refactor(cli): drop -d/-m short aliases; loosen version pins

Two unrelated changes in one commit:

1. Drop the `-d` short for `--dry-run` and `-m` short for
   `--manifest-path` from `GlobalArgs`. We want those letters free
   for future flags. The long forms are unaffected, and a new
   `reserved_short_forms_are_not_assigned` compose test locks in
   that no subcommand reassigns either letter. Per-subcommand
   short-form tests (`*_short`, `manifest_path_short_form`, etc.)
   are deleted; the long-form counterparts cover the contract.

2. Loosen `python-version` and `ruby-version` pins in ci.yml from
   exact patch (`3.12.13`, `3.2.10`) to minor.x (`3.12.x`, `3.2.x`).
   setup-python and setup-ruby's catalogs keep retiring older patch
   versions and breaking the workflow — minor.x auto-resolves to
   whatever patch is currently available.

CLI_CONTRACT.md updated to remove `-d`/`-m` from the global args
table and the env-var cross-reference.

Assisted-by: Claude Code:opus-4-7

Author: mikolalysenko

.github/workflows/ci.yml

@@ -376,7 +376,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: '3.12.13'
+          python-version: '3.12.x'
 
       - name: Run pypi dispatch tests
         run: python pypi/socket-patch/test_dispatch.py
@@ -445,15 +445,16 @@ jobs:
         if: matrix.suite == 'e2e_pypi'
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: '3.12.13'
+          python-version: '3.12.x'
 
       - name: Setup Ruby
         if: matrix.suite == 'e2e_gem'
         uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
-          # 3.2.11 was removed from setup-ruby's catalog; 3.2.10 is the
-          # newest 3.2.x available on the GitHub-hosted runner.
-          ruby-version: '3.2.10'
+          # Pin to minor.x so setup-ruby auto-resolves to the latest
+          # available 3.2.x patch — exact patch pins kept dropping out
+          # of the catalog as new releases landed.
+          ruby-version: '3.2.x'
           bundler-cache: false
 
       - name: Run e2e tests

crates/socket-patch-cli/CLI_CONTRACT.md

@@ -26,7 +26,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | Long | Short | Env var | Default | Type | Semantic |
 |---|---|---|---|---|---|
 | `--cwd` | — | `SOCKET_CWD` | `.` | path | Working directory |
-| `--manifest-path` | `-m` | `SOCKET_MANIFEST_PATH` | `.socket/manifest.json` | path | Manifest location (resolved relative to `--cwd`) |
+| `--manifest-path` | — | `SOCKET_MANIFEST_PATH` | `.socket/manifest.json` | path | Manifest location (resolved relative to `--cwd`) |
 | `--api-url` | — | `SOCKET_API_URL` | `https://api.socket.dev` | string | Authenticated API endpoint |
 | `--api-token` | — | `SOCKET_API_TOKEN` | (none) | string | Auth token (absence selects the public proxy) |
 | `--org` | `-o` | `SOCKET_ORG_SLUG` | (auto-resolve) | string | Org slug |
@@ -39,7 +39,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | `--json` | `-j` | `SOCKET_JSON` | `false` | bool | Machine-readable output |
 | `--verbose` | `-v` | `SOCKET_VERBOSE` | `false` | bool | Extra detail |
 | `--silent` | `-s` | `SOCKET_SILENT` | `false` | bool | Errors only |
-| `--dry-run` | `-d` | `SOCKET_DRY_RUN` | `false` | bool | Preview, no mutations |
+| `--dry-run` | — | `SOCKET_DRY_RUN` | `false` | bool | Preview, no mutations |
 | `--yes` | `-y` | `SOCKET_YES` | `false` | bool | Skip prompts |
 | `--debug` | — | `SOCKET_DEBUG` | `false` | bool | Verbose debug logs to stderr |
 | `--no-telemetry` | — | `SOCKET_TELEMETRY_DISABLED` | `false` | bool | Disable anonymous usage telemetry |
@@ -80,7 +80,7 @@ All v3.0 env vars use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*` names
 | Env var | CLI equivalent | Default | Notes |
 |---|---|---|---|
 | `SOCKET_CWD` | `--cwd` | `.` | — |
-| `SOCKET_MANIFEST_PATH` | `--manifest-path` / `-m` | `.socket/manifest.json` | — |
+| `SOCKET_MANIFEST_PATH` | `--manifest-path` | `.socket/manifest.json` | — |
 | `SOCKET_API_URL` | `--api-url` | `https://api.socket.dev` | — |
 | `SOCKET_API_TOKEN` | `--api-token` | (none) | Absence selects the public proxy. |
 | `SOCKET_ORG_SLUG` | `--org` / `-o` | (auto-resolve) | — |
@@ -93,7 +93,7 @@ All v3.0 env vars use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*` names
 | `SOCKET_JSON` | `--json` / `-j` | `false` | — |
 | `SOCKET_VERBOSE` | `--verbose` / `-v` | `false` | — |
 | `SOCKET_SILENT` | `--silent` / `-s` | `false` | — |
-| `SOCKET_DRY_RUN` | `--dry-run` / `-d` | `false` | — |
+| `SOCKET_DRY_RUN` | `--dry-run` | `false` | — |
 | `SOCKET_YES` | `--yes` / `-y` | `false` | — |
 | `SOCKET_DEBUG` | `--debug` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_DEBUG`). |
 | `SOCKET_TELEMETRY_DISABLED` | `--no-telemetry` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_TELEMETRY_DISABLED`). |

