)]
+
+
+def test_system_exit_zero_is_success_nonzero_is_failure():
+    statuses = []
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value="run-sx"), \
+         patch("socketsecurity.core.streaming.finalize_cli_run", side_effect=lambda c, r, status, report_run_id: statuses.append(status)), \
+         patch.object(streaming_mod.BatchedLogUploader, "start"), \
+         patch.object(streaming_mod.BatchedLogUploader, "stop"):
+        try:
+            with _make(cli_name="t-sx0-cli", sdk_name="t-sx0-sdk"):
+                raise SystemExit(0)
+        except SystemExit:
+            pass
+        try:
+            with _make(cli_name="t-sx1-cli", sdk_name="t-sx1-sdk"):
+                raise SystemExit(1)
+        except SystemExit:
+            pass
+    assert statuses == ["success", "failure"]
+
+
+def test_restores_logger_state_on_exit():
+    cli_logger = logging.getLogger("t-restore-cli")
+    sdk_logger = logging.getLogger("t-restore-sdk")
+    cli_logger.setLevel(logging.WARNING)
+    sdk_logger.setLevel(logging.ERROR)
+    cli_logger.propagate = True
+    sdk_logger.propagate = True
+    handlers_before = (len(cli_logger.handlers), len(sdk_logger.handlers))
+
+    with patch("socketsecurity.core.streaming.register_cli_run", return_value="run-r"), \
+         patch("socketsecurity.core.streaming.finalize_cli_run"), \
+         patch.object(streaming_mod.BatchedLogUploader, "start"), \
+         patch.object(streaming_mod.BatchedLogUploader, "stop"):
+        with StreamingLogs(
+            client=object(),
+            cli_logger=cli_logger,
+            sdk_logger=sdk_logger,
+            client_version="1.0",
+            upload_logs=True,
+            enable_debug=False,
+        ):
+            # Inside the with block: levels and propagate are forced.
+            assert cli_logger.level == logging.DEBUG
+            assert sdk_logger.level == logging.DEBUG
+            assert cli_logger.propagate is False
+            assert sdk_logger.propagate is False
+
+    assert cli_logger.level == logging.WARNING
+    assert sdk_logger.level == logging.ERROR
+    assert cli_logger.propagate is True
+    assert sdk_logger.propagate is True
+    assert (len(cli_logger.handlers), len(sdk_logger.handlers)) == handlers_before
diff --git a/uv.lock b/uv.lock
index 0ed1361..86d19ff 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.8"
+version = "2.4.9"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From f3d71a4228bd4f15d7898e7059b0beddd5d70361 Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Fri, 12 Jun 2026 17:43:06 -0400
Subject: [PATCH 67/80] Add --include-dirs flag to scan normally-excluded
 directories (#235)

Adds the ability to opt directories that the CLI excludes from manifest
discovery by default (build, dist, node_modules, .venv, etc.) back into
the scan, for projects that keep manifest files under those names.

- New --include-dirs flag (comma-separated directory names) re-includes
  any of the default-excluded names in manifest discovery.
- --include-module-folders now functions as documented (re-includes the
  JS/TS module folders as a group); it was previously a no-op.

Bumps version to 2.4.10 with changelog and CLI reference updates.

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 CHANGELOG.md                         | 15 +++++
 docs/cli-reference.md                |  5 +-
 pyproject.toml                       |  2 +-
 socketsecurity/__init__.py           |  2 +-
 socketsecurity/config.py             | 13 ++++
 socketsecurity/core/socket_config.py |  4 ++
 socketsecurity/socketcli.py          | 16 ++++-
 tests/unit/test_include_dirs.py      | 99 ++++++++++++++++++++++++++++
 uv.lock                              |  2 +-
 9 files changed, 151 insertions(+), 7 deletions(-)
 create mode 100644 tests/unit/test_include_dirs.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d83963d..39e686a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.4.10
+
+### Added: opt directories back into manifest discovery via `--include-dirs`
+
+- New `--include-dirs` flag (comma-separated directory names) that re-includes directories
+  the CLI excludes from manifest discovery by default. The default exclude list
+  (`node_modules`, `bower_components`, `jspm_packages`, `__pycache__`, `.venv`, `venv`,
+  `build`, `dist`, `.tox`, `.mypy_cache`, `.pytest_cache`, `*.egg-info`, `vendor`) is a sane
+  default, but some projects keep manifest files under those names — e.g. `build/requirements.txt`.
+  Pass `--include-dirs build,dist` to scan them. Names are matched against any path segment,
+  mirroring how the default exclude list is applied.
+- `--include-module-folders` now functions as documented: it re-includes the JS/TS module
+  folders (`node_modules`, `bower_components`, `jspm_packages`) as a group. Previously the
+  flag was accepted but had no effect.
+
 ## 2.4.9
 
 ### Added: opt-in streaming log channel via `--upload-logs`
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index adb41ca..7524495 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -148,7 +148,7 @@ socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--
           [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
-          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
+          [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--include-dirs INCLUDE_DIRS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
           [--enable-json] [--enable-sarif] [--sarif-file <path>] [--sarif-scope {diff,full}] [--sarif-grouping {instance,alert}] [--sarif-reachability {all,reachable,potentially,reachable-or-potentially}] [--enable-gitlab-security] [--gitlab-security-file <path>]
           [--disable-overview] [--exclude-license-details] [--allow-unverified] [--disable-security-issue]
           [--ignore-commit-files] [--disable-blocking] [--disable-ignore] [--enable-diff] [--scm SCM] [--timeout TIMEOUT] [--include-module-folders]
@@ -205,13 +205,14 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--workspace-name`            | False    |                       | Workspace name suffix to append to repository name (repo-name-workspace_name). Must be used with `--sub-path`                                                                     |
 | `--excluded-ecosystems`       | False    | []                    | List of ecosystems to exclude from analysis (JSON array string). You can get supported files from the [Supported Files API](https://docs.socket.dev/reference/getsupportedfiles) |
 | `--exclude-paths`             | False    |                       | Comma-separated paths/globs to exclude from **both** manifest discovery (every scan) **and** reachability analysis (e.g. `tests/**,packages/legacy,*.spec.ts`). Patterns are scan-root-relative, case-sensitive globs where `*` does not cross `/` and `**` does. Supersedes `--reach-exclude-paths`. |
+| `--include-dirs`              | False    |                       | Comma-separated directory **names** that are excluded from manifest discovery by default but should be scanned (e.g. `build,dist`). Names are matched against any path segment, mirroring the default exclude list (`node_modules`, `bower_components`, `jspm_packages`, `__pycache__`, `.venv`, `venv`, `build`, `dist`, `.tox`, `.mypy_cache`, `.pytest_cache`, `*.egg-info`, `vendor`). Use this when manifest files live under a normally-ignored folder, e.g. `build/requirements.txt`. |
 
 #### Branch and Scan Configuration
 | Parameter                | Required | Default | Description                                                                                           |
 |:-------------------------|:---------|:--------|:------------------------------------------------------------------------------------------------------|
 | `--default-branch`         | False    | *auto*  | Make this branch the default branch (auto-detected from git and CI environment when not specified)   |
 | `--pending-head`           | False    | *auto*  | If true, the new scan will be set as the branch's head scan (automatically synced with default-branch) |
-| `--include-module-folders` | False    | False   | If enabled will include manifest files from folders like node_modules                                |
+| `--include-module-folders` | False    | False   | If enabled, re-includes the JS/TS module folders (`node_modules`, `bower_components`, `jspm_packages`) in manifest discovery. For other excluded directories, use `--include-dirs`. |
 
 #### Output Configuration
 | Parameter                 | Required | Default | Description                                                                       |
diff --git a/pyproject.toml b/pyproject.toml
index acff1fb..357f26e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.9"
+version = "2.4.10"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index cc95834..4b86d9b 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.9'
+__version__ = '2.4.10'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index bad7ed6..fdb7005 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -154,6 +154,7 @@ class CliConfig:
     repo_is_public: bool = False
     excluded_ecosystems: list[str] = field(default_factory=lambda: [])
     exclude_paths: Optional[List[str]] = None
+    included_dirs: List[str] = field(default_factory=lambda: [])
     version: str = __version__
     jira_plugin: PluginConfig = field(default_factory=PluginConfig)
     slack_plugin: PluginConfig = field(default_factory=PluginConfig)
@@ -314,6 +315,7 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'reach_ecosystems': args.reach_ecosystems.split(',') if args.reach_ecosystems else None,
             'reach_exclude_paths': args.reach_exclude_paths.split(',') if args.reach_exclude_paths else None,
             'exclude_paths': normalize_exclude_paths(args.exclude_paths),
+            'included_dirs': normalize_exclude_paths(args.include_dirs) or [],
             'reach_skip_cache': args.reach_skip_cache,
             'reach_min_severity': args.reach_min_severity,
             'reach_output_file': args.reach_output_file,
@@ -639,6 +641,17 @@ def create_argument_parser() -> argparse.ArgumentParser:
              "Supersedes --reach-exclude-paths."
     )
 
+    path_group.add_argument(
+        "--include-dirs",
+        dest="include_dirs",
+        metavar="<list>",
+        help="Comma-separated directory names that are excluded from manifest discovery by "
+             "default but should be scanned (e.g. 'build,dist'). Names are matched against any "
+             "path segment, mirroring the default exclude list. Defaults excluded: "
+             "node_modules, bower_components, jspm_packages, __pycache__, .venv, venv, build, "
+             "dist, .tox, .mypy_cache, .pytest_cache, *.egg-info, vendor."
+    )
+
     # Branch and Scan Configuration
     config_group = parser.add_argument_group('Branch and Scan Configuration')
     config_group.add_argument(
diff --git a/socketsecurity/core/socket_config.py b/socketsecurity/core/socket_config.py
index 8ebde8d..acf01a2 100644
--- a/socketsecurity/core/socket_config.py
+++ b/socketsecurity/core/socket_config.py
@@ -15,6 +15,10 @@
     "vendor"
 }
 
