chore(release): 3.2.0

[lelia]

Summary

Release prep for 3.2.0, bundling #110, #111 and #112. Version files, uv.lock
and every current-release reference in README.md and docs/** are bumped, and
the [Unreleased] changelog section is stamped as [3.2.0] - 2026-09-10.

The changelog section was also condensed and reorganized. Four of the changes in
this release alter which findings a scan produces, and the per-PR entries buried
that among documentation and tooling notes, so the version section now opens with
an Upgrade notes block carrying the behavioral changes in full, while the
Added/Changed/Removed/Fixed entries stay short.

Changes

• pyproject.toml, socket_basics/version.py, socket_basics/__init__.py,
  action.yml, uv.lock → 3.2.0
• 83 current-release references synchronized across README.md and docs/**
• CHANGELOG.md: [Unreleased] → [3.2.0] - 2026-09-10, restructured with an
  Upgrade notes section

Two facts that were missing from the changelog

Both are consequences of #110 that its changelog entry did not state, but its
commit message did. They are now in Upgrade notes:

• With trufflehog_show_unverified off — the default — the old code passed
  --no-verification, so every finding came back Verified: false → low
  severity → non-blocking, and no secret could ever block a run. Verified
  secrets are now critical and blocking, so pipelines that gate on severity will
  start failing on real leaked credentials.
• Verification is a live check, so TruffleHog now sends candidate credentials to
  third-party validation endpoints on every scan. New behavior for anyone running
  with the setting off; relevant to egress-restricted runners.

The other two behavioral items were already in the changelog and are now stated
as upgrade consequences rather than bug-fix lines: TruffleHog failing the run
instead of returning an empty clean result, and the Java SAST rule rewrite, after
which existing Java baselines will lose most of their findings and gain new ones
at call sites the old patterns could never match.

Java finding-volume figure

The per-PR entry quoted "about 95% fewer findings," which is the -94.6%
unique-findings-on-mature-libraries-only row of
docs/java-sast-benchmark.md. This now quotes that table's own headline
-92% (total findings, 1,631 → 126) along with the caveat the doc attaches to
it: roughly a quarter of the drop comes from new test, benchmark and example
path exclusions rather than rule logic.

Heavy image Python CLI bump

Already done — SOCKET_PYTHON_CLI_VERSION=2.8.0 in both Dockerfile.heavy and
app_tests/Dockerfile, landed in #112 (c296024). No change needed here; the
changelog entry for it is retained.

Testing

• scripts/sync_release_version.py --check → in sync at 3.2.0
• scripts/check_release_docs.py --check → in sync, release 3.2.0, tool pins
  {trufflehog: 3.96.0, opengrep: 1.26.0, trivy: 0.73.0}
• uv sync --locked --extra dev → lockfile consistent with the bumped project
• uv run --no-sync pytest -q tests/ → 383 passed
• Docs diffs verified to contain version-string changes only
• Full PR check suite green, Cursor Bugbot clean

---

Release checklist

• python3 scripts/prep_release.py --version 3.2.0 completed successfully
• Release metadata and uv.lock are synchronized
• Current-release references in README and docs are synchronized
• CHANGELOG.md contains reviewed, human-authored notes for this version
• Release PR will be merged before its merge commit is tagged

After merge: tag the merge commit v3.2.0 to trigger publish. action.yml
already points at ghcr.io/socketdev/socket-basics:3.2.0, which does not exist
until that tag builds.

🤖 Generated with Claude Code

---

Note

Low Risk
This PR only bumps versions, retargets the action image tag, and restructures release notes; scanner behavior changes are documented but not introduced in this diff.

Overview
Release 3.2.0 prep: bumps package metadata (pyproject.toml, socket_basics/version.py, uv.lock), sets the GitHub Action Docker image to ghcr.io/socketdev/socket-basics:3.2.0, and replaces 83 3.1.0 references in README.md and docs/** with 3.2.0.

The main editorial change is CHANGELOG.md: the former [Unreleased] notes are published as [3.2.0] - 2026-09-10, with a new Upgrade notes section up front that spells out scanner behavior shifts (TruffleHog verification/blocking/egress/fail-closed; Java SAST baseline churn), while Added/Changed/Fixed entries are shortened and tagged with #110–#112. The Java volume figure is corrected to -92% with the benchmark caveat.

No application logic changes in this diff—consumers get the accuracy fixes from the already-merged PRs when they adopt this tag; the image tag in action.yml only exists after the post-merge v3.2.0 publish.

^{Reviewed by Cursor Bugbot for commit 531e551. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 531e551. Configure here.}