diff --git a/CHANGELOG.md b/CHANGELOG.md
index a671653..1820ee0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.4.1] - 2026-10-21
+
+### Changed
+- Socket Python CLI 2.9.0 -> 2.11.3 in the heavy and app-tests images. 2.11.3
+  carries the same eMudhra CA fix for its own image and requires
+  `certifi>=2026.10.19` (SocketDev/socket-python-cli#415, #418).
+- Socket Python SDK 3.6.0 -> 3.6.1, which requires `certifi>=2026.10.19`.
+- Trivy 0.73.0 -> 0.76.1, upstream's release for the eMudhra compromise. It is
+  built on Go 1.27.3, which blocks the compromised intermediates in Go itself
+  and clears container scanner findings against Trivy's Go version.
+
 ### Fixed
 
 - **The images no longer trust certificates from the compromised eMudhra
@@ -16,8 +27,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   2026.10.19 or newer, and source installs (`pip install -e .`) require the same
   `certifi`. curl, git, Python `requests`, pip, Node, and the bundled Trivy and
   TruffleHog now reject those chains. Container scanners may still report
-  CVE-2026-111943 against the Trivy and TruffleHog binaries until they are
-  rebuilt on Go 1.26.10 or 1.27.3.
+  CVE-2026-111943 against the TruffleHog binary until it is rebuilt on Go
+  1.26.10 or 1.27.3.
 
 ## [3.4.0] - 2026-09-18
 
diff --git a/Dockerfile b/Dockerfile
index 19d2eb6..1ea1a4d 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,10 +15,11 @@ ARG SOCKET_NPM_CLI_VERSION=1.1.165
 # source and published by Socket's own release pipeline. Pinned by digest; both
 # ARGs are updated together by that release process, never bumped independently.
 # Building requires pull access to the registry; contributors without it can
-# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.73.0 .
+# override, e.g.: docker build --build-arg TRIVY_IMAGE=aquasec/trivy:0.76.1 .
 # TRIVY_VERSION feeds the image label — keep it in sync with the TRIVY_IMAGE tag.
-ARG TRIVY_VERSION=0.73.0
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+# -socket.N is a trivy-dist toolchain rebuild: same upstream source, newer Go.
+ARG TRIVY_VERSION=0.76.1
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
diff --git a/Dockerfile.heavy b/Dockerfile.heavy
index 64a839c..e09b868 100644
--- a/Dockerfile.heavy
+++ b/Dockerfile.heavy
@@ -4,9 +4,9 @@ ARG TRUFFLEHOG_VERSION=3.96.0
 ARG UV_VERSION=0.12.1
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 # Socket-built Trivy, pinned by digest — see the note in ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 FROM ${TRIVY_IMAGE} AS trivy
 FROM trufflesecurity/trufflehog:${TRUFFLEHOG_VERSION} AS trufflehog
diff --git a/README.md b/README.md
index b87bc58..a182bd8 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.4.0
+        uses: SocketDev/socket-basics@<sha>  # v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
diff --git a/action.yml b/action.yml
index 0c69b8b..e9e8319 100644
--- a/action.yml
+++ b/action.yml
@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.4.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.4.1"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}
diff --git a/app_tests/Dockerfile b/app_tests/Dockerfile
index 46d1104..1584c19 100644
--- a/app_tests/Dockerfile
+++ b/app_tests/Dockerfile
@@ -13,11 +13,11 @@ ARG UV_VERSION=0.12.1
 ARG GOSEC_VERSION=v2.28.0
 ARG OPENGREP_VERSION=v1.26.0
 ARG SOCKET_NPM_CLI_VERSION=1.1.165
-ARG SOCKET_PYTHON_CLI_VERSION=2.9.0
+ARG SOCKET_PYTHON_CLI_VERSION=2.11.3
 #
 # NOT Dependabot-trackable — Socket-built Trivy, pinned by digest; updated by
 # Socket's trivy-dist release process. See the note in the root ./Dockerfile.
-ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.73.0@sha256:e3d9d5f10250cb73b0ea9446ae1191c0f2da2f5e6173eac08a840b1812f02e0b
+ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:0.76.1@sha256:883da3593a60e311b2ed87c3a55241051b27bba15ffc3ce041ae570cd0f00915
 