+# Subset of default_exclude_dirs that hold installed JS/TS modules. Re-included as a group
+# by --include-module-folders (see CliConfig.include_module_folders).
+module_folder_dirs = {"node_modules", "bower_components", "jspm_packages"}
+
 @dataclass
 class SocketConfig:
     api_key: str
diff --git a/socketsecurity/socketcli.py b/socketsecurity/socketcli.py
index 7eeabbd..0d8bccc 100644
--- a/socketsecurity/socketcli.py
+++ b/socketsecurity/socketcli.py
@@ -19,7 +19,7 @@
 from socketsecurity.core.logging import initialize_logging, set_debug_mode
 from socketsecurity.core.messages import Messages
 from socketsecurity.core.scm_comments import Comments
-from socketsecurity.core.socket_config import SocketConfig
+from socketsecurity.core.socket_config import SocketConfig, module_folder_dirs
 from socketsecurity.core.streaming import StreamingLogs
 from socketsecurity.fossa_compat import build_fossa_attribution_payload
 from socketsecurity.output import OutputHandler
@@ -195,7 +195,19 @@ def main_code():
     ) as streaming:
         core = Core(socket_config, sdk, config)
         log.debug("loaded core")
-        
+
+        # Re-include directories that are excluded from manifest discovery by default
+        # (e.g. build/dist). --include-dirs names them individually; --include-module-folders
+        # re-includes the JS module folders as a group. Build a new set rather than mutating
+        # the shared default_exclude_dirs in place. Applied here so it covers every find_files
+        # call below, including the sub-path manifest pre-check.
+        dirs_to_include = set(config.included_dirs or [])
+        if config.include_module_folders:
+            dirs_to_include |= module_folder_dirs
+        if dirs_to_include:
+            core.config.excluded_dirs = set(core.config.excluded_dirs) - dirs_to_include
+            log.debug(f"Re-including normally-excluded directories in scan: {sorted(dirs_to_include)}")
+
         # Check for required dependencies if reachability analysis is enabled
         if config.reach:
             log.info("Reachability analysis enabled, checking for required dependencies...")
diff --git a/tests/unit/test_include_dirs.py b/tests/unit/test_include_dirs.py
new file mode 100644
index 0000000..7261f69
--- /dev/null
+++ b/tests/unit/test_include_dirs.py
@@ -0,0 +1,99 @@
+"""Tests for --include-dirs (and the now-functional --include-module-folders).
+
+Covers config parsing of the comma-separated directory names and that re-including a
+normally-excluded directory (e.g. build) lets Core.find_files discover manifests under it.
+"""
+import types
+from unittest.mock import MagicMock
+
+import pytest
+
+from socketsecurity.config import CliConfig
+from socketsecurity.core import Core
+from socketsecurity.core.socket_config import (
+    SocketConfig,
+    default_exclude_dirs,
+    module_folder_dirs,
+)
+
+BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+
+# ---- config parsing ------------------------------------------------------
+
+def test_include_dirs_parses_to_list():
+    config = CliConfig.from_args(BASE_ARGS + ["--include-dirs", "build, dist , vendor"])
+    assert config.included_dirs == ["build", "dist", "vendor"]
+
+
+def test_include_dirs_defaults_empty():
+    config = CliConfig.from_args(BASE_ARGS)
+    assert config.included_dirs == []
+
+
+def test_include_dirs_from_config_file(tmp_path):
+    import json
+    cfg = tmp_path / "socketcli.json"
+    cfg.write_text(json.dumps({"socketcli": {"include_dirs": ["build", "dist"]}}), encoding="utf-8")
+    config = CliConfig.from_args(BASE_ARGS + ["--config", str(cfg)])
+    assert config.included_dirs == ["build", "dist"]
+
+
+def test_module_folder_dirs_is_subset_of_defaults():
+    assert module_folder_dirs <= default_exclude_dirs
+
+
+# ---- find_files integration ----------------------------------------------
+
+def _make_core(excluded_dirs):
+    core = Core.__new__(Core)
+    core.config = SocketConfig(api_key="test-key", excluded_dirs=excluded_dirs)
+    core.cli_config = types.SimpleNamespace(exclude_paths=None)
+    core.sdk = MagicMock()
+    return core
+
+
+def _seed_manifests(tmp_path):
+    for rel in ("requirements.txt", "build/requirements.txt", "dist/requirements.txt"):
+        p = tmp_path / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text("flask==1.0\n", encoding="utf-8")
+
+
+def test_find_files_excludes_build_by_default(tmp_path, mocker):
+    _seed_manifests(tmp_path)
+    core = _make_core(set(default_exclude_dirs))
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"pypi": {"requirements.txt": {"pattern": "requirements.txt"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert not any("/build/" in f for f in found)
+    assert not any("/dist/" in f for f in found)
+    assert any(f.endswith("/requirements.txt") for f in found)
+
+
+def test_find_files_includes_build_when_unexcluded(tmp_path, mocker):
+    """Mirrors socketcli wiring: dropping a name from excluded_dirs re-includes its manifests."""
+    _seed_manifests(tmp_path)
+    core = _make_core(set(default_exclude_dirs) - {"build"})
+    mocker.patch.object(
+        core, "get_supported_patterns",
+        return_value={"pypi": {"requirements.txt": {"pattern": "requirements.txt"}}},
+    )
+
+    found = core.find_files(str(tmp_path))
+    assert any("/build/requirements.txt" in f for f in found)
+    # dist is still excluded since only build was re-included
+    assert not any("/dist/" in f for f in found)
+
+
+def test_unexcluding_does_not_mutate_shared_defaults():
+    """The socketcli flow builds a new set rather than mutating the module-level default."""
+    before = set(default_exclude_dirs)
+    config = SocketConfig(api_key="test-key")
+    config.excluded_dirs = set(config.excluded_dirs) - {"build"}
+    assert "build" not in config.excluded_dirs
+    assert default_exclude_dirs == before
+    assert "build" in default_exclude_dirs
diff --git a/uv.lock b/uv.lock
index 86d19ff..b11778b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.9"
+version = "2.4.10"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 6e3996d9de201d1e628f659b71ddb737e41ad336 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Fri, 19 Jun 2026 09:26:23 +0200
Subject: [PATCH 68/80] Add units to reachability timeout/memory-limit flags
 (#236)

--reach-analysis-timeout now accepts an optional duration unit (s/m/h, e.g.
90s, 10m, 1h) and --reach-analysis-memory-limit an optional size unit (MB/GB,
case-insensitive, e.g. 512MB, 8GB). Values are forwarded verbatim to the
reachability engine (@coana-tech/cli), which owns parsing and validation, so
the unit grammar and error messages live in a single source of truth.

To pass values through unchanged, the four flags (incl. the hidden
--reach-timeout/--reach-memory-limit aliases) drop type=int and accept raw
strings; the dataclass fields become Optional[str]. A defensive str() is kept
at the coana forward point so config-file JSON numbers (which bypass argparse's
type converter via set_defaults) still reach subprocess as strings, and the
guard uses `is not None` so an explicit empty string flows through and triggers
coana's own error rather than being silently dropped.

Bare numbers remain accepted for backward compatibility (seconds for the
timeout, MB for the memory limit) but are no longer documented. Bumped the
pinned @coana-tech/cli version to 15.5.0, which ships the unit parser.

Docs (cli-reference) and CHANGELOG updated; unit tests cover unit-bearing
values, bare-int back-compat, and int coercion.
---
 CHANGELOG.md                              | 13 +++++++++++
 docs/cli-reference.md                     |  6 ++---
 pyproject.toml                            |  2 +-
 socketsecurity/__init__.py                |  2 +-
 socketsecurity/config.py                  | 16 +++++--------
 socketsecurity/core/tools/reachability.py | 28 ++++++++++++++---------
 tests/unit/test_config.py                 | 20 ++++++++++++----
 tests/unit/test_reachability.py           | 17 +++++++++++++-
 uv.lock                                   |  2 +-
 9 files changed, 73 insertions(+), 33 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39e686a..8ddfa73 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.4.11
+
+### Changed: units for `--reach-analysis-timeout` and `--reach-analysis-memory-limit`
+
+- `--reach-analysis-timeout` now accepts a duration with an optional unit suffix — `s`, `m`
+  or `h` (e.g. `90s`, `10m`, `1h`). `--reach-analysis-memory-limit` now accepts a size with an
+  optional unit suffix — `MB` or `GB`, case-insensitive (e.g. `512MB`, `8GB`). The value is
+  passed through verbatim to the reachability engine (`@coana-tech/cli`), which owns parsing
+  and validation, so error messages come from a single source of truth.
+- Backward compatible: a bare number is still accepted (seconds for the timeout, MB for the
+  memory limit), exactly as before. This legacy form is no longer documented but keeps working.
+- Bumped the pinned `@coana-tech/cli` version to `15.5.0`, which ships the unit parser.
+
 ## 2.4.10
 
 ### Added: opt directories back into manifest discovery via `--include-dirs`
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 7524495..d162d8c 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,9 +241,9 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a tier-1 full-application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.3.24 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
-| `--reach-analysis-timeout`         | False    | 600     | Timeout in seconds for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-timeout` |
-| `--reach-analysis-memory-limit`    | False    | 8192    | Memory limit in MB for the reachability analysis. Omitted by default, so coana applies its own default. Alias: `--reach-memory-limit` |
+| `--reach-version`                  | False    | 15.5.0  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
+| `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
 | `--reach-additional-params`        | False    |         | Pass custom parameters to the coana CLI tool                                                                               |
 | `--reach-ecosystems`               | False    |         | Comma-separated list of ecosystems to analyze (e.g., "npm,pypi"). If not specified, all supported ecosystems are analyzed  |
diff --git a/pyproject.toml b/pyproject.toml
index 357f26e..508d0f7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.10"
+version = "2.4.11"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 4b86d9b..56da7cf 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.10'
+__version__ = '2.4.11'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index fdb7005..79495fc 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -168,8 +168,8 @@ class CliConfig:
     # Reachability Flags
     reach: bool = False
     reach_version: Optional[str] = None
-    reach_analysis_memory_limit: Optional[int] = None
-    reach_analysis_timeout: Optional[int] = None
+    reach_analysis_memory_limit: Optional[str] = None
+    reach_analysis_timeout: Optional[str] = None
     reach_disable_analytics: bool = False
     reach_disable_analysis_splitting: bool = False  # Deprecated, kept for backwards compatibility
     reach_enable_analysis_splitting: bool = False
@@ -988,29 +988,25 @@ def create_argument_parser() -> argparse.ArgumentParser:
     reachability_group.add_argument(
         "--reach-analysis-timeout",
         dest="reach_analysis_timeout",
-        type=int,
-        metavar="<seconds>",
-        help="Timeout for reachability analysis in seconds"
+        metavar="<duration>",
+        help="Set the timeout for each reachability analysis run, e.g. 90s, 10m or 1h. (default: 10m)"
     )
     # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
     reachability_group.add_argument(
         "--reach-timeout",
         dest="reach_analysis_timeout",
-        type=int,
         help=argparse.SUPPRESS
     )
     reachability_group.add_argument(
         "--reach-analysis-memory-limit",
         dest="reach_analysis_memory_limit",
-        type=int,
-        metavar="<mb>",
-        help="Memory limit for reachability analysis in MB (defaults to the coana CLI's own default, currently 8192)"
+        metavar="<size>",
+        help="Set the memory limit for each reachability analysis run, e.g. 512MB or 8GB. (default: 8GB)"
     )
     # Backwards-compatible alias for the pre-alignment name. Kept working, hidden from help.
     reachability_group.add_argument(
         "--reach-memory-limit",
         dest="reach_analysis_memory_limit",
-        type=int,
         help=argparse.SUPPRESS
     )
     reachability_group.add_argument(
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 88d3105..c549a17 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.3.24"
+DEFAULT_COANA_CLI_VERSION: Final = "15.5.0"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.3.24').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.0').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.3.24').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.0').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
@@ -79,8 +79,8 @@ def run_reachability_analysis(
         target_directory: str,
         tar_hash: Optional[str] = None,
         output_path: str = ".socket.facts.json",
-        timeout: Optional[int] = None,
-        memory_limit: Optional[int] = None,
+        timeout: Optional[str] = None,
+        memory_limit: Optional[str] = None,
         ecosystems: Optional[List[str]] = None,
         exclude_paths: Optional[List[str]] = None,
         min_severity: Optional[str] = None,
@@ -112,8 +112,10 @@ def run_reachability_analysis(
             target_directory: Directory to analyze
             tar_hash: Tar hash from manifest upload or existing scan (optional)
             output_path: Output file path for results
-            timeout: Analysis timeout in seconds
-            memory_limit: Memory limit in MB
+            timeout: Analysis timeout, forwarded verbatim to coana --analysis-timeout
+                (coana parses the units, e.g. '90s', '10m', '1h'; a bare number is seconds)
+            memory_limit: Memory limit, forwarded verbatim to coana --memory-limit
+                (coana parses the units, e.g. '512MB', '8GB'; a bare number is MB)
             ecosystems: List of ecosystems to analyze (e.g., ['npm', 'pypi'])
             exclude_paths: Paths to exclude from analysis
             min_severity: Minimum severity level (info, low, moderate, high, critical)
@@ -149,11 +151,15 @@ def run_reachability_analysis(
             "--disable-report-submission"
         ])
         
