Core tool version drift detected

[github-actions]

Core tool supply-chain watch

Tool	Pinned	Latest	Drift	Socket (pinned)	Socket (latest)
OpenGrep (SAST engine)	v1.26.0	v1.27.0	⬆️ v1.27.0	⏳ analysis pending upstream	⏳ analysis pending upstream
TruffleHog (secret scanner)	3.96.0	v3.96.0	✅ current	⏳ analysis pending upstream	⏳ analysis pending upstream
Trivy (Socket trivy-dist)	0.73.0	0.73.0	✅ current	⏳ analysis pending upstream	⏳ analysis pending upstream
Socket SDK (socket-sdk-python)	3.5.0	3.5.0	✅ current	⏳ analysis pending upstream	⏳ analysis pending upstream
Socket Python CLI (socket-python-cli)	2.6.3	2.6.3	✅ current	⏳ analysis pending upstream	⏳ analysis pending upstream
Socket npm CLI (socket-cli)	1.1.154	1.1.157	⬆️ 1.1.157	⏳ analysis pending upstream	⏳ analysis pending upstream

Notes

• OpenGrep (SAST engine): GitHub-release binary; not Dependabot-trackable and not covered by Socket's pkg:github coordinates. Falls back to the upstream Semgrep lineage (pkg:pypi/semgrep) as a project-health proxy -- this does NOT analyze OpenGrep's own release artifacts, so it is reported, never build-failing.
• Trivy (Socket trivy-dist): Release drift follows the Socket-built ghcr.io/socketdev/trivy package (produced by SocketDev/trivy-dist and mirrored privately to Docker Hub), not Aqua's release feed. Socket scoring uses the corresponding upstream Go module because trivy-dist rebuilds that source without modification.

[github-actions]

Drift re-detected by run #30796427782; body updated.

[github-actions]

Drift re-detected by run #31623205851; body updated.