crates/socket-patch-cli/src/args.rs

@@ -36,7 +36,6 @@ pub struct GlobalArgs {
     /// Path to patch manifest file (resolved relative to --cwd).
     #[arg(
         long = "manifest-path",
-        short = 'm',
         env = "SOCKET_MANIFEST_PATH",
         default_value = DEFAULT_PATCH_MANIFEST_PATH,
     )]
@@ -133,7 +132,6 @@ pub struct GlobalArgs {
     /// Preview the operation without making any mutations.
     #[arg(
         long = "dry-run",
-        short = 'd',
         env = "SOCKET_DRY_RUN",
         default_value_t = false,
     )]

crates/socket-patch-cli/tests/cli_global_args.rs

@@ -89,19 +89,21 @@ fn every_global_flag_parses_on_every_subcommand() {
     }
 }
 
-/// Short forms (`-d`, `-s`, `-y`, etc.) are part of the contract too.
+/// Short forms (`-s`, `-y`, etc.) are part of the contract too. `-d`
+/// and `-m` were dropped after v3.0 (they were reserved as aliases for
+/// `--dry-run` and `--manifest-path` but we want those letters free
+/// for future flags); the corresponding rejection check lives in
+/// `reserved_short_forms_are_not_assigned` below.
 #[test]
 fn every_global_short_form_parses_on_every_subcommand() {
     // (short, requires_value) — only flags that actually have a short.
     let shorts: &[(&str, bool)] = &[
-        ("-m", true),  // --manifest-path
         ("-o", true),  // --org
         ("-e", true),  // --ecosystems
         ("-g", false), // --global
         ("-j", false), // --json
         ("-v", false), // --verbose
         ("-s", false), // --silent
-        ("-d", false), // --dry-run
         ("-y", false), // --yes
     ];
     let all_subcommands: Vec<&str> = SUBCOMMANDS_NO_POSITIONAL
@@ -132,6 +134,42 @@ fn every_global_short_form_parses_on_every_subcommand() {
     }
 }
 
+/// `-d` and `-m` were intentionally dropped (formerly aliases for
+/// `--dry-run` and `--manifest-path`) so those letters stay free for
+/// future flags. Lock that in: clap must reject the bare shorts on
+/// every subcommand. The long forms still work and are exercised by
+/// `every_global_flag_parses_on_every_subcommand` above.
+#[test]
+fn reserved_short_forms_are_not_assigned() {
+    let all_subcommands: Vec<&str> = SUBCOMMANDS_NO_POSITIONAL
+        .iter()
+        .chain(SUBCOMMANDS_WITH_IDENTIFIER.iter())
+        .copied()
+        .collect();
+    for &subcommand in &all_subcommands {
+        for short in ["-d", "-m"] {
+            let result = try_parse(subcommand, &[short]);
+            assert!(
+                result.is_err(),
+                "`{}` should NOT accept the reserved short `{}` — \
+                 if you bound it intentionally, update this test and \
+                 the corresponding `--help` docs.",
+                subcommand,
+                short,
+            );
+            let err = result.err().unwrap();
+            assert_eq!(
+                err.kind(),
+                clap::error::ErrorKind::UnknownArgument,
+                "expected UnknownArgument when `{}` is passed to `{}`; got {:?}",
+                short,
+                subcommand,
+                err.kind(),
+            );
+        }
+    }
+}
+
 /// Locks the env-var bindings: setting a SOCKET_* env var must populate
 /// the corresponding GlobalArgs field on parse.
 ///

crates/socket-patch-cli/tests/cli_parse_apply.rs

@@ -70,11 +70,6 @@ fn dry_run_long() {
     assert!(parse_apply(&["--dry-run"]).common.dry_run);
 }
 