-        # Add conditional arguments
-        if timeout:
+        # Add conditional arguments. timeout/memory_limit are forwarded verbatim; coana owns
+        # unit parsing/validation (e.g. '90s', '8GB'). We coerce to str only for subprocess
+        # safety — config-file values can arrive as ints via argparse set_defaults — and use
+        # `is not None` (not truthiness) so an explicit empty string still reaches coana and
+        # triggers coana's own error, rather than being silently dropped.
+        if timeout is not None:
             coana_args.extend(["--analysis-timeout", str(timeout)])
-        
-        if memory_limit:
+
+        if memory_limit is not None:
             coana_args.extend(["--memory-limit", str(memory_limit)])
         
         if disable_analytics:
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 7403005..717e302 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -180,21 +180,31 @@ def test_reach_defaults_are_unset_and_delegated_to_coana(self):
         assert config.reach_analysis_timeout is None
 
     def test_reach_node_style_name_aliases(self):
-        """G8: Node-style primary names map to the same dests."""
+        """G8: Node-style primary names map to the same dests. Values are kept as raw
+        strings and forwarded verbatim to coana (coana owns unit parsing)."""
         config = CliConfig.from_args(
             self.BASE_ARGS
             + ["--reach", "--reach-analysis-timeout", "300", "--reach-analysis-memory-limit", "2048"]
         )
-        assert config.reach_analysis_timeout == 300
-        assert config.reach_analysis_memory_limit == 2048
+        assert config.reach_analysis_timeout == "300"
+        assert config.reach_analysis_memory_limit == "2048"
 
     def test_reach_legacy_name_aliases_still_work(self):
         """G8: pre-alignment names keep working (hidden aliases)."""
         config = CliConfig.from_args(
             self.BASE_ARGS + ["--reach", "--reach-timeout", "111", "--reach-memory-limit", "512"]
         )
-        assert config.reach_analysis_timeout == 111
-        assert config.reach_analysis_memory_limit == 512
+        assert config.reach_analysis_timeout == "111"
+        assert config.reach_analysis_memory_limit == "512"
+
+    def test_reach_unit_suffixes_are_passed_through_verbatim(self):
+        """Unit-bearing values (parsed/validated by coana) are stored as-is, not coerced."""
+        config = CliConfig.from_args(
+            self.BASE_ARGS
+            + ["--reach", "--reach-analysis-timeout", "10m", "--reach-analysis-memory-limit", "8GB"]
+        )
+        assert config.reach_analysis_timeout == "10m"
+        assert config.reach_analysis_memory_limit == "8GB"
 
     def test_reach_debug_flag(self):
         """G9: dedicated --reach-debug flag, independent of --enable-debug."""
diff --git a/tests/unit/test_reachability.py b/tests/unit/test_reachability.py
index 1130be3..98933fe 100644
--- a/tests/unit/test_reachability.py
+++ b/tests/unit/test_reachability.py
@@ -87,11 +87,26 @@ def test_disable_external_tool_checks(analyzer, mocker):
 
 def test_concurrency_and_memory_args(analyzer, mocker):
     """G7: explicit concurrency/memory propagate as coana args."""
-    cmd, _ = _run(analyzer, mocker, concurrency=1, memory_limit=8192)
+    cmd, _ = _run(analyzer, mocker, concurrency=1, memory_limit="8192")
     assert "--concurrency" in cmd and cmd[cmd.index("--concurrency") + 1] == "1"
     assert "--memory-limit" in cmd and cmd[cmd.index("--memory-limit") + 1] == "8192"
 
 
+def test_timeout_and_memory_units_forwarded_verbatim(analyzer, mocker):
+    """Unit-bearing timeout/memory strings are forwarded to coana untouched (coana parses them)."""
+    cmd, _ = _run(analyzer, mocker, timeout="10m", memory_limit="8GB")
+    assert cmd[cmd.index("--analysis-timeout") + 1] == "10m"
+    assert cmd[cmd.index("--memory-limit") + 1] == "8GB"
+
+
+def test_timeout_and_memory_int_values_coerced_to_str(analyzer, mocker):
+    """Config-file values can arrive as ints (set_defaults bypasses argparse type=); they must
+    still reach subprocess as strings, not raw ints."""
+    cmd, _ = _run(analyzer, mocker, timeout=300, memory_limit=2048)
+    assert cmd[cmd.index("--analysis-timeout") + 1] == "300"
+    assert cmd[cmd.index("--memory-limit") + 1] == "2048"
+
+
 def test_env_identifies_python_cli(analyzer, mocker):
     """G5: SOCKET_CLI_VERSION + SOCKET_CALLER_USER_AGENT forwarded to coana."""
     _, env = _run(analyzer, mocker)
diff --git a/uv.lock b/uv.lock
index b11778b..0d11821 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.10"
+version = "2.4.11"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From f59513f37c4d2806ee2a6dcb594b4d23183f68fa Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Fri, 19 Jun 2026 14:47:22 +0200
Subject: [PATCH 69/80] Consolidate coana launcher env vars into
 SOCKET_CLI_COANA_LAUNCHER (#233)

Replace the SOCKET_CLI_COANA_FORCE_NPM_INSTALL and
SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK toggles with a single
SOCKET_CLI_COANA_LAUNCHER variable (auto | npx | npm-install), mirroring
the Socket Node CLI. The legacy variables remain supported when the new
variable is unset, but are deprecated and no longer documented.

Follow-up from the review thread on PR #230.
---
 CHANGELOG.md                              | 13 ++++++
 docs/cli-reference.md                     |  7 ++--
 pyproject.toml                            |  2 +-
 socketsecurity/__init__.py                |  2 +-
 socketsecurity/core/tools/reachability.py | 38 +++++++++++++++---
 tests/unit/test_reachability.py           | 48 +++++++++++++++++++++++
 uv.lock                                   |  2 +-
 7 files changed, 100 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8ddfa73..90b17fc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.4.12
+
+### Changed: consolidated coana launcher env vars into `SOCKET_CLI_COANA_LAUNCHER`
+
+- The reachability launcher is now tuned via a single `SOCKET_CLI_COANA_LAUNCHER`
+  environment variable (mirroring the Socket Node CLI): `auto` (default when unset; try
+  `npx` first, fall back to `npm install` + `node` on launcher-level failures),
+  `npm-install` (skip `npx` entirely), or `npx` (never fall back). An unrecognized value
+  logs a warning and behaves as `auto`.
+- The legacy `SOCKET_CLI_COANA_FORCE_NPM_INSTALL` and `SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK`
+  variables remain supported for back-compat when `SOCKET_CLI_COANA_LAUNCHER` is unset, but
+  are deprecated and no longer documented.
+
 ## 2.4.11
 
 ### Changed: units for `--reach-analysis-timeout` and `--reach-analysis-memory-limit`
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index d162d8c..35e2218 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -317,9 +317,10 @@ For CI-specific examples and guidance, see [`ci-cd.md`](ci-cd.md).
 
 The CLI runs a pinned `@coana-tech/cli` version via `npx --yes --force` (the same flags the Socket Node CLI passes for coana); it does **not** auto-update the engine or install it globally. `--yes` skips npx's interactive install prompt so non-interactive/CI runs don't hang. If the `npx` launcher is unavailable or fails before the engine starts, the CLI falls back to `npm install`-ing the pinned version into a temp directory and running it via `node`. Pass `--reach-version latest` to opt into the newest published version. Use `--reach` to enable reachability analysis during a full scan, or add `--only-facts-file` (with `--reach`) to submit only the reachability facts file (`.socket.facts.json`) when creating the full scan.
 
-The launcher fallback can be tuned via environment variables:
-- `SOCKET_CLI_COANA_FORCE_NPM_INSTALL` — skip `npx` entirely and always use the `npm install` + `node` path (useful where `npx` is known-broken).
-- `SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK` — never fall back; surface the `npx` failure directly.
+The launcher can be tuned via the `SOCKET_CLI_COANA_LAUNCHER` environment variable:
+- `auto` (default when unset) — try `npx` first; fall back to `npm install` + `node` if the launcher fails before the engine starts.
+- `npm-install` — skip `npx` entirely and always use the `npm install` + `node` path (useful where `npx` is known-broken).
+- `npx` — never fall back; surface the `npx` failure directly.
 
 #### Advanced Configuration
 | Parameter                | Required | Default | Description                                                           |
diff --git a/pyproject.toml b/pyproject.toml
index 508d0f7..96e9a77 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.11"
+version = "2.4.12"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 56da7cf..c50caaf 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.11'
+__version__ = '2.4.12'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index c549a17..91d5037 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -304,6 +304,31 @@ def _npx_launcher_failed_before_coana(returncode: int) -> bool:
         """
         return returncode < 0 or returncode >= 128
 
+    @staticmethod
+    def _resolve_coana_launcher_mode() -> str:
+        """Resolve the coana launcher mode: ``auto``, ``npx``, or ``npm-install``.
+
+        ``SOCKET_CLI_COANA_LAUNCHER`` wins when set to a recognized value; an unrecognized
+        value warns and behaves as ``auto``. Only when it is unset/empty do the legacy vars
+        apply: ``SOCKET_CLI_COANA_FORCE_NPM_INSTALL`` -> ``npm-install``, else
+        ``SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK`` -> ``npx``. Mirrors the Node CLI.
+        """
+        raw = os.environ.get("SOCKET_CLI_COANA_LAUNCHER", "")
+        mode = raw.strip().lower()
+        if mode in ("auto", "npx", "npm-install"):
+            return mode
+        if mode:
+            log.warning(
+                f'Ignoring unrecognized SOCKET_CLI_COANA_LAUNCHER value "{raw}"; '
+                'expected "auto", "npm-install", or "npx".'
+            )
+            return "auto"
+        if os.environ.get("SOCKET_CLI_COANA_FORCE_NPM_INSTALL"):
+            return "npm-install"
+        if os.environ.get("SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK"):
+            return "npx"
+        return "auto"
+
     def _spawn_coana(
         self,
         coana_args: List[str],
@@ -324,14 +349,15 @@ def _spawn_coana(
 
         Fallback path: if npx is missing, or its launcher dies before coana starts, install
         @coana-tech/cli into a temp dir via ``npm install`` and run it directly via ``node``.
-        Toggle with ``SOCKET_CLI_COANA_FORCE_NPM_INSTALL`` (use the fallback as the primary
-        path) and ``SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK`` (never fall back).
+        Tune with ``SOCKET_CLI_COANA_LAUNCHER``: ``auto`` (default; npx with the npm-install
+        fallback), ``npm-install`` (skip npx, always use the fallback path), or ``npx``
+        (never fall back).
         """
         effective_version = self._resolve_coana_version(version)
         coana_env = self._sanitize_coana_env(env)
-        disable_fallback = bool(os.environ.get("SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK"))
+        launcher_mode = self._resolve_coana_launcher_mode()
 
-        if os.environ.get("SOCKET_CLI_COANA_FORCE_NPM_INSTALL"):
+        if launcher_mode == "npm-install":
             return self._spawn_coana_via_npm_install(coana_args, effective_version, coana_env, cwd)
 
         package_spec = f"@coana-tech/cli@{effective_version}"
@@ -347,7 +373,7 @@ def _spawn_coana(
             )
         except FileNotFoundError:
             # npx is not on PATH: the launcher provably never started coana.
-            if disable_fallback:
+            if launcher_mode == "npx":
                 raise
             log.warning("npx not found on PATH; retrying reachability analysis via `npm install` + `node`.")
             return self._spawn_coana_via_npm_install(coana_args, effective_version, coana_env, cwd)
@@ -355,7 +381,7 @@ def _spawn_coana(
         if result.returncode == 0:
             return 0
 
-        if not disable_fallback and self._npx_launcher_failed_before_coana(result.returncode):
+        if launcher_mode != "npx" and self._npx_launcher_failed_before_coana(result.returncode):
             log.warning(
                 f"npx launcher failed (exit {result.returncode}) before coana started; "
                 "retrying reachability analysis via `npm install` + `node`."
diff --git a/tests/unit/test_reachability.py b/tests/unit/test_reachability.py
index 98933fe..670fd57 100644
--- a/tests/unit/test_reachability.py
+++ b/tests/unit/test_reachability.py
@@ -317,6 +317,54 @@ def fake_run(argv, **_kw):
     assert all(c[:2] != ["npm", "install"] for c in calls)
 
