GeezerVison is showing github.com — chore(release): 5.0.0 release notes for PRs merged since the bump by mikolalysenko · Pull Request #1432 · SocketDev/socket-patch
Conversation
Release-notes PR for the v5.0.0 cut. Editing CHANGELOG.md is allowed here: this is release work, not a feature PR.
What changed
The 5.0.0 version bump (#1194) merged on 2026-10-09. Since then, 117 PRs have landed on main (6c01c7f78..17793173f). The release will be cut from main HEAD, so this PR adds those PRs to the existing ## [5.0.0] section and changes its date to 2026-10-12. [Unreleased] stays empty, and version stamps are unchanged.
- Breaking changes: a bare
scan/get keeps the project's existing mode (Decide: make the command model read-only scan plus fix/undo/sync, with mode taken from project state, and make "nothing to undo" exit 0 #1088). Every command prints one --json envelope (An unparseable .socket/manifest.json is reported under five different --json error codes depending on the command #931, scan exits 1 in human output but 0 with --json when every patch query returns nothing #1062). Artifact GC reports one JSON shape (Artifact GC is reported in four JSON shapes, and the bytesFreed/bytes fields the contract documents are emitted by no command #1257, rollback --json counters count only the agent leg, so hosted and vendored failures report failed: 0 #1066). get/remove/rollback use one package-target grammar with case-preserving identity (get <uuid> overrides socket.yml without the documented policy_bypassed warning (purl/CVE/GHSA forms do warn) #453, remove, rollback and get treat case-distinct packages as one: remove pkg:npm/jsonstream also removes JSONStream's patch #1292). --download-mode is removed (Decide: make --download-mode file the default and retire the diff download path #792). Three existing bullets that the envelope change superseded are updated: the first bullet on the hosted default, failed apply events, and hosted redirect.patches.
- Added: OS trust store and
SSL_CERT_FILE support, settings from go env -w, Go resync warnings, Pipenv/uv co-wiring of the exported requirements.txt and pylock.toml, pnpm --update commands, warnings for a stale Bundler plugin and yarn member-dir installs, telemetry additions, and the v5 support tiers.
- Fixed: a bold credential-redaction entry,
--manifest-path, GC/repair, and fixes grouped by ecosystem (JVM, NuGet, Go, Composer, npm family, Cargo, RubyGems, PyPI).
- Maintenance: the docs, crate-cleanup and CI/test-only PRs are condensed into three bullets.
Checks
scripts/release-lint.sh --stable-only --tag-check: all checks passed, with 157 entries in [5.0.0].python3 scripts/release.py changelog check --version 5.0.0 passed.python3 -m unittest test_release.ChangelogTests: 8 tests OK.
🤖 Generated with Claude Code
Note Low Risk
Documentation-only release notes in CHANGELOG.md; no runtime or API code changes in this PR.
Overview
Updates the 5.0.0 changelog section (release date 2026-10-12) with user-facing notes for 117 PRs merged after the initial version bump, without touching version stamps or [Unreleased].
Breaking changes are expanded and aligned with shipped behavior: bare scan/get preserve an existing project mode; unified --json envelopes and GC shape; shared package-target grammar; removal of --download-mode; wording fixes for hosted defaults and failed apply reporting.
Added, Fixed, and maintenance bullets capture TLS/Go/pnpm telemetry, credential redaction, --manifest-path, and ecosystem-grouped fixes (JVM, NuGet, Go, npm, Cargo, Ruby, PyPI), plus condensed docs/CI cleanup notes.
Reviewed by Cursor Bugbot for commit a06a3ab. Configure here.
Generated by Claude Code
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Fold the 117 PRs merged to main after the 5.0.0 version bump (#1194,
6c01c7f..1779317) into the [5.0.0] section and re-date it
2026-10-12, so the release cut from main HEAD documents what it ships.