 # ─── Stage: trivy (Socket-built redistribution) ───────────────────────────────
 FROM ${TRIVY_IMAGE} AS trivy
@@ -89,7 +89,13 @@ ARG SOCKET_NPM_CLI_VERSION
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
-      curl git wget ca-certificates libatomic1
+      curl git wget ca-certificates libatomic1 \
+    && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge 20250419+deb13u1
+# pip checks certificates against its own vendored CA bundle, not the system
+# store, and the base image's pip trusts the compromised intermediates. 26.2.2
+# vendors certifi 2026.10.19. Upgrade it against the system store fixed above.
+RUN python -m pip install --no-cache-dir --cert /etc/ssl/certs/ca-certificates.crt --upgrade "pip>=26.2.2" \
+    && python -c 'import sys, pip; sys.exit(tuple(map(int, pip.__version__.split(".")[:3])) < (26, 2, 2))'
 RUN --mount=type=cache,target=/root/.npm \
     npm install -g eslint eslint-plugin-security \
       @typescript-eslint/parser @typescript-eslint/eslint-plugin \
diff --git a/docs/github-action.md b/docs/github-action.md
index b8513a9..cfedadd 100644
--- a/docs/github-action.md
+++ b/docs/github-action.md
@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -59,7 +59,7 @@ Without dashboard configuration, every scanner input defaults to off, so turn on
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.4.0`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.4.1`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -77,7 +77,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.0`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.1`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -87,7 +87,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -103,7 +103,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.4.0`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.4.1`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -128,14 +128,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.4.0
+  uses: SocketDev/socket-basics@<sha>  # v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.0
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.1
 ```
 
 ---
@@ -147,7 +147,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -168,7 +168,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.4.0` comment in sync. You review, approve, and merge
+and keeping the `# v3.4.1` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -178,7 +178,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.4.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.4.1` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -219,7 +219,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -233,7 +233,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -253,7 +253,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -280,7 +280,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -289,7 +289,7 @@ path that does not exist is skipped with a `Dockerfile not found` warning.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -327,7 +327,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -456,7 +456,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -469,7 +469,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.4.0
+> - uses: SocketDev/socket-basics@v3.4.1
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -540,7 +540,7 @@ directly as a step:
   run: docker build -t myapp:${{ github.sha }} .
 
 - name: Run Socket Basics
-  uses: docker://ghcr.io/socketdev/socket-basics:3.4.0
+  uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
   env:
     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -559,7 +559,7 @@ the dashboard. Running the image directly differs from the action in two ways:
   for some languages.
 - The step isn't tied to an action version, so update the image tag yourself
   when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
-  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.0`
+  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
   prints the digest.
 
 See the [Parameters Reference](parameters.md) for every CLI flag.
@@ -570,7 +570,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -582,7 +582,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -597,7 +597,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -609,7 +609,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -621,7 +621,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -657,7 +657,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -699,7 +699,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -765,7 +765,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -790,7 +790,7 @@ For repositories with multiple Dockerfiles across different directories, you can
 >
 > ```yaml
 > - name: Run Socket Basics
->   uses: docker://ghcr.io/socketdev/socket-basics:3.4.0
+>   uses: docker://ghcr.io/socketdev/socket-basics:3.4.1
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -847,7 +847,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -905,7 +905,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.4.0
+        uses: SocketDev/socket-basics@v3.4.1
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -1070,7 +1070,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.4.0
+  - uses: SocketDev/socket-basics@v3.4.1
 ```
 
 ### PR Comments Not Appearing
diff --git a/docs/github-pr-comment-guide.md b/docs/github-pr-comment-guide.md
index 914bb7b..ca8d21b 100644
--- a/docs/github-pr-comment-guide.md
+++ b/docs/github-pr-comment-guide.md
@@ -315,7 +315,7 @@ PR. This is for teams who want to review finding quality in the Socket dashboard
 first, without every PR growing a comment that developers have to scroll past.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/docs/local-install-docker.md b/docs/local-install-docker.md
index 570aa1f..c928b5f 100644
--- a/docs/local-install-docker.md
+++ b/docs/local-install-docker.md
@@ -16,7 +16,7 @@ Run Socket Basics locally using Docker without installing security tools on your
 
 ```bash
 # 1. Pull a pinned release from GHCR (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # 2. Create .env file with your credentials (the API key is environment-only;
 #    the organization can also be passed per run with --socket-org)
@@ -29,14 +29,14 @@ EOF
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
   --console-tabular-enabled
 ```
 
-The Docker image should always be pinned to an exact version such as `3.4.0`. Avoid
+The Docker image should always be pinned to an exact version such as `3.4.1`. Avoid
 floating tags like `:latest` in CI/CD.
 