 
+def test_launcher_npm_install_skips_npx(analyzer, mocker, monkeypatch):
+    """SOCKET_CLI_COANA_LAUNCHER=npm-install routes straight to npm install + node."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_LAUNCHER", "npm-install")
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=0)
+    assert all(c[0] != "npx" for c in calls)
+    assert calls[0][:2] == ["npm", "install"]
+    assert calls[1][0] == "node"
+
+
+def test_launcher_npx_propagates_npx_failure(analyzer, mocker, monkeypatch):
+    """SOCKET_CLI_COANA_LAUNCHER=npx: a launcher failure is NOT retried via npm."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_LAUNCHER", "npx")
+    mocker.patch.object(analyzer, "_extract_scan_id", return_value=None)
+    calls = []
+
+    def fake_run(argv, **_kw):
+        calls.append(argv)
+        m = MagicMock()
+        m.returncode = 137
+        return m
+
+    mocker.patch.object(reachability.subprocess, "run", side_effect=fake_run)
+    with pytest.raises(Exception):
+        analyzer.run_reachability_analysis(org_slug="my-org", target_directory=".")
+    assert calls[0][0] == "npx"
+    assert all(c[:2] != ["npm", "install"] for c in calls)
+
+
+def test_launcher_overrides_legacy_vars(analyzer, mocker, monkeypatch):
+    """A recognized SOCKET_CLI_COANA_LAUNCHER wins; legacy vars are ignored entirely."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_LAUNCHER", "auto")
+    monkeypatch.setenv("SOCKET_CLI_COANA_FORCE_NPM_INSTALL", "1")
+    monkeypatch.setenv("SOCKET_CLI_COANA_DISABLE_NPM_FALLBACK", "1")
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=137)
+    assert calls[0][0] == "npx"  # force-npm-install ignored: npx still attempted
+    assert calls[1][:2] == ["npm", "install"]  # disable-fallback ignored: fallback runs
+    assert calls[2][0] == "node"
+
+
+def test_launcher_unrecognized_value_behaves_as_auto(analyzer, mocker, monkeypatch):
+    """An unrecognized SOCKET_CLI_COANA_LAUNCHER value warns and behaves as auto."""
+    monkeypatch.setenv("SOCKET_CLI_COANA_LAUNCHER", "bogus")
+    calls = _capture_spawns(analyzer, mocker, npx_behavior=137)
+    assert calls[0][0] == "npx"
+    assert calls[1][:2] == ["npm", "install"]
+    assert calls[2][0] == "node"
+
+
 def test_fallback_installs_once_per_version(analyzer, mocker):
     """A second in-process fallback for the same version reuses the install (no re-install)."""
     mocker.patch.object(analyzer, "_extract_scan_id", return_value="scan-123")
diff --git a/uv.lock b/uv.lock
index 0d11821..63b5eed 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.11"
+version = "2.4.12"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From c970eef1ac62634ec282ca929218460bb41eef78 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Mon, 22 Jun 2026 12:30:45 +0200
Subject: [PATCH 70/80] refactor(reachability): use full names instead of "tier
 1/2/3" + bump Coana CLI to 15.5.7 (#238)

Rename the reachability analysis types in user-facing text from the "Tier 1/2/3"
numbering to their full names: Full application reachability (formerly Tier 1),
Precomputed reachability (formerly Tier 2), and Dependency reachability (formerly
Tier 3). Only --help text, command output, log messages, comments, and docs change;
wire-format values such as the socket_tier1 scan type are kept as-is for backward
compatibility. A note in docs/cli-reference.md maps the old names to the new ones.

Also bump the pinned @coana-tech/cli version from 15.5.0 to 15.5.7.
---
 CHANGELOG.md                              | 13 ++++++++
 docs/cli-reference.md                     | 12 ++++++--
 docs/troubleshooting.md                   |  2 +-
 pyproject.toml                            |  2 +-
 socketsecurity/__init__.py                |  2 +-
 socketsecurity/core/__init__.py           | 36 +++++++++++------------
 socketsecurity/core/tools/reachability.py |  6 ++--
 uv.lock                                   |  2 +-
 8 files changed, 48 insertions(+), 27 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90b17fc..c7a50b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## 2.4.13
+
+### Changed: reachability analysis types now use full names instead of "Tier 1/2/3"
+
+- Reachability analysis types are referred to by their full names instead of the
+  "Tier 1/2/3" numbering: **Full application reachability** (formerly Tier 1),
+  **Precomputed reachability** (formerly Tier 2), and **Dependency reachability**
+  (formerly Tier 3). This updates `--help` text, command output, log messages, and docs
+  only — wire-format values such as the `socket_tier1` scan type are unchanged for
+  backward compatibility. See the reachability section in `docs/cli-reference.md` for the
+  old→new name mapping.
+- Bumped the pinned `@coana-tech/cli` version to `15.5.7`.
+
 ## 2.4.12
 
 ### Changed: consolidated coana launcher env vars into `SOCKET_CLI_COANA_LAUNCHER`
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 35e2218..fdbb5a7 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -240,8 +240,8 @@ If you don't want to provide the Socket API Token every time then you can use th
 #### Reachability Analysis
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
-| `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a tier-1 full-application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.5.0  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
+| `--reach-version`                  | False    | 15.5.7  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
@@ -271,6 +271,14 @@ The Python CLI verifies the following **up front** (before invoking the analysis
 
 Separately, the analysis engine (coana) needs the **per-ecosystem build toolchain** for whatever languages your project uses — e.g. a compatible Python interpreter (3.11+, or PyPy) for Python, a JDK for Java/Kotlin/Scala, .NET 6+ for C#, the matching Go toolchain for Go, etc. These are validated by the engine **at analysis time** (the CLI does not pre-check them) and that validation can be skipped with `--reach-disable-external-tool-checks`.
 
+**Reachability analysis types:**
+
+Socket's reachability analysis comes in three forms, referred to by their full names rather than the older "Tier" numbering:
+
+- **Full application reachability** (formerly *Tier 1*) — the full-application analysis enabled by `--reach`.
+- **Precomputed reachability** (formerly *Tier 2*).
+- **Dependency reachability** (formerly *Tier 3*).
+
 ## Config file support
 
 Use `--config <path>` to load defaults from a `.toml` or `.json` file.
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 80d08f9..531099c 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -22,7 +22,7 @@ Common reasons:
 - Policy vs dataset:
   - `--strict-blocking` only affects diff-scope behavior and does not make diff output equivalent to full dashboard data.
 - Reachability data availability:
-  - If reachability analysis partially fails and falls back to precomputed tiers, counts can shift.
+  - If reachability analysis partially fails and falls back to precomputed reachability, counts can shift.
 
 Recommended comparison path:
 
diff --git a/pyproject.toml b/pyproject.toml
index 96e9a77..151be6a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.12"
+version = "2.4.13"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index c50caaf..e8d10bb 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.12'
+__version__ = '2.4.13'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index 4e6c032..a8cef92 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -58,7 +58,7 @@
 # whose basename is exactly ``.socket.facts.json.br`` and stores it as plain
 # ``.socket.facts.json``. Compressing the facts file on upload keeps it well under the
 # server's per-file size cap (a ~262 MB facts file compresses to roughly 15-30 MB),
-# which is required for large reachability (tier 1) scans to succeed.
+# which is required for large full application reachability scans to succeed.
 #
 # The server matches the *exact* name ``.socket.facts.json.br``, so we only compress
 # files whose basename is exactly ``.socket.facts.json`` (a custom ``--reach-output-file``
@@ -72,8 +72,8 @@
 # Stream the facts file in 1 MiB chunks so large files aren't held fully in memory.
 SOCKET_FACTS_BROTLI_CHUNK_SIZE = 1024 * 1024
 
-# Tier 1 reachability finalize retry policy. The finalize call links the tier1 scan to the
-# full scan and can fail transiently (network/API blips); a few backoff retries make it robust.
+# Full application reachability finalize retry policy. The finalize call links the reachability
+# scan to the full scan and can fail transiently (network/API blips); a few backoff retries make it robust.
 TIER1_FINALIZE_MAX_ATTEMPTS = 3
 TIER1_FINALIZE_BACKOFF_SECONDS = 1.0
 
@@ -612,21 +612,21 @@ def empty_head_scan_file() -> List[str]:
 
     def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
         """
-        Finalize a tier 1 reachability scan by associating it with a full scan.
+        Finalize a full application reachability scan by associating it with a full scan.
 
         This function reads the tier1ReachabilityScanId from the facts file and
         calls the SDK to link it with the specified full scan.
 
-        Linking the tier 1 scan to the full scan helps the Socket team debug potential issues.
+        Linking the reachability scan to the full scan helps the Socket team debug potential issues.
 
         Args:
-            full_scan_id: The ID of the full scan to associate with the tier 1 scan
+            full_scan_id: The ID of the full scan to associate with the reachability scan
             facts_file_path: Path to the .socket.facts.json file containing the tier1ReachabilityScanId
 
         Returns:
             True if successful, False otherwise
         """
-        log.debug(f"Finalizing tier 1 scan for full scan {full_scan_id}")
+        log.debug(f"Finalizing full application reachability scan for full scan {full_scan_id}")
 
         # Read the tier1ReachabilityScanId from the facts file
         try:
@@ -649,7 +649,7 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
             log.debug(f"Failed to read tier1ReachabilityScanId from {facts_file_path}: {e}")
             return False
 
-        # Call the SDK to finalize the tier 1 scan, retrying transient failures with backoff.
+        # Call the SDK to finalize the full application reachability scan, retrying transient failures with backoff.
         last_error: Optional[Exception] = None
         for attempt in range(1, TIER1_FINALIZE_MAX_ATTEMPTS + 1):
             try:
@@ -659,7 +659,7 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
                 )
 
                 if success:
-                    log.debug(f"Successfully finalized tier 1 scan {tier1_scan_id} for full scan {full_scan_id}")
+                    log.debug(f"Successfully finalized full application reachability scan {tier1_scan_id} for full scan {full_scan_id}")
                     return True
 
                 log.debug(
@@ -669,7 +669,7 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
             except Exception as e:
                 last_error = e
                 log.debug(
-                    f"Unable to finalize tier 1 scan (attempt {attempt}/{TIER1_FINALIZE_MAX_ATTEMPTS}): {e}"
+                    f"Unable to finalize full application reachability scan (attempt {attempt}/{TIER1_FINALIZE_MAX_ATTEMPTS}): {e}"
                 )
 
             if attempt < TIER1_FINALIZE_MAX_ATTEMPTS:
@@ -677,12 +677,12 @@ def finalize_tier1_scan(self, full_scan_id: str, facts_file_path: str) -> bool:
 
         if last_error is not None:
             log.debug(
-                f"Giving up finalizing tier 1 scan {tier1_scan_id} after "
+                f"Giving up finalizing full application reachability scan {tier1_scan_id} after "
                 f"{TIER1_FINALIZE_MAX_ATTEMPTS} attempts: {last_error}"
             )
         else:
             log.debug(
-                f"Giving up finalizing tier 1 scan {tier1_scan_id} after "
+                f"Giving up finalizing full application reachability scan {tier1_scan_id} after "
                 f"{TIER1_FINALIZE_MAX_ATTEMPTS} attempts"
             )
         return False
@@ -846,21 +846,21 @@ def create_full_scan(self, files: List[str], params: FullScanParams, base_paths:
         total_time = create_full_end - create_full_start
         log.debug(f"New Full Scan created in {total_time:.2f} seconds")
 