- Breaking: mode kept from project state (#1088), one JSON envelope
for every command (#931/#1062), one GC JSON shape (#1257/#1066), one
package-target grammar with case-preserving identity (#453/#1292),
--download-mode removed (#792). Existing bullets superseded by the
envelope (agent failed events, hosted redirect.patches) updated.
- Added: OS trust store + SSL_CERT_FILE, go env -w, Go resync
warnings, Pipenv/uv sibling co-wiring, pnpm --update hints, stale
Bundler plugin and yarn member-dir warnings, telemetry, v5 tiers.
- Fixed: credential redaction, --manifest-path, GC/repair, plus
per-ecosystem fixes (JVM, NuGet, Go, Composer, npm family, Cargo,
RubyGems, PyPI).
- Maintenance: docs, crate cleanup and CI condensed into three bullets.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit a06a3ab. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Ready for review (burn-down agent)
- Head:
a06a3ab2
- CI: 35/35 green, 19 path-skipped; no main-wide failures.
- Mergeable: yes, no conflicts with
main.
- Bugbot: reviewed
a06a3ab, no findings. No open review threads.
- Release PR (
release/v5.0.0-notes): the CHANGELOG.md change is expected. Reviewers should check the 5.0.0 notes against the PRs merged since the version bump.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Final review brief
What it does: Brings the untagged ## [5.0.0] section up to date with the 49 PRs merged since the 5.0.0 bump (#1194). It moves the date to 2026-10-12 and adds five Breaking entries (JSON envelope, GC shape, target grammar, --download-mode removed, mode kept from project state) plus about 70 Added/Fixed/Maintenance bullets. It also rewords three older entries that the new envelope made stale. Only CHANGELOG.md changes, which is allowed on a release/v* branch.
Risk: low. The change is docs only, and every new entry traces to a commit on main. No v5.0.0 tag exists yet, so editing the section in place is correct.
Look here
Verified
Changes I made: none.
Open questions (non-blocking; the release agent can fold these into a follow-up)
Auto-merge (squash) is armed, so approving sends this straight to the merge queue.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Oct 12, 2026
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Oct 13, 2026
* ci(release): publish npm from release.yml, not publish-npm.yml
Every socket-patch npm package's trusted publisher is registered against
release.yml, and npm allows only one publisher per package. The 5.0.0
release dispatched publish-npm.yml, whose OIDC token named that file, so
npm rejected it with E401 before staging anything.
Move the npm leg back inline as release.yml's npm-publish job (same steps
as publish-npm.yml) and delete publish-npm.yml, so the existing
registration keeps working. Add an `npm-retry-version` input that skips
the version gate, build, tag, GitHub release and crates.io jobs and
re-stages npm from an existing release's assets; this retries 5.0.0 now
and replaces the manual Publish npm dispatch. crates.io stays dispatched
through publish-cargo.yml, since crates.io allows several publishers per
crate.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* chore(release): fold 22 more PRs into the 5.0.0 notes
Cover the PRs merged to main after #1432's base (1779317..4cb3643):
Cargo source replacement and registry = "crates-io" (#338/#455, #386),
pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc
${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir
cascade and global home (#439/#686, #586), Go +incompatible vex (#484),
gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988),
Poetry source = "pypi" (#1282) and Hatch path characters (#547).
No entries for #1411 (macOS fix to code #1393 added in this release;
the #1393 entry already describes the intended behavior), #1426 (perf
regression introduced and fixed within 5.0.0) or the CI/test/bench PRs.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* chore(release): cover #1419, #1434, #1440, #1442, #1444 in the 5.0.0 notes
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* chore(release): 5.0.1
Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with
scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9
(#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm
publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first
v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450,
#1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452,
#1454, #1457, #1459) have no entries.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
* chore(release): 5.0.1 notes for PRs merged since the cut
Covers #1469, #1470, #1474, #1475, #1478, #1479, #1480 and #1482; #1484 is
CI-only. The notes now cover main through 285a5e8.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
---------
Co-authored-by: Claude Opus 5.5 (1M context) <[email protected]>
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Labels
Ready for review
Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|