Core tool version drift detected

[github-actions]

Core tool supply-chain watch

Tool	Pinned	Latest	Drift	Socket (pinned)	Socket (latest)
OpenGrep (SAST engine)	v1.26.0	v1.27.1	⬆️ v1.27.1	✅ clean (600 alerts)	✅ clean (588 alerts)
TruffleHog (secret scanner)	3.96.0	v3.97.0	⬆️ v3.97.0	✅ clean (12 alerts)	✅ clean (19 alerts)
Trivy (Socket trivy-dist)	0.73.0	0.73.0	✅ current	✅ clean (21 alerts)	✅ clean (21 alerts)
Socket SDK (socket-sdk-python)	3.5.0	3.5.0	✅ current	✅ clean (5 alerts)	✅ clean (5 alerts)
Socket Python CLI (socket-python-cli)	2.6.3	2.6.4	⬆️ 2.6.4	✅ clean (6 alerts)	✅ clean (4 alerts)
Socket npm CLI (socket-cli)	1.1.154	1.1.157	⬆️ 1.1.157	✅ clean (3 alerts)	✅ clean (2 alerts)

Notes

• OpenGrep (SAST engine): GitHub-release binary; not Dependabot-trackable and not covered by Socket's pkg:github coordinates. Falls back to the upstream Semgrep lineage (pkg:pypi/semgrep) as a project-health proxy -- this does NOT analyze OpenGrep's own release artifacts, so it is reported, never build-failing.
• Trivy (Socket trivy-dist): Release drift follows the Socket-built ghcr.io/socketdev/trivy package (produced by SocketDev/trivy-dist and mirrored privately to Docker Hub), not Aqua's release feed. Socket scoring uses the corresponding upstream Go module because trivy-dist rebuilds that source without modification.

[github-actions]

Drift re-detected by run #30796427782; body updated.

[github-actions]

Drift re-detected by run #31623205851; body updated.

[github-actions]

Drift re-detected by run #32005675573; body updated.