-        # Finalize tier1 scan if reachability analysis was enabled
+        # Finalize full application reachability scan if reachability analysis was enabled
         if self.cli_config and self.cli_config.reach:
             facts_file_path = os.path.join(
-                self.cli_config.target_path or ".", 
+                self.cli_config.target_path or ".",
                 self.cli_config.reach_output_file
             )
-            log.debug(f"Reachability analysis enabled, finalizing tier1 scan for full scan {full_scan.id}")
+            log.debug(f"Reachability analysis enabled, finalizing full application reachability scan for full scan {full_scan.id}")
             try:
                 success = self.finalize_tier1_scan(full_scan.id, facts_file_path)
                 if success:
-                    log.debug(f"Successfully finalized tier1 scan for full scan {full_scan.id}")
+                    log.debug(f"Successfully finalized full application reachability scan for full scan {full_scan.id}")
                 else:
-                    log.debug(f"Failed to finalize tier1 scan for full scan {full_scan.id}")
+                    log.debug(f"Failed to finalize full application reachability scan for full scan {full_scan.id}")
             except Exception as e:
-                log.warning(f"Error finalizing tier1 scan for full scan {full_scan.id}: {e}")
+                log.warning(f"Error finalizing full application reachability scan for full scan {full_scan.id}: {e}")
 
         return full_scan
 
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 91d5037..4fd6d06 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.5.0"
+DEFAULT_COANA_CLI_VERSION: Final = "15.5.7"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.0').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.7').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.0').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.7').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 63b5eed..160f494 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.12"
+version = "2.4.13"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 73bd4b00ded623ed57a7823beea8367e70d05736 Mon Sep 17 00:00:00 2001
From: Benjamin Barslev Nielsen <benjaminbarslev@gmail.com>
Date: Wed, 24 Jun 2026 12:40:38 +0200
Subject: [PATCH 71/80] chore: bump pinned @coana-tech/cli to 15.5.9 (2.4.14)
 (#240)

---
 CHANGELOG.md                              | 6 ++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7a50b0..4c64a22 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.4.14
+
+### Changed: bump pinned @coana-tech/cli to 15.5.9
+
+- Bumped the pinned `@coana-tech/cli` version to `15.5.9` (previously `15.5.7`).
+
 ## 2.4.13
 
 ### Changed: reachability analysis types now use full names instead of "Tier 1/2/3"
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index fdbb5a7..c0c9c86 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.5.7  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.5.9  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index 151be6a..b1ee83c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.13"
+version = "2.4.14"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index e8d10bb..6e74354 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.13'
+__version__ = '2.4.14'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 4fd6d06..e09e4df 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.5.7"
+DEFAULT_COANA_CLI_VERSION: Final = "15.5.9"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.7').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.9').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.7').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.9').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 160f494..9f40b7b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.13"
+version = "2.4.14"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 7c0368bd6abcc9770949565835cc2b6aa689a2f6 Mon Sep 17 00:00:00 2001
From: Martin Torp <martin@socket.dev>
Date: Fri, 26 Jun 2026 15:48:04 +0200
Subject: [PATCH 72/80] Bump pinned @coana-tech/cli to 15.6.1 (#242)

Co-authored-by: socket-release-bot[bot] <234652667+socket-release-bot[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c64a22..97b59d1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.15
+
+### Changed: bump pinned @coana-tech/cli to 15.6.1
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.5.9` to
+  `15.6.1`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.14
 
 ### Changed: bump pinned @coana-tech/cli to 15.5.9
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index c0c9c86..9d83610 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.5.9  | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.6.1 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index b1ee83c..e0c4938 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.14"
+version = "2.4.15"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 6e74354..1ecf50d 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.14'
+__version__ = '2.4.15'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index e09e4df..f2b3612 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.5.9"
+DEFAULT_COANA_CLI_VERSION: Final = "15.6.1"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.5.9').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.6.1').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.5.9').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.6.1').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 9f40b7b..4d0ad6d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.14"
+version = "2.4.15"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 6df16c06188ae795e21f50ba832c7e30e9715482 Mon Sep 17 00:00:00 2001
From: "socket-security-prs[bot]"
 <294242679+socket-security-prs[bot]@users.noreply.github.com>
Date: Wed, 1 Jul 2026 16:01:56 +0200
Subject: [PATCH 73/80] Bump pinned @coana-tech/cli to 15.6.7 (#247)

Co-authored-by: socket-security-prs[bot] <294242679+socket-security-prs[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 97b59d1..c17cb4b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.16
+
+### Changed: bump pinned @coana-tech/cli to 15.6.7
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.6.1` to
+  `15.6.7`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.15
 
 ### Changed: bump pinned @coana-tech/cli to 15.6.1
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 9d83610..d3554a3 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.6.1 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.6.7 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index e0c4938..8b628f9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.15"
+version = "2.4.16"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 1ecf50d..f851007 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.15'
+__version__ = '2.4.16'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index f2b3612..7f25ed8 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.6.1"
+DEFAULT_COANA_CLI_VERSION: Final = "15.6.7"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.6.1').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.6.7').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.6.1').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.6.7').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 4d0ad6d..85f6669 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.15"
+version = "2.4.16"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From b4b54b5f327629838e35e629effa1a06df904cf6 Mon Sep 17 00:00:00 2001
From: "socket-security-prs[bot]"
 <294242679+socket-security-prs[bot]@users.noreply.github.com>
Date: Fri, 3 Jul 2026 13:20:57 +0200
Subject: [PATCH 74/80] Bump pinned @coana-tech/cli to 15.8.1 (#252)

Co-authored-by: socket-security-prs[bot] <294242679+socket-security-prs[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c17cb4b..d6e62ae 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.17
+
+### Changed: bump pinned @coana-tech/cli to 15.8.1
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.6.7` to
+  `15.8.1`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.16
 
 ### Changed: bump pinned @coana-tech/cli to 15.6.7
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index d3554a3..6fdbc8d 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.6.7 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.8.1 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index 8b628f9..2dd9d88 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.16"
+version = "2.4.17"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index f851007..94f1e02 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.16'
+__version__ = '2.4.17'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 7f25ed8..487785f 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.6.7"
+DEFAULT_COANA_CLI_VERSION: Final = "15.8.1"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.6.7').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.1').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.6.7').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.1').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 85f6669..75a8c48 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.16"
+version = "2.4.17"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From c1a6c0aa467015822bd79aa12fb9e8ff36bda542 Mon Sep 17 00:00:00 2001
From: "socket-security-prs[bot]"
 <294242679+socket-security-prs[bot]@users.noreply.github.com>
Date: Tue, 7 Jul 2026 16:41:04 +0200
Subject: [PATCH 75/80] Bump pinned @coana-tech/cli to 15.8.4 (#255)

Co-authored-by: socket-security-prs[bot] <294242679+socket-security-prs[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6e62ae..215b335 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.18
+
+### Changed: bump pinned @coana-tech/cli to 15.8.4
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.8.1` to
+  `15.8.4`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.17
 
 ### Changed: bump pinned @coana-tech/cli to 15.8.1
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 6fdbc8d..03681b8 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.8.1 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.8.4 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index 2dd9d88..b2eb55c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.17"
+version = "2.4.18"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 94f1e02..6f00f0c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.17'
+__version__ = '2.4.18'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 487785f..afffc37 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.8.1"
+DEFAULT_COANA_CLI_VERSION: Final = "15.8.4"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.1').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.4').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.1').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.4').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 75a8c48..a0d7ba1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.17"
+version = "2.4.18"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From f3a05f8358e9dc048d25a00a7ef083a0a4c77b69 Mon Sep 17 00:00:00 2001
From: "socket-pr-bot[bot]"
 <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 15:30:52 +0200
Subject: [PATCH 76/80] Bump pinned @coana-tech/cli to 15.8.5 (#256)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 215b335..83b83f5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.19
+
+### Changed: bump pinned @coana-tech/cli to 15.8.5
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.8.4` to
+  `15.8.5`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.18
 
 ### Changed: bump pinned @coana-tech/cli to 15.8.4
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 03681b8..999b3cf 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.8.4 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.8.5 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index b2eb55c..f231c60 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.18"
+version = "2.4.19"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 6f00f0c..b845d5c 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.18'
+__version__ = '2.4.19'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index afffc37..81f7812 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.8.4"
+DEFAULT_COANA_CLI_VERSION: Final = "15.8.5"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.4').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.5').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.4').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.5').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index a0d7ba1..697dd32 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.18"
+version = "2.4.19"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 12f97fb99d905df53d050e4e16348f8bdefffc0d Mon Sep 17 00:00:00 2001
From: "socket-pr-bot[bot]"
 <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 20:02:59 +0200
Subject: [PATCH 77/80] Bump pinned @coana-tech/cli to 15.8.8 (#259)

* Bump pinned @coana-tech/cli to 15.8.8

* Upgrade soupsieve to 2.8.4 to resolve pip-audit CVEs (CVE-2026-49476, CVE-2026-49477)

---------

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Co-authored-by: barslev <barslev@socket.dev>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 8 ++++----
 6 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83b83f5..0f165c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.4.20
+
+### Changed: bump pinned @coana-tech/cli to 15.8.8
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.8.5` to
+  `15.8.8`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.4.19
 
 ### Changed: bump pinned @coana-tech/cli to 15.8.5
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 999b3cf..00828d6 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -241,7 +241,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.8.5 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.8.8 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index f231c60..52abf4b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.19"
+version = "2.4.20"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index b845d5c..7f863af 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.19'
+__version__ = '2.4.20'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 81f7812..6560467 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.8.5"
+DEFAULT_COANA_CLI_VERSION: Final = "15.8.8"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.5').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.8').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.5').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.8').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index 697dd32..6805666 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.19"
+version = "2.4.20"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },
@@ -1351,11 +1351,11 @@ dev = [{ name = "pre-commit", specifier = ">=4.3.0" }]
 
 [[package]]
 name = "soupsieve"
-version = "2.8.1"
+version = "2.8.4"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/89/23/adf3796d740536d63a6fbda113d07e60c734b6ed5d3058d1e47fc0495e47/soupsieve-2.8.1.tar.gz", hash = "sha256:4cf733bc50fa805f5df4b8ef4740fc0e0fa6218cf3006269afd3f9d6d80fd350", size = 117856, upload-time = "2025-12-18T13:50:34.655Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/47/2c/0a5f6f8ee0d5589e48c7640213ed5175d52cf540a06725b628cc1a45d6ce/soupsieve-2.8.4.tar.gz", hash = "sha256:e121fd02e975c695e4e9e8774a5ee35d74714b59307868dcc5319ad2d9e3328e", size = 121110, upload-time = "2026-05-24T13:55:57.154Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/48/f3/b67d6ea49ca9154453b6d70b34ea22f3996b9fa55da105a79d8732227adc/soupsieve-2.8.1-py3-none-any.whl", hash = "sha256:a11fe2a6f3d76ab3cf2de04eb339c1be5b506a8a47f2ceb6d139803177f85434", size = 36710, upload-time = "2025-12-18T13:50:33.267Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/f5/0c41cb68dcae6b7de4fac4188a3a9589e21fb31df21ea3a2e888db95e6c9/soupsieve-2.8.4-py3-none-any.whl", hash = "sha256:e7e6b0769c8f51ed59acab6e994b00621096cfb1c640a7509295987388fbaf65", size = 37304, upload-time = "2026-05-24T13:55:55.406Z" },
 ]
 
 [[package]]

From cf83115baa0f357360d0b50f9d9635abe9a299ec Mon Sep 17 00:00:00 2001
From: lelia <2418071+lelia@users.noreply.github.com>
Date: Tue, 14 Jul 2026 16:04:43 -0400
Subject: [PATCH 78/80] Add `--base-scan-id` / `--base-commit-sha` flags for
 diffing against a chosen baseline (#261)

* add --base-scan-id / --base-commit-sha diff baseline overrides

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* document baseline overrides, merge-base workflow, Buildlkite-specific guidance