 ## Using Pre-built Images
@@ -46,13 +46,13 @@ The baked-in security tool versions are recorded in the image labels so you can
 inspect exactly what's inside:
 
 ```bash
-docker inspect ghcr.io/socketdev/socket-basics:3.4.0 \
+docker inspect ghcr.io/socketdev/socket-basics:3.4.1 \
   | jq '.[0].Config.Labels'
 # {
-#   "com.socket.trivy-version": "0.73.0",
+#   "com.socket.trivy-version": "0.76.1",
 #   "com.socket.trufflehog-version": "3.96.0",
 #   "com.socket.opengrep-version": "v1.26.0",
-#   "org.opencontainers.image.version": "3.4.0",
+#   "org.opencontainers.image.version": "3.4.1",
 #   ...
 # }
 ```
@@ -90,8 +90,8 @@ tool: `socketcli` runs the Python CLI; `socket-basics`, or any other argument,
 runs Socket Basics:
 
 ```bash
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0-heavy socketcli --help
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0-heavy --workspace /workspace --python
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy socketcli --help
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1-heavy --workspace /workspace --python
 ```
 
 `latest` and `latest-heavy` are floating aliases published for onboarding
@@ -109,7 +109,7 @@ comments and labels. If you must run the image directly, pin the exact version:
       -v "$GITHUB_WORKSPACE:/workspace" \
       -e SOCKET_SECURITY_API_KEY=${{ secrets.SOCKET_SECURITY_API_KEY }} \
       -e SOCKET_ORG=${{ secrets.SOCKET_ORG }} \
-      ghcr.io/socketdev/socket-basics:3.4.0 \
+      ghcr.io/socketdev/socket-basics:3.4.1 \
       --workspace /workspace \
       --python \
       --javascript \
@@ -122,7 +122,7 @@ comments and labels. If you must run the image directly, pin the exact version:
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.0
+    name: ghcr.io/socketdev/socket-basics:3.4.1
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -141,7 +141,7 @@ security-scan:
 
 ```dockerfile
 # Pin socket-basics and let Dependabot send upgrade PRs automatically
-FROM ghcr.io/socketdev/socket-basics:3.4.0
+FROM ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 ### Staying Up to Date with Dependabot
@@ -159,7 +159,7 @@ updates:
       interval: "weekly"
 ```
 
-Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.4.0` reference
+Dependabot will detect the `FROM ghcr.io/socketdev/socket-basics:3.4.1` reference
 and open a PR with the version bump when a new release is available.
 
 ## Building the Docker Image
@@ -170,10 +170,10 @@ Pull a specific release without building locally:
 
 ```bash
 # GHCR (preferred)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 
 # Docker Hub
-docker pull socketdev/socket-basics:3.4.0
+docker pull socketdev/socket-basics:3.4.1
 ```
 
 ### Build from Source
@@ -186,7 +186,7 @@ git clone https://github.com/SocketDev/socket-basics.git
 cd socket-basics
 
 # Build with version tag (multi-stage; first build is slower, subsequent ones are fast)
-docker build -t socket-basics:3.4.0 .
+docker build -t socket-basics:3.4.1 .
 
 # Verify the build
 docker images | grep socket-basics
@@ -195,7 +195,7 @@ docker images | grep socket-basics
 ### Build for a Specific Platform (M1/M2 Macs)
 
 ```bash
-docker build --platform linux/amd64 -t socket-basics:3.4.0 .
+docker build --platform linux/amd64 -t socket-basics:3.4.1 .
 ```
 
 ### Build with Custom Tool Versions
@@ -206,7 +206,7 @@ The image pins the bundled tools to specific versions. You can override them at
 docker build \
   --build-arg TRUFFLEHOG_VERSION=3.96.0 \
   --build-arg OPENGREP_VERSION=v1.26.0 \
-  -t socket-basics:3.4.0 .
+  -t socket-basics:3.4.1 .
 ```
 
 Trivy comes from a Socket-built image pinned by digest via the `TRIVY_IMAGE`
@@ -219,13 +219,13 @@ tests image, build from the `app_tests` directory and use the same build args.
 
