@@ -23,6 +23,131 @@ a version without a non-empty section in this file. |
23 | 23 |
|
24 | 24 | ## [Unreleased] |
25 | 25 |
|
| 26 | +## [5.1.0] — 2026-11-06 |
| 27 | + |
| 28 | +### Added |
| 29 | + |
| 30 | +- **RubyGems.** |
| 31 | + - **Agent mode patches gems with native (C) extensions for real.** When |
| 32 | + `apply` (or `scan` / `get --mode agent`) patches a gem whose patch changes |
| 33 | + native-extension sources (such as `ext/**/*.c` or an `extconf.rb`), it |
| 34 | + now rebuilds the gem's extensions with RubyGems' own builder, the step |
| 35 | + `gem pristine --extensions` runs, using the Ruby that owns the gem home. |
| 36 | + Both the copy under `extensions/<platform>/<abi>/` and the copy under the |
| 37 | + gem's `lib/` are rebuilt, so Ruby stops loading the stale install-time |
| 38 | + `.so` / `.bundle`. A build that fails puts the original sources and build |
| 39 | + back (`native_extension_build_failed`), and a copy that can't be rebuilt |
| 40 | + in place (a precompiled platform gem, a Bundler git checkout, no matching |
| 41 | + Ruby) is refused with `native_extensions_unsupported` before anything is |
| 42 | + written. Sources an earlier release patched without a rebuild are rebuilt |
| 43 | + on the next `apply` (`native_extension_rebuilt` warning). `vex` and |
| 44 | + `apply --check` attest such a patch only once its rebuild is recorded, |
| 45 | + and otherwise report `native_extension_not_rebuilt`. `rollback` and |
| 46 | + `remove` restore the original build. Callers that compile the extension |
| 47 | + themselves can opt out with `--no-gem-native-rebuild` (env |
| 48 | + `SOCKET_NO_GEM_NATIVE_REBUILD`): the sources are written without a |
| 49 | + rebuild, with a `native_extension_not_rebuilt` warning, and `vex` does |
| 50 | + not attest them. Hosted copies are unaffected, since RubyGems compiles |
| 51 | + the patched gem itself (#1996, #1998). |
| 52 | + |
| 53 | +### Fixed |
| 54 | + |
| 55 | +- **RubyGems.** |
| 56 | + - With Bundler 4.1 `override "other", with: "gem", in: "parent"`, hosted |
| 57 | + `rollback` and `remove` treat the override target as transitive and give |
| 58 | + back the original lock and Gemfile byte for byte, instead of writing a |
| 59 | + new exact `gem "gem", "x.y.z"` pin that blocked later upgrades (#1989, |
| 60 | + #1991). |
| 61 | + - Gemspec directives and development dependencies are read as Ruby code: |
| 62 | + `=begin`/`=end` blocks, heredoc bodies and `__END__` data are skipped, so |
| 63 | + a commented-out dev dependency no longer adds a bogus requirement and a |
| 64 | + heredoc no longer refuses the Gemfile (#1932, #1936). |
| 65 | +- **npm family.** |
| 66 | + - pnpm workspace globs with brace sets and character classes |
| 67 | + (`packages/{a,b}`, `packages/[ab]*`) are read the way pnpm reads them in |
| 68 | + every mode instead of being refused or read as every directory; shapes |
| 69 | + pnpm reads its own way (extglobs, `[!a]`, a `+` after a class, stepped or |
| 70 | + punctuation-spanning brace ranges) are still refused, and commented |
| 71 | + importer lines in `pnpm-lock.yaml` are ignored (#1846, #1863). |
| 72 | + - Quoted values, YAML escapes and duplicate keys in `pnpm-workspace.yaml`, |
| 73 | + `.yarnrc.yml` and `.modules.yaml` decode one way, as pnpm reads them, so |
| 74 | + settings such as `modulesDir` or `lockfileDir` no longer resolve to |
| 75 | + different paths depending on the command (#1918, #1973). |
| 76 | + - yarn classic's `.yarnrc` is read as yarn 1.22 reads the whole file: |
| 77 | + `--modules-folder 'deps'` no longer sends the crawler to a folder yarn |
| 78 | + never installs into, and a file yarn can't parse sets nothing (#1901, |
| 79 | + #1915). |
| 80 | + - A malformed `package.json` `workspaces` field (a non-string item, `null`, |
| 81 | + the wrong type) is judged the same way everywhere; the Bun member walk |
| 82 | + falls back to `bun.lock` instead of reading no members (#1900, #1971). |
| 83 | + - `apply` and `rollback` no longer touch package copies inside a store |
| 84 | + nested in another store's entry, which `scan` never reports, and keep |
| 85 | + the peer-variant copies of a project that lives under `~/.bun`, |
| 86 | + `~/.deno` or `~/.vlt` (#1899, #1986). |
| 87 | + - Hosted npm warns `redirect_npm_omit_lockfile_registry_resolved` when any |