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

* bump to v2.5.0, add CHANGELOG entry

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>

---------

Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
---
 CHANGELOG.md                    |  22 ++++++
 README.md                       |  26 ++++++-
 docs/ci-cd.md                   |  48 ++++++++++++
 docs/cli-reference.md           |  34 ++++++++
 pyproject.toml                  |   2 +-
 socketsecurity/__init__.py      |   2 +-
 socketsecurity/config.py        |  29 +++++++
 socketsecurity/core/__init__.py | 102 ++++++++++++++++++++++--
 tests/core/test_sdk_methods.py  | 133 +++++++++++++++++++++++++++++++-
 tests/unit/test_config.py       |  51 ++++++++++++
 uv.lock                         |   2 +-
 11 files changed, 437 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f165c3..ee8851e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## 2.5.0
+
+### Added: `--base-scan-id` / `--base-commit-sha` diff baseline overrides
+
+- New mutually exclusive flags to control which full scan a diff is compared
+  against, instead of always using the repository's latest head scan:
+  - `--base-scan-id <id>` diffs against that full scan ID verbatim.
+  - `--base-commit-sha <sha>` diffs against the most recent full scan created
+    from that commit — e.g. the PR's merge base from
+    `git merge-base origin/main HEAD` — so PR diffs are not polluted by
+    default-branch commits the PR never branched from.
+- A `--base-commit-sha` with no matching full scan is a hard error (exit code 3,
+  or `--exit-code-on-api-error`; exit 0 with `--disable-blocking`) rather than a
+  silent fallback to the head scan, since diffing against the wrong baseline
+  misreports which alerts a PR introduces.
+- Both flags are also settable via `--config` files (`base_scan_id`,
+  `base_commit_sha`).
+- **Requirement:** `--base-commit-sha` looks up an existing scan — it does not
+  create one. Using it requires CI to run `socketcli` on every commit that lands
+  on the default branch; see the "Diffing against the merge base" note in
+  `docs/cli-reference.md` for the failure modes and a backfill pattern.
+
 ## 2.4.20
 
 ### Changed: bump pinned @coana-tech/cli to 15.8.8
diff --git a/README.md b/README.md
index a3eeb10..cda9a40 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,26 @@ socketcli --target-path .
 socketcli --enable-gitlab-security --gitlab-security-file gl-dependency-scanning-report.json
 ```
 
+### PR scan diffed against the merge base
+
+By default, PR scans are diffed against the repository's latest head scan. To diff against
+the exact commit your PR branched from instead, pass the merge base as the baseline:
+
+```bash
+BASE_SHA=$(git merge-base origin/main HEAD)
+socketcli --pr-number 123 --base-commit-sha "$BASE_SHA"
+```
+
+> **Requirement:** `--base-commit-sha` only works if Socket already has a full scan for that
+> exact commit. In practice this means your CI must run `socketcli` on **every commit that
+> lands on your default branch** — not just some of them. If merges can land without a scan
+> (skipped/canceled builds, `[skip ci]`, path-filtered pipelines), the PR scan will fail with
+> exit code 3 rather than silently diff against the wrong baseline. See
+> [`docs/cli-reference.md`](https://github.com/SocketDev/socket-python-cli/blob/main/docs/cli-reference.md)
+> for the full requirements and a backfill pattern that makes PR jobs self-sufficient.
+
+A specific full scan ID also works: `--base-scan-id <id>`.
+
 ## SARIF use cases
 
 ### Full-scope reachable SARIF (grouped alerts)
@@ -204,8 +224,10 @@ Minimal pattern:
 | `3`  | Infrastructure or API error (timeout, network failure, unexpected error) |
 
 `--exit-code-on-api-error <N>` remaps the infrastructure-error code (`3`) to any
-value — e.g. a Buildkite `soft_fail` code, or `0` to swallow infra errors. Exit
-`3` is a Socket convention, not an industry standard.
+value — e.g. a Buildkite
+[`soft_fail`](https://buildkite.com/docs/pipelines/configure/step-types/command-step)
+code, or `0` to swallow infra errors. Exit `3` is a Socket convention, not an
+industry standard.
 
 ### How these options interact
 
diff --git a/docs/ci-cd.md b/docs/ci-cd.md
index edf3a4e..66193f3 100644
--- a/docs/ci-cd.md
+++ b/docs/ci-cd.md
@@ -81,6 +81,54 @@ steps:
       SOCKET_SECURITY_API_TOKEN: "${SOCKET_SECURITY_API_TOKEN}"
 ```
 
