[Oskar Haarklou Veileborg (BarrensZeppelin)]

Moves the Docker image's PyPy (amd64 only, used to speed up Python reachability analysis) from PyPy 7.3.20 / Python 3.11 to the latest alpine-pypy release, PyPy 8.0.1 / Python 3.12. The new build targets Alpine 3.24, matching the current python:3-alpine base, and ships as .tar.gz instead of .tar.bz2, so the extraction flag changes too.

Checked locally: the SHA-256 matches the digest GitHub publishes for the asset, and unpacking it in python:3-alpine (Alpine 3.24.2) gives a working pypy3 (Python 3.12.15, PyPy 8.0.1) that imports ssl, sqlite3, ctypes and json. I also built the image and ran a reachability full scan (--reach) of a small Poetry project with it: the engine picked up /bin/pypy3, ran the Python analysis on PyPy 3.12 with no analysis errors (97 vulnerabilities: 9 reachable, 41 unreachable, the rest unsupported), and the scan uploaded normally.

Bumps the CLI version to 2.11.4 (required by check_version, since 2.11.3 is on PyPI) and adds a changelog entry. The new image reaches socketdev/cli when 2.11.4 is released.

Expected reviewer effort: Stamp

---

Note

Low Risk
Dockerfile-only dependency bump for an optional amd64 PyPy used to speed Python reachability analysis; no app or auth logic changes.

Overview
Updates the amd64-only PyPy install in the Docker image from PyPy 7.3.20 / Python 3.11 (Alpine 3.21, .tar.bz2) to PyPy 8.0.1 / Python 3.12 via the alp3.24.2-pypy3.12-8.0.1 alpine-pypy release, aligned with the python:3-alpine base on Alpine 3.24.

The download URL, SHA-256 check, archive name, and tar flags switch to gzip (curl → /tmp/pypy.tar.gz, tar -xz). Comments reflect PyPy 3.12; the /opt/pypy layout and pypy3 symlink are unchanged.

^{Reviewed by Cursor Bugbot for commit 14242d3. Configure here.}