| 88 | + npm config layer sets `omit-lockfile-registry-resolved`, which makes the |
| 89 | + next `npm install` drop the hosted URL and fail with `EINTEGRITY`, and |
| 90 | + names where it is set and the remedies (#1871, #1872). |
| 91 | +- **PyPI.** |
| 92 | + - A requirements line pinned through an environment variable |
| 93 | + (`six==${SIXV}`) is refused by `vendor` with |
| 94 | + `pypi_requirement_env_templated`, and `vendor --check` and `vex` read it |
| 95 | + as possibly installing any release, so the patch is no longer attested |
| 96 | + while `pip install -r` can install the unpatched one (#1873, #1874). |
| 97 | + - A hosted scan of a Python project with no lockfile the rewriters read now |
| 98 | + warns `redirect_pypi_no_lockfile`, naming the files looked for and the |
| 99 | + project's own lock command, instead of passing silently (#638, #1885). |
| 100 | + - After a hosted rollback, a vendored rollback or `vendor --revert` of a |
| 101 | + requirements-file pin, the reinstall advisory covers pip and names the |
| 102 | + requirements files to reinstall from (#1953, #1954). |
| 103 | + - The hosted Pipenv stale-install warning ends with the same runnable |
| 104 | + remedy as vendored mode and never prints an option-like package name |
| 105 | + into a shell command (#1878, #1883). |
| 106 | + - A `poetry.lock` in an old format (0, 1.0, 1.1) keeps its "written by |
| 107 | + Poetry < 1.4" warnings and refusals even when a hand-merged header claims |
| 108 | + a newer Poetry (#1847, #1865). |
| 109 | +- **Go.** In a go 1.16 (unpruned) module where a dependency imports a fork |
| 110 | + that the root `go.mod` replaces with the patched module, `apply`, |
| 111 | + `apply --check`, hosted mode and `vex` read the module graph to tell |
| 112 | + whether the patch is really built, instead of reporting it applied while |
| 113 | + `go build` linked the unpatched code (#1840, #1843). |
| 114 | +- **Maven.** A Maven 4 root that builds its subdirectories implicitly |
| 115 | + (model 4.1.0, `pom` packaging, no `<subprojects>`) is treated as a reactor |
| 116 | + by hosted mode, `vex` and the Maven cache scope, not only by vendored mode, |
| 117 | + so a root-only pin is no longer attested while a module keeps its own |
| 118 | + version (#1809, #1886). |
| 119 | +- **Vendoring.** |
| 120 | + - Vendored dry runs leave already-vendored patches out of the "Would |
| 121 | + download and vendor" headline and list them as skipped, matching the wet |
| 122 | + run and the JSON (#1850, #1856). |
| 123 | + - Run from a workspace member with no lockfile of its own, a vendored |
| 124 | + `scan`, `get` or `vendor` names the lock that installs the member and |
| 125 | + where to run from (#1904, #1913). |
| 126 | + - npm package-lock packages installed from a URL or git spec, and workspace |
| 127 | + members, are refused before their patch is downloaded; dry runs preview |
| 128 | + them as refused and they no longer hold a `--max-new-patches` rollout |
| 129 | + slot (#1976, #1977). |
| 130 | + - In a vlt project, `vendor` no longer requests service downloads for |
| 131 | + packages it then refuses (#1909, #1947). |
| 132 | +- **General.** |
| 133 | + - The nested-project remedy quotes its path for the shell it prints for, |
| 134 | + including Windows and `%` (#1859, #1884). |
| 135 | + - Patch and vendor download errors read the same on every path (size |
| 136 | + limit, HTTP status with a bounded body excerpt), and artifact downloads |
| 137 | + log under `--debug` (#1869, #1870). |
| 138 | + |
| 139 | +### Maintenance |
| 140 | + |
| 141 | +- Code consolidation with no output change: one lock-rewrite driver for |
| 142 | + Poetry and PDM (#1898) and module sweeps across the CLI and core |
| 143 | + (#1855, #1864, #1875, #1884, #1892, #1897, #1903, #1907, #1914, #1920, |
| 144 | + #1923, #1929, #1939, #1948, #1967, #1975, #1985, #1990). |
| 145 | +- Test and CI infrastructure: shared test env guard, docker harness, PTY |
| 146 | + runner, `copy_tree` and apply fixtures; hermetic children scrub color |
| 147 | + variables; failing tests are annotated in CI; offline bun.lockb rollback |
| 148 | + mock and a Windows venv layout in the PyPI fixture (#1891, #1890, #1905, |
| 149 | + #1944, #1955, #1964, #1972, #1978, #1988, #1994). |
| 150 | + |
26 | 151 | ## [5.0.1] — 2026-10-13 |
27 | 152 |
|
28 | 153 | ### Fixed |
|