+#### Merge-base baselines in Buildkite (dynamic pipelines)
+
+Notes for using `--base-commit-sha` (see the
+[merge-base note in the CLI reference](cli-reference.md#pull-request-and-commit))
+when your steps are emitted by a
+[dynamic pipeline](https://buildkite.com/docs/pipelines/configure/dynamic-pipelines)
+generator rather than a static YAML file:
+
+- **Compute the merge base at generation time, not step time.** The generator runs
+  with a full checkout; step agents may have shallow or fresh clones where
+  `git merge-base` fails or needs an extra fetch. Resolve it once in the generator and
+  bake it into the emitted step's `env`. Diff against the PR's *target* branch, which
+  isn't always the default branch (see Buildkite's
+  [environment variables](https://buildkite.com/docs/pipelines/configure/environment-variables)):
+
+  ```shell
+  TARGET="${BUILDKITE_PULL_REQUEST_BASE_BRANCH:-$BUILDKITE_PIPELINE_DEFAULT_BRANCH}"
+  BASE_SHA=$(git merge-base "origin/${TARGET}" HEAD)
+  ```
+
+- **Emit the backfill step conditionally from the generator.** The generator is the
+  natural place for the "does a baseline scan exist?" check
+  (`GET /orgs/{org}/full-scans?repo=<repo>&commit_hash=$BASE_SHA&per_page=1`): only
+  emit the baseline-scan step when it returns nothing. The emitted pipeline then shows
+  in the UI whether a backfill will run.
+
+- **Keep the backfill inside one command step.** The checkout-base → scan →
+  checkout-PR sequence must not be split across steps — steps can land on different
+  agents with different checkouts. Prefer
+  [`git worktree`](https://git-scm.com/docs/git-worktree) over mutating the step's
+  checkout: `git worktree add /tmp/socket-base "$BASE_SHA"` then
+  `socketcli --target-path /tmp/socket-base --branch "$TARGET" --disable-blocking`.
+
+- **Soft-fail infra errors, not findings.** A missing baseline (or any API error)
+  exits with code 3 (`--exit-code-on-api-error` to change it); real findings exit 1.
+  [`soft_fail: [{exit_status: 3}]`](https://buildkite.com/docs/pipelines/configure/step-types/command-step)
+  on the PR scan step keeps infra errors from blocking merges while security findings
+  still do.
+
+- **["Cancel intermediate builds"](https://buildkite.com/docs/pipelines/configure/canceling-builds#cancel-running-intermediate-builds)
+  on the default branch is the main source of baseline gaps.** Canceled builds never
+  scan their commit, so merge-base lookups for PRs based on those commits fail. The
+  conditional backfill step above is the remedy; there is no per-step exemption from
+  build cancellation in Buildkite. If you need strict scan-once semantics for
+  concurrent backfills of the same merge base, serialize the backfill step with a
+  [concurrency group](https://buildkite.com/docs/pipelines/configure/workflows/controlling-concurrency)
+  keyed on the merge-base SHA.
+
 ### GitLab CI
 
 ```yaml
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 00828d6..ca7be23 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -146,6 +146,7 @@ This will simultaneously generate:
 socketcli [-h] [--api-token API_TOKEN] [--repo REPO] [--workspace WORKSPACE] [--repo-is-public] [--branch BRANCH] [--integration {api,github,gitlab,azure,bitbucket}]
           [--config <path>]
           [--owner OWNER] [--pr-number PR_NUMBER] [--commit-message COMMIT_MESSAGE] [--commit-sha COMMIT_SHA] [--committers [COMMITTERS ...]]
+          [--base-scan-id BASE_SCAN_ID | --base-commit-sha BASE_COMMIT_SHA]
           [--target-path TARGET_PATH] [--sbom-file SBOM_FILE] [--license-file-name LICENSE_FILE_NAME] [--save-submitted-files-list SAVE_SUBMITTED_FILES_LIST]
           [--save-manifest-tar SAVE_MANIFEST_TAR] [--files FILES] [--sub-path SUB_PATH] [--workspace-name WORKSPACE_NAME]
           [--excluded-ecosystems EXCLUDED_ECOSYSTEMS] [--exclude-paths EXCLUDE_PATHS] [--include-dirs INCLUDE_DIRS] [--default-branch] [--pending-head] [--generate-license] [--enable-debug]
@@ -191,6 +192,39 @@ If you don't want to provide the Socket API Token every time then you can use th
 | `--pr-number`      | False    | "0"     | Pull request number                            |
 | `--commit-message` | False    | *auto*  | Commit message (auto-detected from git)       |
 | `--commit-sha`     | False    | *auto*  | Commit SHA (auto-detected from git)           |
+| `--base-scan-id`   | False    |         | Full scan ID to diff against, overriding the repository's head scan as the baseline. Mutually exclusive with `--base-commit-sha` |
+| `--base-commit-sha`| False    |         | Commit SHA to diff against, overriding the repository's head scan as the baseline. The most recent full scan for that commit is used; the CLI errors (exit code 3, or `--exit-code-on-api-error`) if no scan exists for it. Mutually exclusive with `--base-scan-id` |
+
+> **Diffing against the merge base** — by default, PR scans are diffed against the repository's *latest* head scan, which may include newer default-branch commits than your PR branched from. To diff against the exact commit your PR is based on, compute the merge base and pass it as the baseline:
+>
+> ```shell
+> BASE_SHA=$(git merge-base origin/main HEAD)
+> socketcli --pr-number 123 --base-commit-sha "$BASE_SHA"
+> ```
+>
+> **Requirement: a full scan must already exist for the merge-base commit.** `--base-commit-sha` does not create a scan of that commit; it looks up an existing one. That lookup only succeeds if your CI runs `socketcli` on **every commit that lands on your default branch** — every merge and direct push, not just periodic or latest-only scans. Common ways commits slip through without a scan:
+>
+> - CI settings that cancel or skip intermediate builds when newer commits land (e.g. Buildkite's ["cancel intermediate builds"](https://buildkite.com/docs/pipelines/configure/canceling-builds#cancel-running-intermediate-builds))
+> - `[skip ci]` commits, path-filtered pipelines, or failed/canceled scan steps
+> - merge-base commits that predate your Socket rollout
+>
+> If no scan exists for the commit, the CLI **fails** (exit code 3, or your `--exit-code-on-api-error` value; exit 0 with `--disable-blocking`) instead of silently falling back to the head scan — a wrong baseline would misreport which alerts the PR introduces. Don't adopt this flag without default-branch scan coverage in place; you'll fail PR builds on lookup misses.
+>
+> **Backfill pattern** — if your default-branch coverage has gaps, the PR job can create the missing baseline itself before scanning:
+>
+> ```shell
+> BASE_SHA=$(git merge-base origin/main HEAD)
+> # Create the baseline only if Socket doesn't have one for this commit yet
+> # (check: GET /orgs/{org}/full-scans?repo=<repo>&commit_hash=$BASE_SHA&per_page=1)
+> git checkout "$BASE_SHA"
+> socketcli --branch main --disable-blocking
+> git checkout -
+> socketcli --pr-number 123 --base-commit-sha "$BASE_SHA"
+> ```
+>
+> Run the baseline step with `--disable-blocking` (findings on the default branch must not fail the PR job) and an explicit `--branch`, since branch auto-detection is unreliable at a detached HEAD.
+>
+> Buildkite users with dynamically generated pipelines: see [Merge-base baselines in Buildkite](ci-cd.md#merge-base-baselines-in-buildkite-dynamic-pipelines) for generation-time vs. step-time guidance.
 
 #### Path and File
 | Parameter                   | Required | Default               | Description                                                                                                                                                                      |
diff --git a/pyproject.toml b/pyproject.toml
index 52abf4b..716c413 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.4.20"
+version = "2.5.0"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 7f863af..f44ed53 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.4.20'
+__version__ = '2.5.0'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/config.py b/socketsecurity/config.py
index 79495fc..2654244 100644
--- a/socketsecurity/config.py
+++ b/socketsecurity/config.py
@@ -119,6 +119,8 @@ class CliConfig:
     scm: str = "api"
     sbom_file: Optional[str] = None
     commit_sha: str = ""
+    base_scan_id: Optional[str] = None
+    base_commit_sha: Optional[str] = None
     generate_license: bool = False
     enable_debug: bool = False
     allow_unverified: bool = False
@@ -265,6 +267,8 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             'scm': args.scm,
             'sbom_file': args.sbom_file,
             'commit_sha': args.commit_sha,
+            'base_scan_id': args.base_scan_id,
+            'base_commit_sha': args.base_commit_sha,
             'generate_license': args.generate_license,
             'enable_debug': args.enable_debug,
             'enable_diff': args.enable_diff,
@@ -406,6 +410,12 @@ def from_args(cls, args_list: Optional[List[str]] = None) -> 'CliConfig':
             logging.error("--workspace-name requires --sub-path to be specified")
             exit(1)
 
+        # argparse only enforces the mutually exclusive group for real CLI args;
+        # this also catches both values arriving via a --config file.
+        if args.base_scan_id and args.base_commit_sha:
+            logging.error("--base-scan-id and --base-commit-sha are mutually exclusive")
+            exit(1)
+
         if args.sarif_scope == "full" and not args.reach:
             logging.error("--sarif-scope full requires --reach to be specified")
             exit(1)
@@ -560,6 +570,25 @@ def create_argument_parser() -> argparse.ArgumentParser:
         help="Committer for the commit (comma separated)",
         nargs="*"
     )
+    base_scan_group = pr_group.add_mutually_exclusive_group()
+    base_scan_group.add_argument(
+        "--base-scan-id",
+        dest="base_scan_id",
+        metavar="<id>",
+        default=None,
+        help="Full scan ID to diff the new scan against, overriding the repository's "
+             "head scan as the baseline. Mutually exclusive with --base-commit-sha."
+    )
+    base_scan_group.add_argument(
+        "--base-commit-sha",
+        dest="base_commit_sha",
+        metavar="<sha>",
+        default=None,
+        help="Commit SHA to diff the new scan against, overriding the repository's head "
+             "scan as the baseline. The most recent full scan matching this commit (e.g. "
+             "the merge base from 'git merge-base origin/main HEAD') is used; the CLI "
+             "errors if no scan exists for it. Mutually exclusive with --base-scan-id."
+    )
 
     # Path and File options
     path_group = parser.add_argument_group('Path and File')
diff --git a/socketsecurity/core/__init__.py b/socketsecurity/core/__init__.py
index a8cef92..a372de4 100644
--- a/socketsecurity/core/__init__.py
+++ b/socketsecurity/core/__init__.py
@@ -1154,6 +1154,94 @@ def get_head_scan_for_repo(self, repo_slug: str) -> str:
         repo_info = self.get_repo_info(repo_slug)
         return repo_info.head_full_scan_id if repo_info.head_full_scan_id else None
 
+    def get_full_scan_id_by_commit(
+            self,
+            repo_slug: str,
+            commit_sha: str,
+            workspace: Optional[str] = None,
+            scan_type: Optional[str] = None
+    ) -> Optional[str]:
+        """
+        Finds the most recent full scan for a repository + commit SHA.
+
+        Used by --base-commit-sha to resolve the diff baseline (e.g. the merge-base
+        commit of a PR). When the same commit was scanned more than once, the newest
+        scan wins.
+
+        Args:
+            repo_slug: Repository slug the scan belongs to
+            commit_sha: Commit SHA the scan was created from
+            workspace: Socket workspace the scan belongs to, if any
+            scan_type: Socket scan type to match, if any
+
+        Returns:
+            Full scan ID if one exists for that commit, None otherwise
+        """
+        query_params = {
+            "repo": repo_slug,
+            "commit_hash": commit_sha,
+            "sort": "created_at",
+            "direction": "desc",
+            "per_page": 1,
+        }
+        if workspace:
+            query_params["workspace"] = workspace
+        if scan_type:
+            query_params["scan_type"] = scan_type
+
+        response = self.sdk.fullscans.get(
+            self.config.org_slug,
+            query_params,
+        )
+        results = response.get("results") if isinstance(response, dict) else None
+        if not results:
+            return None
+        return results[0].get("id")
+
+    def resolve_base_full_scan_id(self, params: FullScanParams) -> Optional[str]:
+        """
+        Resolves the baseline full scan ID to diff a new scan against.
+
+        Priority: --base-scan-id (used verbatim), then --base-commit-sha (newest
+        full scan for that commit), then the repository's current head scan. A
+        --base-commit-sha with no matching full scan is a hard error rather than a
+        silent fallback to the head scan, because diffing against the wrong
+        baseline silently misreports which alerts a PR introduces.
+
+        Returns:
+            Full scan ID to use as the diff baseline, or None when the repository
+            has no head scan yet (caller creates an empty baseline scan).
+        """
+        if self.cli_config and self.cli_config.base_scan_id:
+            log.info(f"Using full scan {self.cli_config.base_scan_id} as diff baseline (--base-scan-id)")
+            return self.cli_config.base_scan_id
+
+        if self.cli_config and self.cli_config.base_commit_sha:
+            commit_sha = self.cli_config.base_commit_sha
+            scan_id = self.get_full_scan_id_by_commit(
+                params.repo,
+                commit_sha,
+                workspace=params.workspace,
+                scan_type=params.scan_type,
+            )
+            if scan_id is None:
+                log.error(
+                    f"No full scan found for commit {commit_sha} in repo {params.repo} "
+                    "(--base-commit-sha). Ensure a scan was created for that commit "
+                    "(e.g. the CLI runs on default-branch pushes), or pass "
+                    "--base-scan-id instead."
+                )
+                if self.cli_config.disable_blocking:
+                    sys.exit(0)
+                sys.exit(self.cli_config.exit_code_on_api_error)
+            log.info(f"Using full scan {scan_id} (commit {commit_sha}) as diff baseline (--base-commit-sha)")
+            return scan_id
+
+        try:
+            return self.get_head_scan_for_repo(params.repo)
+        except APIResourceNotFound:
+            return None
+
     @staticmethod
     def update_package_values(pkg: Package) -> Package:
         pkg.purl = f"{pkg.name}@{pkg.version}"
@@ -1242,8 +1330,8 @@ def get_added_and_removed_packages(
                     OVERWRITES whatever the diff embedded, before anything reads it.
                 Either way the embedded license payload is dead weight, and on
                 large dependency trees it inflated the diff response past ~2.3MB
-                and truncated it mid-string, crashing ``response.json()``
-                (CE-224, customer: Tremendous). Defaulting to ``False`` keeps the
+                and truncated it mid-string, crashing ``response.json()``.
+                Defaulting to ``False`` keeps the
                 diff lean with zero change to any output artifact. The parameter
                 is retained as an explicit override seam, not wired to the
                 ``--exclude-license-details`` user flag (which still governs the
@@ -1388,11 +1476,9 @@ def create_new_diff(
             log.info("No supported manifest files found - creating empty scan for diff comparison")
             scan_files = Core.empty_head_scan_file()
 
-        try:
-            # Get head scan ID
-            head_full_scan_id = self.get_head_scan_for_repo(params.repo)
-        except APIResourceNotFound:
-            head_full_scan_id = None
+        # Resolve the baseline scan: --base-scan-id / --base-commit-sha override
+        # the repository's head scan (None only when the repo has no head scan yet).
+        head_full_scan_id = self.resolve_base_full_scan_id(params)
 
         # If no head scan exists, create an empty baseline scan
         if head_full_scan_id is None:
@@ -1475,7 +1561,7 @@ def create_new_diff(
         # (the --exclude-license-details user flag) into the diff request. The
         # diff path never consumes embedded license data (see
         # get_added_and_removed_packages docstring), so requesting it only bloats
-        # the response and risks the CE-224 truncation crash on large repos. The
