feat(purl): adopt socketdev typed batch params

[lelia]

What & why

The core-tool-watch scoring call in scripts/check_core_tools.py opted into the batch purl API's fail-closed semantics via stringly-typed query-string kwargs (poll="true", timeoutSec="120", alerts="true") — an undocumented SDK passthrough. socketdev (Python SDK) v3.4.2+ promoted these to first-class typed params, so this migrates to the supported surface.

Changes

• scripts/check_core_tools.py: poll="true" → poll=True, timeoutSec="120" → timeout_sec=120, alerts="true" → alerts=True. Behavior unchanged (still fail-closed).
• pyproject.toml: socketdev>=3.3.0 → socketdev>=3.5.0. Typed params landed in 3.4.2 (on 3.3.0, timeout_sec would be sent as a literal timeout_sec query param, silently losing the timeoutSec fail-closed bound); 3.5.0 additionally bounds the SDK's runtime dependency ranges and hardens PyPI install verification.
• uv.lock: regenerated — socketdev 3.3.0 → 3.5.0.

Validation (against the published 3.5.0 wheel)

• Full test suite: 216 passed via the CI install path (uv sync --locked --extra dev).
• Wire-level check of analyze_purls through the real SDK transport: the call produces POST orgs/<slug>/purl?license=false&poll=true&timeoutSec=120&alerts=true with the expected components body — typed params map to the exact query params the server expects.
• Synthetic notFound rows survive the SDK's dedupe hardening and map to status=not_found (fail-closed semantics intact).
• check_core_tools.py --mode watch end-to-end run against live GitHub APIs works.

Note: core-tool-watch's scan env installs from main's uv.lock, so the typed params take effect there once this merges.

Refs CE-360

---

Note

Medium Risk
Touches supply-chain guard scoring for pinned core tools; risk is mitigated by intentional behavior parity and a dependency bump with a documented wire-level mapping requirement.

Overview
Core-tool-watch now uses the socketdev SDK’s first-class batch PURL parameters instead of undocumented string query passthroughs. In analyze_purls, poll="true", timeoutSec="120", and alerts="true" become poll=True, timeout_sec=120, and alerts=True — same fail-closed batch semantics (bounded poll, synthetic pendingScan/notFound rows).

The socketdev floor moves from >=3.3.0 to >=3.5.0 in pyproject.toml so typed params (from 3.4.2+) map correctly to API query names like timeoutSec; uv.lock is updated to 3.5.0.

^{Reviewed by Cursor Bugbot for commit 2820504. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.3.0 ⏵ 3.5.0	+1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.3.0 ⏵ 3.5.0	+1

View full report

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2820504. Configure here.}

[lelia]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2820504. Configure here.}