GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Follow the republished minimist canary patch by mikolalysenko · Pull Request #1302 · SocketDev/socket-patch

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Collaborator

Fixes #1293

Production withdrew the canary patch for pkg:npm/[email protected] (80630680-4da6-45f9-bba8-b888e0ffd58c now answers withdrawn from /patch/package, and Patch not found from /patch/view). It republished the fix at 2026-10-09 15:57Z as 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb, with a new patched index.js (afterHash ec956dca…, previously 043f04d1…) and an added test/proto.js.

Main's run 37954539425 (CI), 37954539418 (Bun) and 37954539561 (vlt) failed because of this, which blocks every PR in the merge queue:

hosted-e2e: hosted proofs rewrote nothing ("production publishes no patches").
e2e_safety_pnpm: index.js hash did not match the old afterHash.
Bun/vlt native legs: patch 80630680-… is not granted: 'withdrawn'.

Change

The UUID and afterHash are updated in the production-facing tests (e2e_hosted_production, e2e_vendored_production, e2e_safety_pnpm, e2e_npm), in scripts/backtest-bun.py and scripts/backtest-vlt.py, and in docs/testing/bun-compatibility.md. Offline UUID-shape tests, wiremock suites and binary .lockb/golden fixtures keep the old UUID, because they never contact the service.

Verified locally

cargo test -p socket-patch-cli --test e2e_hosted_production -- --include-ignored: 65 passed.
--test e2e_safety_pnpm: 23 passed.
python3 -m unittest discover -s scripts/tests: 296 OK.
backtest-vlt.fetch_grant() returns the new tarball and its sha512.

Two existing failures are unrelated to this change, and neither suite is in the PR gate:

e2e_npm test_npm_uuid_shortcut and test_npm_global_lifecycle: the shortcut now runs hosted mode in a lockfile project.
e2e_vendored_production yarn_berry_vendored_install_proof: no manifest is written.

🤖 Generated with Claude Code

Note

Low Risk
Test and documentation constant updates only; no runtime or security-sensitive application code is modified.

Overview
Production withdrew the free-tier [email protected] canary patch and republished the same CVE fix under a new UUID, with updated patched index.js bytes. This PR retargets every production-facing pin so hosted/vendored e2e, npm/pnpm safety tests, Bun/vlt backtest scripts, and Bun compatibility docs use 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb and the new afterHash (ec956dca…).

No CLI or patch-application logic changes—only constants and comments that gate CI against the live public proxy.

^{Reviewed by Cursor Bugbot for commit 84570cc. Configure here.}

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Follow the republished minimist canary patch

84570cc

Production withdrew the [email protected] patch 80630680-… on
2026-10-09 and republished it as 642d7f02-… with a new patched
index.js (afterHash ec956dca…). Every live-API suite that pins the
old UUID or hash failed: hosted-e2e, e2e_safety_pnpm and the Bun
and vlt compatibility matrices, which turned main and every PR red.

Point the production-facing tests, backtest harnesses and the Bun
compatibility doc at the new patch. Offline shape tests and binary
fixtures keep the old UUID; they never reach the service.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Mikola Lysenko (mikolalysenko) enabled auto-merge

October 9, 2026 16:40

This was referenced Oct 9, 2026

Merge queue blocked: production no longer publishes free [email protected] patch #1293

Closed

After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops #1155

Closed

Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request

Oct 9, 2026


          Repin live minimist suites to the republished patch

e2011fa

Port of #1302 (fixes #1293). Production withdrew the free
[email protected] patch 80630680-… and republished the same fix as
642d7f02-…, with a new patched index.js (afterHash ec956dca…). That
turned hosted-e2e and e2e_safety_pnpm red on main and here. No-ops once
main carries #1302 or #1301.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Mzbk9WDZkhatFrCWUAyaNs

This was referenced Oct 9, 2026

Fix yarn classic empty-range lock keys (#1271) #1274

Merged

docs: complete v5 package targeting migration guidance #1296

Merged

docs(cli): align v5 help with lockfile-first patching #1297

Merged


          Accept unprefixed patch file keys in vlt harness

ede56b4

The republished minimist patch records its files as `index.js` and
`test/proto.js` instead of `package/index.js`. The vlt backtest
stripped the first path segment unconditionally, so every cell
errored with IndexError before checking any installed bytes. Strip
the `package/` prefix only when present, as the Bun harness does.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

This was referenced Oct 9, 2026

Redact credentials from logged URLs, VEX product ids and hosted Composer locks #1026

Merged

Fix gem checks judging unused system gem homes (#1098, #1109) #1290

Merged

Report artifact GC in one JSON shape and count every rollback leg #1273

Merged

Fix Bun restore ignoring user registry config (#1276) #1283

Merged

Repin live [email protected] suites to republished patch 642d7f02 (#1293) #1301

Merged

Match package targets by PurlKey identity, not by lowercase (#1292) #1294

Merged

Make sbt Docker e2e jar fetch survive Central 403/404s #1291

Merged

Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request

Oct 9, 2026


          Read vlt backtest patch file keys with or without the package/ prefix

06065a0

The republished minimist patch (642d7f02) keys its files without the
package/ prefix, so key.split('/', 1)[1] raised IndexError in every
native vlt leg. Ports the matching line from #1302.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YRcjmQwhWGod7X58Hbe5FW

This was referenced Oct 9, 2026

Test cargo takeover over unrewritable deps (#1020) #1314

Merged

refactor: remove obsolete vendoring machinery and duplicate crate code #1279

Merged

Tanmay Singla (Tanmay182003) approved these changes

Oct 9, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added this pull request to the merge queue

Oct 9, 2026

This was referenced Oct 9, 2026

Remove --download-mode and the diff download path (#792) #1049

Merged

ci: reuse the merge-queue verdict on main and trim coverage/sbt work #1355

Merged

Fix gem unwind dropping source-block ! (#1056) #1303

Merged

Fix cargo shared-cache patch orphaned on takeover/prune (#336, #1278) #1305

Merged

Rebuild cargo crates after in-place apply/rollback (#387) #1307

Merged

Fix cargo cold-cache apply exiting 0 (#616) #1310

Merged

Freeze v5 support matrix and migration policy (#1156) #1318

Merged

Fix human vendored --prune skipping GC (#1127) #1338

Merged

Fix hosted NuGet lock walk: BOM and other versions (#593, #623) #1339

Merged

Mikola Lysenko (mikolalysenko) removed this pull request from the merge queue due to a manual request

Oct 9, 2026

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Copy link

Copy Markdown

Collaborator Author

Superseded by #1301, which merged the same repin to 642d7f02 plus the vlt harness prefix fix and regression tests.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Mikola Lysenko (mikolalysenko) closed this

Oct 9, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request

Oct 9, 2026

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th) #1248

Open

Reviewers

Tanmay Singla (Tanmay182003)

Tanmay182003 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Merge queue blocked: production no longer publishes free [email protected] patch

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change

Verified locally

Uh oh!

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.