 ```bash
 # The image's entrypoint is `socket-basics`, so its own flags need no prefix
-docker run --rm socket-basics:3.4.0 --version
+docker run --rm socket-basics:3.4.1 --version
 
 # Other bundled tools need --entrypoint
-docker run --rm --entrypoint socket     socket-basics:3.4.0 --version
-docker run --rm --entrypoint opengrep   socket-basics:3.4.0 --version
-docker run --rm --entrypoint trufflehog socket-basics:3.4.0 --version
-docker run --rm --entrypoint trivy      socket-basics:3.4.0 --version
+docker run --rm --entrypoint socket     socket-basics:3.4.1 --version
+docker run --rm --entrypoint opengrep   socket-basics:3.4.1 --version
+docker run --rm --entrypoint trufflehog socket-basics:3.4.1 --version
+docker run --rm --entrypoint trivy      socket-basics:3.4.1 --version
 ```
 
 ### Smoke Test
@@ -260,7 +260,7 @@ Mount your project directory into the container:
 # Scan current directory
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -277,7 +277,7 @@ docker run --rm \
 # Scan a specific project directory
 docker run --rm \
   -v "/path/to/your/project:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --javascript \
   --secrets
@@ -288,7 +288,7 @@ docker run --rm \
 ```bash
 docker run --rm \
   -v "$PWD:/workspace" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --all-languages \
   --secrets \
@@ -341,7 +341,7 @@ INPUT_VERBOSE=false
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets
@@ -356,7 +356,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=scrt_your_api_key" \
   -e "SOCKET_ORG=your-org-slug" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -378,7 +378,7 @@ docker run --rm \
   --env-file .env.socket \
   --env-file .env.notifiers \
   --env-file .env.scanning \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --all-languages
 ```
@@ -397,7 +397,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -e "SOCKET_SECURITY_API_KEY=$SOCKET_SECURITY_API_KEY" \
   -e "SOCKET_ORG=$SOCKET_ORG" \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python
 ```
@@ -424,7 +424,7 @@ docker run --rm \
   -e GITHUB_TOKEN \
   -e GITHUB_REPOSITORY=owner/repo \
   -e GITHUB_PR_NUMBER=123 \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python --javascript --secrets
 ```
@@ -463,7 +463,7 @@ mkdir -p ./scan-results
 docker run --rm \
   -v "$PWD:/workspace" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --secrets \
@@ -488,7 +488,7 @@ docker run --rm -it \
   -v "$PWD:/workspace" \
   --env-file .env \
   --entrypoint /bin/bash \
-  socket-basics:3.4.0
+  socket-basics:3.4.1
 
 # Inside container, run commands manually:
 # cd /workspace
@@ -517,7 +517,7 @@ docker run --rm \
   -v "$PWD:/workspace" \
   -v "$PWD/socket-config.json:/config.json" \
   --env-file .env \
-  socket-basics:3.4.0 \
+  socket-basics:3.4.1 \
   --workspace /workspace \
   --config /config.json
 ```
@@ -541,7 +541,7 @@ for PROJECT in "${PROJECTS[@]}"; do
   docker run --rm \
     -v "$PROJECT:/workspace" \
     --env-file .env \
-    socket-basics:3.4.0 \
+    socket-basics:3.4.1 \
     --workspace /workspace \
     --all-languages \
     --secrets \
@@ -584,7 +584,7 @@ pipeline {
                 script {
                     // --entrypoint='' is required: Jenkins runs `cat` to keep the
                     // container alive, and the image's entrypoint is socket-basics.
-                    docker.image('ghcr.io/socketdev/socket-basics:3.4.0').inside(
+                    docker.image('ghcr.io/socketdev/socket-basics:3.4.1').inside(
                         "--entrypoint='' -v ${WORKSPACE}:/workspace --env-file .env"
                     ) {
                         sh '''
@@ -607,7 +607,7 @@ pipeline {
 ```yaml
 security-scan:
   image:
-    name: ghcr.io/socketdev/socket-basics:3.4.0
+    name: ghcr.io/socketdev/socket-basics:3.4.1
     entrypoint: [""]   # GitLab needs a shell; the image's entrypoint is socket-basics
   stage: test
   script:
@@ -650,7 +650,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$(pwd):/workspace" \  # Use $(pwd) instead of $PWD
-     socket-basics:3.4.0
+     socket-basics:3.4.1
    ```
 
 2. Verify mount (the entrypoint is `socket-basics`, so override it to run `ls`):
@@ -658,7 +658,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --entrypoint ls \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      -la /workspace
    ```
 
@@ -688,7 +688,7 @@ security-scan:
    docker run --rm \
      -v "$PWD:/workspace" \
      --env-file "$(pwd)/.env" \
-     socket-basics:3.4.0
+     socket-basics:3.4.1
    ```
 
 ### Container Image Too Large
@@ -719,7 +719,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --python \
      --secrets \
@@ -740,7 +740,7 @@ security-scan:
    ```bash
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --output /workspace/results.json  # Save to mounted directory
    ```
@@ -751,7 +751,7 @@ security-scan:
    mkdir -p ./scan-results
    docker run --rm \
      -v "$PWD:/workspace" \
-     socket-basics:3.4.0 \
+     socket-basics:3.4.1 \
      --workspace /workspace \
      --output /workspace/scan-results/scan.json
    ```
@@ -784,7 +784,7 @@ Add these to your `~/.bashrc` or `~/.zshrc` for quick access:
 