+        # the response and risks the truncation crash on large repos. The
         # user flag still controls the dashboard report URL below; it just no
         # longer gates this internal diff payload.
         (
diff --git a/tests/core/test_sdk_methods.py b/tests/core/test_sdk_methods.py
index 2cad8e5..9b1ce44 100644
--- a/tests/core/test_sdk_methods.py
+++ b/tests/core/test_sdk_methods.py
@@ -1,6 +1,7 @@
 import pytest
 from socketdev.fullscans import FullScanParams
 
+from socketsecurity.config import CliConfig
 from socketsecurity.core import Core
 from socketsecurity.core.socket_config import SocketConfig
 
@@ -10,6 +11,23 @@ def core(mock_sdk_with_responses):
     config = SocketConfig(api_key="test_key")
     return Core(config=config, sdk=mock_sdk_with_responses)
 
+
+def make_cli_config(*extra_args):
+    return CliConfig.from_args(["--api-token", "test-token", "--repo", "test", *extra_args])
+
+
+def make_full_scan_params(**overrides):
+    values = {
+        "repo": "test",
+        "branch": "main",
+        "commit_hash": "head123",
+        "scan_type": "socket",
+        "workspace": None,
+    }
+    values.update(overrides)
+    return FullScanParams(**values)
+
+
 def test_get_repo_info(core, mock_sdk_with_responses):
     """Test getting repository information"""
     repo_info = core.get_repo_info("test")
@@ -44,6 +62,119 @@ def test_get_head_scan_for_repo_no_head(core, mock_sdk_with_responses):
     head_scan_id = core.get_head_scan_for_repo("no-head")
     assert head_scan_id is None
 
+def test_get_full_scan_id_by_commit(core, mock_sdk_with_responses):
+    """Looks up the newest full scan for a repo + commit via the list endpoint"""
+    mock_sdk_with_responses.fullscans.get.return_value = {
+        "results": [{"id": "base-scan-id", "commit_hash": "abc123"}],
+        "nextPage": None,
+    }
+
+    scan_id = core.get_full_scan_id_by_commit("test", "abc123")
+
+    assert scan_id == "base-scan-id"
+    mock_sdk_with_responses.fullscans.get.assert_called_once_with(
+        core.config.org_slug,
+        {
+            "repo": "test",
+            "commit_hash": "abc123",
+            "sort": "created_at",
+            "direction": "desc",
+            "per_page": 1,
+        },
+    )
+
+
+def test_get_full_scan_id_by_commit_scopes_to_workspace_and_scan_type(core, mock_sdk_with_responses):
+    """Looks up a baseline scan from the same workspace and scan type as the new scan"""
+    mock_sdk_with_responses.fullscans.get.return_value = {
+        "results": [{"id": "workspace-reach-base", "commit_hash": "abc123"}],
+        "nextPage": None,
+    }
+
+    scan_id = core.get_full_scan_id_by_commit(
+        "test",
+        "abc123",
+        workspace="customer-a",
+        scan_type="socket_tier1",
+    )
+
+    assert scan_id == "workspace-reach-base"
+    mock_sdk_with_responses.fullscans.get.assert_called_once_with(
+        core.config.org_slug,
+        {
+            "repo": "test",
+            "commit_hash": "abc123",
+            "sort": "created_at",
+            "direction": "desc",
+            "per_page": 1,
+            "workspace": "customer-a",
+            "scan_type": "socket_tier1",
+        },
+    )
+
+
+def test_get_full_scan_id_by_commit_not_found(core, mock_sdk_with_responses):
+    """No scan for the commit returns None (empty results and SDK error dict)"""
+    mock_sdk_with_responses.fullscans.get.return_value = {"results": [], "nextPage": None}
+    assert core.get_full_scan_id_by_commit("test", "abc123") is None
+
+    mock_sdk_with_responses.fullscans.get.return_value = {}
+    assert core.get_full_scan_id_by_commit("test", "abc123") is None
+
+def test_resolve_base_full_scan_id_defaults_to_head_scan(core):
+    """Without base overrides the repository head scan is the baseline"""
+    assert core.resolve_base_full_scan_id(make_full_scan_params()) == "head"
+
+def test_resolve_base_full_scan_id_uses_base_scan_id(core):
+    """--base-scan-id is used verbatim, without touching the repo endpoint"""
+    core.cli_config = make_cli_config("--base-scan-id", "explicit-base")
+
+    assert core.resolve_base_full_scan_id(make_full_scan_params()) == "explicit-base"
+    core.sdk.repos.repo.assert_not_called()
+
+def test_resolve_base_full_scan_id_uses_base_commit_sha(core):
+    """--base-commit-sha resolves through the full-scans list endpoint"""
+    core.cli_config = make_cli_config("--base-commit-sha", "abc123")
+    core.sdk.fullscans.get.return_value = {
+        "results": [{"id": "merge-base-scan"}],
+        "nextPage": None,
+    }
+
+    params = make_full_scan_params(workspace="customer-a", scan_type="socket_tier1")
+
+    assert core.resolve_base_full_scan_id(params) == "merge-base-scan"
+    core.sdk.repos.repo.assert_not_called()
+    core.sdk.fullscans.get.assert_called_once_with(
+        core.config.org_slug,
+        {
+            "repo": "test",
+            "commit_hash": "abc123",
+            "sort": "created_at",
+            "direction": "desc",
+            "per_page": 1,
+            "workspace": "customer-a",
+            "scan_type": "socket_tier1",
+        },
+    )
+
+def test_resolve_base_full_scan_id_commit_sha_not_found_exits(core):
+    """A --base-commit-sha with no scan is a hard error (exit_code_on_api_error)"""
+    core.cli_config = make_cli_config("--base-commit-sha", "abc123")
+    core.sdk.fullscans.get.return_value = {"results": [], "nextPage": None}
+
+    with pytest.raises(SystemExit) as exc_info:
+        core.resolve_base_full_scan_id(make_full_scan_params())
+    assert exc_info.value.code == core.cli_config.exit_code_on_api_error
+
+def test_resolve_base_full_scan_id_commit_sha_not_found_disable_blocking(core):
+    """--disable-blocking keeps the missing-base error from failing the build"""
+    core.cli_config = make_cli_config("--base-commit-sha", "abc123", "--disable-blocking")
+    core.sdk.fullscans.get.return_value = {"results": [], "nextPage": None}
+
+    with pytest.raises(SystemExit) as exc_info:
+        core.resolve_base_full_scan_id(make_full_scan_params())
+    assert exc_info.value.code == 0
+
 def test_get_full_scan(core, mock_sdk_with_responses, head_scan_metadata, head_scan_stream):
     """Test getting an existing full scan"""
     full_scan = core.get_full_scan("head")
@@ -98,7 +229,7 @@ def test_get_added_and_removed_packages(core):
     # Verify SDK was called correctly.
     # include_license_details defaults to "false": the diff path never consumes
     # embedded license data (license artifacts come from the PURL endpoint), so
-    # requesting it only bloats the response and risks the CE-224 truncation
+    # requesting it only bloats the response and risks the truncation
     # crash on large repos.
     core.sdk.fullscans.stream_diff.assert_called_once_with(
         core.config.org_slug,
diff --git a/tests/unit/test_config.py b/tests/unit/test_config.py
index 717e302..c1443ad 100644
--- a/tests/unit/test_config.py
+++ b/tests/unit/test_config.py
@@ -166,6 +166,57 @@ def test_config_file_json_sets_defaults(self, tmp_path):
         assert config.sarif_reachability == "reachable"
 
 
+class TestBaseScanFlags:
+    """Tests for the --base-scan-id / --base-commit-sha diff baseline overrides."""
+
+    BASE_ARGS = ["--api-token", "test-token", "--repo", "test-repo"]
+
+    def test_defaults_are_none(self):
+        config = CliConfig.from_args(self.BASE_ARGS)
+        assert config.base_scan_id is None
+        assert config.base_commit_sha is None
+
+    def test_base_scan_id_parses(self):
+        config = CliConfig.from_args(self.BASE_ARGS + ["--base-scan-id", "scan-123"])
+        assert config.base_scan_id == "scan-123"
+        assert config.base_commit_sha is None
+
+    def test_base_commit_sha_parses(self):
+        config = CliConfig.from_args(self.BASE_ARGS + ["--base-commit-sha", "abc123def"])
+        assert config.base_commit_sha == "abc123def"
+        assert config.base_scan_id is None
+
+    def test_flags_are_mutually_exclusive(self):
+        """argparse rejects both flags on the command line (exit code 2)."""
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(
+                self.BASE_ARGS + ["--base-scan-id", "scan-123", "--base-commit-sha", "abc123def"]
+            )
+        assert exc_info.value.code == 2
+
+    def test_config_file_values_are_mutually_exclusive(self, tmp_path):
+        """Both values arriving via --config bypass argparse's group; from_args catches it."""
+        config_path = tmp_path / "socketcli.toml"
+        config_path.write_text(
+            "[socketcli]\n"
+            "base_scan_id = \"scan-123\"\n"
+            "base_commit_sha = \"abc123def\"\n",
+            encoding="utf-8",
+        )
+        with pytest.raises(SystemExit) as exc_info:
+            CliConfig.from_args(self.BASE_ARGS + ["--config", str(config_path)])
+        assert exc_info.value.code == 1
+
+    def test_config_file_sets_base_commit_sha(self, tmp_path):
+        config_path = tmp_path / "socketcli.toml"
+        config_path.write_text(
+            "[socketcli]\nbase_commit_sha = \"abc123def\"\n",
+            encoding="utf-8",
+        )
+        config = CliConfig.from_args(self.BASE_ARGS + ["--config", str(config_path)])
+        assert config.base_commit_sha == "abc123def"
+
+
 class TestReachAlignmentFlags:
     """Tests for the reachability flag/default alignment with the Node CLI."""
 
diff --git a/uv.lock b/uv.lock
index 6805666..ba657c2 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.4.20"
+version = "2.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 82810f8b98f7c54b7c756642ffb09271ac822cd6 Mon Sep 17 00:00:00 2001
From: "socket-pr-bot[bot]"
 <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:24:41 +0200
Subject: [PATCH 79/80] Bump pinned @coana-tech/cli to 15.9.0 (#263)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee8851e..f86b223 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.5.1
+
+### Changed: bump pinned @coana-tech/cli to 15.9.0
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.8.8` to
+  `15.9.0`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.5.0
 
 ### Added: `--base-scan-id` / `--base-commit-sha` diff baseline overrides
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index ca7be23..3f8163c 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.8.8 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.9.0 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index 716c413..e26cb16 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.5.0"
+version = "2.5.1"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index f44ed53..07be662 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.5.0'
+__version__ = '2.5.1'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index 6560467..b8a39cb 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.8.8"
+DEFAULT_COANA_CLI_VERSION: Final = "15.9.0"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.8.8').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.9.0').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.8.8').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.9.0').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index ba657c2..f4e703a 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.5.0"
+version = "2.5.1"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },

From 4babcab54cdf40ed8e1df1ad246f9603074652db Mon Sep 17 00:00:00 2001
From: "socket-pr-bot[bot]"
 <294242679+socket-pr-bot[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 15:04:19 +0200
Subject: [PATCH 80/80] Bump pinned @coana-tech/cli to 15.9.1 (#266)

Co-authored-by: socket-pr-bot[bot] <294242679+socket-pr-bot[bot]@users.noreply.github.com>
---
 CHANGELOG.md                              | 8 ++++++++
 docs/cli-reference.md                     | 2 +-
 pyproject.toml                            | 2 +-
 socketsecurity/__init__.py                | 2 +-
 socketsecurity/core/tools/reachability.py | 6 +++---
 uv.lock                                   | 2 +-
 6 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f86b223..8ca5d7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2.5.2
+
+### Changed: bump pinned @coana-tech/cli to 15.9.1
+
+- Bumped the pinned reachability engine (`@coana-tech/cli`) from `15.9.0` to
+  `15.9.1`. See the [Coana changelogs](https://docs.coana.tech/changelogs) for
+  engine changes.
+
 ## 2.5.1
 
 ### Changed: bump pinned @coana-tech/cli to 15.9.0
diff --git a/docs/cli-reference.md b/docs/cli-reference.md
index 3f8163c..51717da 100644
--- a/docs/cli-reference.md
+++ b/docs/cli-reference.md
@@ -275,7 +275,7 @@ If you don't want to provide the Socket API Token every time then you can use th
 | Parameter                        | Required | Default | Description                                                                                                                |
 |:---------------------------------|:---------|:--------|:---------------------------------------------------------------------------------------------------------------------------|
 | `--reach`                          | False    | False   | Enable reachability analysis to identify which vulnerable functions are actually called by your code. Creates a full application reachability scan (`scan_type=socket_tier1`). |
-| `--reach-version`                  | False    | 15.9.0 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
+| `--reach-version`                  | False    | 15.9.1 | Version of @coana-tech/cli to use. Defaults to the pinned version that ships with this CLI release, so the engine only changes when you upgrade the Socket CLI. Pass `latest` to always use the newest published version (opt-in auto-update), or an explicit version (e.g. `1.2.3`) to pin it. |
 | `--reach-analysis-timeout`         | False    | 10m     | Timeout for each reachability analysis run, e.g. `90s`, `10m` or `1h`. Omitted by default, so coana applies its own default (`10m`). Alias: `--reach-timeout` |
 | `--reach-analysis-memory-limit`    | False    | 8GB     | Memory limit for each reachability analysis run, e.g. `512MB` or `8GB`. Omitted by default, so coana applies its own default (`8GB`). Alias: `--reach-memory-limit` |
 | `--reach-concurrency`              | False    | 1       | Control parallel analysis execution (must be >= 1). Omitted by default, so coana applies its own default.                  |
diff --git a/pyproject.toml b/pyproject.toml
index e26cb16..74968e7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.5.1"
+version = "2.5.2"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [
diff --git a/socketsecurity/__init__.py b/socketsecurity/__init__.py
index 07be662..7f72695 100644
--- a/socketsecurity/__init__.py
+++ b/socketsecurity/__init__.py
@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.5.1'
+__version__ = '2.5.2'
 USER_AGENT = f'SocketPythonCLI/{__version__}'
diff --git a/socketsecurity/core/tools/reachability.py b/socketsecurity/core/tools/reachability.py
index b8a39cb..b92df43 100644
--- a/socketsecurity/core/tools/reachability.py
+++ b/socketsecurity/core/tools/reachability.py
@@ -18,7 +18,7 @@
 # Pinned @coana-tech/cli version. Bumped deliberately per Python CLI release so the
 # reachability engine version only changes through a standard pip upgrade (advance notice).
 # Pass --reach-version latest to opt into the newest published version instead.
-DEFAULT_COANA_CLI_VERSION: Final = "15.9.0"
+DEFAULT_COANA_CLI_VERSION: Final = "15.9.1"
 
 # Resolved @coana-tech/cli script paths from the npm-install fallback, keyed by version.
 # Lives for the process lifetime so repeated fallback invocations install only once
@@ -55,7 +55,7 @@ def __init__(self, sdk: socketdev, api_token: str):
     
     def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
         """
-        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.9.0').
+        Resolve the @coana-tech/cli package spec to run (e.g. '@coana-tech/cli@15.9.1').
 
         Args:
             version: Coana CLI version to use.
@@ -64,7 +64,7 @@ def _resolve_coana_package_spec(self, version: Optional[str] = None) -> str:
                 - '<semver>': that exact version.
 
         Returns:
-            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.9.0').
+            str: The package specifier to use with npx (e.g. '@coana-tech/cli@15.9.1').
         """
         return f"@coana-tech/cli@{self._resolve_coana_version(version)}"
 
diff --git a/uv.lock b/uv.lock
index f4e703a..9bb78bd 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1283,7 +1283,7 @@ wheels = [
 
 [[package]]
 name = "socketsecurity"
-version = "2.5.1"
+version = "2.5.2"
 source = { editable = "." }
 dependencies = [
     { name = "brotli", marker = "platform_python_implementation == 'CPython'" },