fix: bump Socket SDK version, handle missing diff scores

[lelia]

Summary

Bump the CLI to socketdev>=3.0.33,<4.0.0 to pick up the SDK fix for unknown alert categories, and harden dependency overview rendering so PR comments no longer crash when diff artifacts have missing or null score data.

Problem

1. The SDK could crash while deserializing diff alerts when the API returned an unknown category like "other". That is fixed in socketdev 3.0.33, so the CLI needs to consume that release.
2. The CLI could crash while generating the dependency overview comment when a diff artifact had score / scores set to None. The comment renderer assumed added.scores was always a dict and called .get(...) on it.

Fix

• bump the CLI dependency to socketdev>=3.0.33,<4.0.0
• bump CLI version to 2.2.86 to prepare for new release
• normalize diff artifacts with score=None to an empty score map in the CLI model layer
• make dependency overview badge rendering tolerate missing, null, or partial score data
• default missing badge values to a valid 100% fallback instead of producing invalid badge URLs

Test plan

• uv run --refresh --extra test pytest tests/unit/test_dependency_overview.py tests/core/test_package_and_alerts.py -q

Added regression coverage for:

• Package.from_diff_artifact(...) normalizing score=None
• dependency overview comment generation succeeding when package scores are missing or partially null
• valid fallback badge output for missing scores

Also fixes: SocketDev/socket-sdk-python#78

[github-actions]

🚀 Preview package published!

Install with:

pip install --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple socketsecurity==2.2.86.dev1

Docker image: socketdev/cli:pr-193

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​socketdev@​3.0.32 ⏵ 3.0.33	+1

View full report

[Chris Johnson (johnsonch)]

Thank you for doing this!

[David Larsen (dc-larsen)]

LGTM

[David Larsen (dc-larsen)]

LGTM

[David Larsen (dc-larsen)]

LGTM

[David Larsen (dc-larsen)]

LGTM