 ```bash
 # Socket Basics Docker aliases
-alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.4.0 --workspace /workspace'
+alias sb-docker='docker run --rm -v "$PWD:/workspace" --env-file .env ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace'
 alias sb-quick='sb-docker --secrets --console-tabular-enabled'
 alias sb-python='sb-docker --python --secrets --console-tabular-enabled'
 alias sb-js='sb-docker --javascript --secrets --console-tabular-enabled'
@@ -810,7 +810,7 @@ sb-all
 
 1. **Use pre-built images** — Pull `ghcr.io/socketdev/socket-basics:<version>` instead of building locally
 2. **Use the standard image** — `-heavy` exists for one deployment constraint (see [Image Variants](#image-variants)); it adds nothing to Socket Basics
-3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.4.0` and upgrade deliberately
+3. **Pin to a specific version** — Avoid `:latest` in production CI; pin to `3.4.1` and upgrade deliberately
 4. **Use Dependabot** — Reference the image in your Dockerfile/Compose to get automatic upgrade PRs
 5. **Inspect baked-in labels** — Run `docker inspect <image> | jq '.[0].Config.Labels'` to verify tool versions
 6. **Use .env files** — Keep credentials out of command history
@@ -830,7 +830,7 @@ set -e
 # Configuration
 PROJECT_DIR="$(pwd)"
 RESULTS_DIR="scan-results"   # relative to the project: it must stay inside the workspace
-IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.4.0"
+IMAGE_NAME="ghcr.io/socketdev/socket-basics:3.4.1"
 ENV_FILE=".env"
 
 # Create results directory (add it to .gitignore)
diff --git a/docs/local-installation.md b/docs/local-installation.md
index 7534d4e..03f2bb6 100644
--- a/docs/local-installation.md
+++ b/docs/local-installation.md
@@ -232,7 +232,7 @@ EOF
 sudo yum -y install trivy
 
 # Using Docker (alternative; always pin an explicit version, ideally by digest):
-docker pull aquasec/trivy:0.73.0
+docker pull aquasec/trivy:0.76.1
 
 # Verify installation
 trivy --version
diff --git a/docs/parameters.md b/docs/parameters.md
index 01106ed..eb6bade 100644
--- a/docs/parameters.md
+++ b/docs/parameters.md
@@ -310,7 +310,7 @@ workflow and pass it in yourself:
   run: echo "ref=$(gh pr view ${{ github.event.issue.number }} --json baseRefName -q .baseRefName)" >> "$GITHUB_OUTPUT"
   env:
     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-- uses: SocketDev/socket-basics@v3.4.0
+- uses: SocketDev/socket-basics@v3.4.1
   env:
     GITHUB_BASE_REF: ${{ steps.prbase.outputs.ref }}
   with:
diff --git a/docs/pre-commit-hook.md b/docs/pre-commit-hook.md
index 496ffbe..c160969 100644
--- a/docs/pre-commit-hook.md
+++ b/docs/pre-commit-hook.md
@@ -41,7 +41,7 @@ Best for: Teams wanting consistent environments without installing security tool
 
 ```bash
 # Pull the pre-built image (no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.4.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.1
 ```
 