-#[test]
-fn dry_run_short() {
-    assert!(parse_apply(&["-d"]).common.dry_run);
-}
-
 #[test]
 fn silent_long() {
     assert!(parse_apply(&["--silent"]).common.silent);
@@ -142,11 +137,6 @@ fn manifest_path_long() {
     );
 }
 
-#[test]
-fn manifest_path_short() {
-    assert_eq!(parse_apply(&["-m", "custom.json"]).common.manifest_path, "custom.json");
-}
-
 #[test]
 fn global_prefix_long() {
     assert_eq!(

crates/socket-patch-cli/tests/cli_parse_list.rs

@@ -47,12 +47,6 @@ fn defaults_match_contract() {
     assert!(!args.common.json);
 }
 
-#[test]
-fn manifest_path_short_form() {
-    let args = parse_list(&["-m", "custom.json"]);
-    assert_eq!(args.common.manifest_path, "custom.json");
-}
-
 #[test]
 fn manifest_path_long_form() {
     let args = parse_list(&["--manifest-path", "custom.json"]);

crates/socket-patch-cli/tests/cli_parse_remove.rs

@@ -83,12 +83,6 @@ fn global_long_form() {
     assert!(args.common.global);
 }
 
-#[test]
-fn manifest_path_short_form() {
-    let args = parse_remove(&["pkg:npm/foo@1", "-m", "custom/manifest.json"]);
-    assert_eq!(args.common.manifest_path, "custom/manifest.json");
-}
-
 #[test]
 fn manifest_path_long_form() {
     let args = parse_remove(&[
@@ -133,7 +127,7 @@ fn all_flags_combined() {
         "pkg:npm/foo@1",
         "--cwd",
         "/tmp/x",
-        "-m",
+        "--manifest-path",
         "custom/manifest.json",
         "--skip-rollback",
         "-y",

crates/socket-patch-cli/tests/cli_parse_repair.rs

@@ -53,24 +53,12 @@ fn repair_defaults_match_contract() {
     assert!(!args.common.json);
 }
 
-#[test]
-fn repair_dry_run_short_flag() {
-    let args = parse_repair(&["-d"]);
-    assert!(args.common.dry_run);
-}
-
 #[test]
 fn repair_dry_run_long_flag() {
     let args = parse_repair(&["--dry-run"]);
     assert!(args.common.dry_run);
 }
 
-#[test]
-fn repair_manifest_path_short_flag() {
-    let args = parse_repair(&["-m", "custom.json"]);
-    assert_eq!(args.common.manifest_path, "custom.json");
-}
-
 #[test]
 fn repair_manifest_path_long_flag() {
     let args = parse_repair(&["--manifest-path", "custom.json"]);

crates/socket-patch-cli/tests/cli_parse_rollback.rs

@@ -57,12 +57,6 @@ fn positional_identifier_purl() {
     assert_eq!(args.identifier, Some("pkg:npm/foo@1".to_string()));
 }
 
-#[test]
-fn dry_run_short() {
-    let args = parse_rollback(&["-d"]);
-    assert!(args.common.dry_run);
-}
-
 #[test]
 fn dry_run_long() {
     let args = parse_rollback(&["--dry-run"]);
@@ -81,12 +75,6 @@ fn silent_long() {
     assert!(args.common.silent);
 }
 
-#[test]
-fn manifest_path_short() {
-    let args = parse_rollback(&["-m", "custom.json"]);
-    assert_eq!(args.common.manifest_path, "custom.json");
-}
-
 #[test]
 fn manifest_path_long() {
     let args = parse_rollback(&["--manifest-path", "custom.json"]);

crates/socket-patch-cli/tests/cli_parse_scan.rs

@@ -274,12 +274,6 @@ fn dry_run_long_form() {
     assert!(args.common.dry_run);
 }
 
-#[test]
-fn dry_run_short_form() {
-    let args = parse_scan(&["-d"]);
-    assert!(args.common.dry_run);
-}
-
 #[test]
 fn scan_json_empty_cwd_emits_updates_key() {
     // Spawn the compiled binary against an empty tempdir so no API call