 **2. Create pre-commit hook:**
@@ -64,7 +64,7 @@ fi
 # Run Socket Basics in Docker
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -118,7 +118,7 @@ fi
 # Scope the scan to the staged changes
 docker run --rm \
   -v "$PWD:/workspace" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --changed-files auto \
   --python \
@@ -153,7 +153,7 @@ docker run --rm \
   -e SOCKET_ORG="$SOCKET_ORG" \
   -e SOCKET_SECURITY_API_KEY="$SOCKET_SECURITY_API_KEY" \
   -e SLACK_WEBHOOK_URL="$SLACK_WEBHOOK_URL" \
-  ghcr.io/socketdev/socket-basics:3.4.0 \
+  ghcr.io/socketdev/socket-basics:3.4.1 \
   --workspace /workspace \
   --python \
   --javascript \
@@ -504,7 +504,7 @@ repos:
     hooks:
       - id: socket-basics
         name: Socket Basics Security Scan
-        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 --workspace /workspace --changed-files auto --python --secrets
+        entry: docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.1 --workspace /workspace --changed-files auto --python --secrets
         language: system
         pass_filenames: false
 ```
diff --git a/pyproject.toml b/pyproject.toml
index 45e63a0..b763318 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "socket_basics"
-version = "3.4.0"
+version = "3.4.1"
 description = "Socket Basics with integrated SAST, secret scanning, and container analysis"
 readme = "README.md"
 requires-python = ">=3.10"
diff --git a/scripts/check_core_tools.py b/scripts/check_core_tools.py
index 23e7aeb..74ccf5e 100644
--- a/scripts/check_core_tools.py
+++ b/scripts/check_core_tools.py
@@ -205,9 +205,10 @@ def _ghcr_latest(org: str, package: str) -> Optional[str]:
         ]
         stable_versions = []
         for tag in tags:
-            match = re.fullmatch(r"v?(\d+)\.(\d+)\.(\d+)", tag)
+            # X.Y.Z-socket.N is a trivy-dist toolchain rebuild of X.Y.Z and ranks above it.
+            match = re.fullmatch(r"v?(\d+)\.(\d+)\.(\d+)(?:-socket\.(\d+))?", tag)
             if match:
-                stable_versions.append((tuple(map(int, match.groups())), tag))
+                stable_versions.append((tuple(int(g or 0) for g in match.groups()), tag))
         return max(stable_versions)[1] if stable_versions else None
     except Exception as exc:  # noqa: BLE001
         print(f"  ! GHCR latest-version lookup failed for {org}/{package}: {exc}", file=sys.stderr)
@@ -287,6 +288,11 @@ def _ensure_v(v: str) -> str:
     return v if v.startswith("v") else f"v{v}"
 
 
+def _strip_socket_rebuild(v: str) -> str:
+    """Drop a trivy-dist -socket.N suffix; the upstream module has no such version."""
+    return re.sub(r"-socket\.\d+$", "", v)
+
+
 # ── tool registry ─────────────────────────────────────────────────────────────
 
 
@@ -327,7 +333,7 @@ def build_tools() -> list[Tool]:
             # The Socket distribution is rebuilt from unmodified upstream
             # source. Score that Go module while release discovery follows the
             # Socket-controlled artifact that Basics actually consumes.
-            purl=lambda v: f"pkg:golang/github.com/aquasecurity/trivy@{_ensure_v(v)}",
+            purl=lambda v: f"pkg:golang/github.com/aquasecurity/trivy@{_ensure_v(_strip_socket_rebuild(v))}",
             note="Release drift follows the Socket-built ghcr.io/socketdev/trivy package "
             "(produced by SocketDev/trivy-dist and mirrored privately to Docker Hub), not "
             "Aqua's release feed. Socket scoring uses the corresponding upstream Go module "
diff --git a/socket_basics/__init__.py b/socket_basics/__init__.py
index aa00ec2..397e0bf 100644
--- a/socket_basics/__init__.py
+++ b/socket_basics/__init__.py
@@ -12,7 +12,7 @@
 from .socket_basics import SecurityScanner, main
 from .core.config import load_config_from_env, Config
 
-__version__ = "3.4.0"
+__version__ = "3.4.1"
 __author__ = "Socket.dev"
 __email__ = "support@socket.dev"
 
diff --git a/socket_basics/version.py b/socket_basics/version.py
index 903a158..a5cfdf5 100644
--- a/socket_basics/version.py
+++ b/socket_basics/version.py
@@ -1 +1 @@
-__version__ = "3.4.0"
+__version__ = "3.4.1"
diff --git a/tests/test_check_core_tools.py b/tests/test_check_core_tools.py
index 1cfada5..51c4edf 100644
--- a/tests/test_check_core_tools.py
+++ b/tests/test_check_core_tools.py
@@ -33,6 +33,29 @@ def test_ghcr_latest_ignores_floating_and_prerelease_tags(monkeypatch):
     assert check_core_tools._ghcr_latest("SocketDev", "trivy") == "0.73.0"
 
 
+def test_ghcr_latest_ranks_socket_rebuilds_above_their_base(monkeypatch):
+    monkeypatch.setenv("GITHUB_TOKEN", "test-token")
+    monkeypatch.setattr(
+        check_core_tools,
+        "_get_json",
+        lambda *_args: [
+            {"metadata": {"container": {"tags": ["0.73.0-socket.2"]}}},
+            {"metadata": {"container": {"tags": ["latest", "0.73.0-socket.10"]}}},
+            {"metadata": {"container": {"tags": ["0.73.0"]}}},
+            {"metadata": {"container": {"tags": ["v0.74.0-rc.1"]}}},
+        ],
+    )
+
+    assert check_core_tools._ghcr_latest("SocketDev", "trivy") == "0.73.0-socket.10"
+
+
+def test_trivy_purl_uses_the_upstream_version_for_socket_rebuilds():
+    trivy = next(tool for tool in check_core_tools.build_tools() if tool.key == "trivy")
+
+    assert trivy.purl("0.73.0-socket.1") == "pkg:golang/github.com/aquasecurity/trivy@v0.73.0"
+    assert trivy.purl("0.73.0") == "pkg:golang/github.com/aquasecurity/trivy@v0.73.0"
+
+
 def test_every_socket_tool_is_named_and_pinned_unambiguously():
     tools = {tool.key: tool for tool in check_core_tools.build_tools()}
 
@@ -67,7 +90,7 @@ def test_socket_cli_installs_are_version_pinned():
 def test_trivy_pin_comes_from_socket_image_tag():
     tools = {tool.key: tool for tool in check_core_tools.build_tools()}
 
-    assert tools["trivy"].read_pinned() == ["0.73.0"]
+    assert tools["trivy"].read_pinned() == ["0.76.1"]
     assert all(
         "ARG TRIVY_IMAGE=ghcr.io/socketdev/trivy:" in dockerfile.read_text()
         for dockerfile in check_core_tools.DOCKERFILES
diff --git a/uv.lock b/uv.lock
index a9b5905..234c0ad 100644
--- a/uv.lock
+++ b/uv.lock
@@ -692,7 +692,7 @@ wheels = [
 
 [[package]]
 name = "socket-basics"
-version = "3.4.0"
+version = "3.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "certifi" },
@@ -735,15 +735,16 @@ dev = []
 
 [[package]]
 name = "socketdev"
-version = "3.6.0"
+version = "3.6.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "certifi" },
     { name = "requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4f/64/7c44c1b1f739db9c40ea0a3d429d27b1810f43153b0680ec4bfc3aada644/socketdev-3.6.0.tar.gz", hash = "sha256:8453da37520db79735479e0892b74cef8ce5bcba52c99f15ffacc6a70f9ea355", size = 201023, upload-time = "2026-09-09T22:44:01.761Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c2/de/c62e2e76ae5f7f55901d1d1cefc5b141309342fd1ae19d44f350fd264efc/socketdev-3.6.1.tar.gz", hash = "sha256:4086d6842a51dd4fd91ecf6aa3f1e24e7c7200f110e50c866784bc09e1fc9986", size = 176415, upload-time = "2026-10-21T21:30:12.548Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fb/c3/e4ac2746b803109eab1fa7b44b02697f365fb418340411df5091e50d4a07/socketdev-3.6.0-py3-none-any.whl", hash = "sha256:fe017aefa72638375bb0fb1697bf5704f64143a5fab634534dfc3e77c851b374", size = 73352, upload-time = "2026-09-09T22:44:00.167Z" },
+    { url = "https://files.pythonhosted.org/packages/27/70/fe1e09c59dd566391aaf7bd0fb89ed9d1011e13f8fc4f4e8cc9376243888/socketdev-3.6.1-py3-none-any.whl", hash = "sha256:2297c7442c5debfa14ac464fd08b2755edbd71063b4cee3844bff173167f30e4", size = 73395, upload-time = "2026-10-21T21:30:10.718Z" },
 ]
 
 [[package]]