GeezerVison is showing github.com — chore(release): bump to 5.0.1 with release notes by mikolalysenko · Pull Request #1446 · SocketDev/socket-patch
Conversation
Bumps the version to 5.0.1 and adds its release notes. Editing CHANGELOG.md is allowed here: this is release work, not a feature PR.
Why 5.0.1, not a 5.0.0 fold
v5.0.0 was tagged at 6ad6add4a and published 2026-10-12 21:38Z, and the release is immutable. This PR originally folded 22 PRs into [5.0.0]. Those PRs are in the 5.0.0 build but were missing from its notes, and editing [5.0.0] on main would make it diverge from the tagged section. So:
[5.0.0] is restored to the tagged text (it's identical to v5.0.0:CHANGELOG.md).- A new
## [5.0.1] — 2026-10-13 section holds those 22 entries plus the fixes merged since v5.0.0. Its intro says some fixes were already in the 5.0.0 build.
Coverage of v5.0.0..origin/main (15 commits)
- Fixed: Hosted pnpm scan refuses with redirect_pnpm_lockfile_disabled over env lockfile settings the project's pnpm major ignores (e.g. any pnpm 11/12 project run through
npm exec with package-lock=false) #1460 (pnpm env settings per major), Vendored yarn berry revert restores the pre-vendor lock entry verbatim, so after upgrading from yarn 4.0.x it writes back a bare-hex checksum and every yarn install --immutable fails YN0028 #759 (vendored Berry revert), Hosted yarn berry rollback/remove drop the ::__archiveUrl= binding when the project's mirror serves npmjs tarball URLs, so cold installs fetch a mirror path that 404s #1465 (mirror archiveUrl on restore), Hosted yarn classic rescan and VEX accept a pin written by v4.0.0 whose patched package.json adds a dependency the lock doesn't have, so yarn installs the patched package without it #1462 (yarn classic v4 pins), The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a source = "pypi" dependency and poetry install 1.3 fails with a solver error #1447 (Poetry 1.3 guard, merged with the Hosted and vendored Poetry rewrites break poetry install on Poetry 1.4–2.2 when the patched dependency is declared with source = "pypi" ("Repository \"pypi\" does not exist."), with no warning #1282 entry), Hosted uv: after uv remove <parent> or uv lock --upgrade-package <parent> drops a hosted-pinned transitive package, its leftover override makes rollback, remove and list fail forever with hosted_wiring_contested #1445 (orphaned uv override), Vendored uv script lock: after the user changes the vendored package's specifier in the PEP 723 block, vendor --revert / remove / rollback write the stale ==1.16.0 back into <script>.py.lock, so uv run --locked fails (exit 0) #869 (uv script-lock revert), Pipenv stale-install remedy can't replace a base-interpreter copy in a --site-packages venv: pip uninstall refuses it and pipenv sync keeps it, so following the warning leaves the package unpatched #1450 (Pipenv base-interpreter remedy), vendor --check reports a missing or corrupt vendored artifact as a raw Rust Debug value (Corrupt { reason: "vendor_workspace_artifact_missing" }) with no remedy, though socket-patch repair fixes it #1467 (vendor --check message).
- Maintenance: Reduce release build time and binary size #1449 (one codegen unit for release builds).
- No entry, on purpose: the CI/test PRs CI: hermetic spawns in scan/vendor tests (#823) #1448, CI: hermetic spawns in in_process tests (#823) #1452, CI: hermetic spawns in VEX tests (#823) #1454, CI: hermetic spawns in redirect build tests (#823) #1457 and Ride out crates.io blips in required cargo e2e legs #1459.
Version
scripts/release.py stamp 5.0.1 covers Cargo.toml, Cargo.lock, the npm wrapper and its lock, and the 15 platform packages.
Checks
scripts/release-lint.sh --stable-only --tag-check: all checks passed for 5.0.1.release.py changelog check --version 5.0.1: passed.scripts/tests/test_release.py: 82 tests OK.
🤖 Generated with Claude Code
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Ready for review (burn-down agent)
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Final review brief
What it does: Adds 22 more merged fixes to the [5.0.0] section of CHANGELOG.md, so the 5.0.0 notes cover main up to 4cb3643ac (#1432). The only file changed is CHANGELOG.md, and no code changes.
Risk: low. It only changes the release notes, on a release/v* branch where editing CHANGELOG.md is expected.
Look here:
Verified:
- Each new entry maps to a merged commit on main: Fix hosted pnpm pin of a lock pnpm ignores (#1074) #1431, Fix berry restore keeping removed descriptors (#1435) #1436, Fix yarnrc ${VAR} and YAML setting reads (#1100) #1433, Fix CRLF .npmrc append with no final newline (#1196) #1417, Fix Composer vendor-dir config cascade (#439, #686) #1408, Fix Composer global home lookup order (#586) #1421, Fix Go vex of +incompatible module patches (#484) #1427, Fix gem agent crawl under a moved BUNDLE_GEMFILE (#952) #1430, Fix gem revert of a commented Gemfile line (#988) #1406, Fix Poetry rewrite of a source = "pypi" dep (#1282) #1413, Fix vendored Hatch refs in %/#/;/? checkouts (#547) #1428, Fix Cargo source replacement being ignored (#338, #455) #1420, Fix hosted cargo pin of registry = "crates-io" (#386) #1412.
- Every warning code the entries name exists in
crates/ on main: redirect_pnpm_lockfile_disabled, redirect_poetry_lock_unsupported, pypi_poetry_source_constraint, pypi_hatch_unsupported, redirect_cargo_directory_source.
- CI: 35/35 green, 19 path-skipped. Bugbot reviewed this head and found nothing. There are no review threads.
Changes I made: none.
Open question (doesn't block this PR): main has moved past the stated coverage point. Five user-facing fixes landed after 4cb3643ac and aren't in these notes yet: #1442 (#1116), #1444 (#1220), #1419 (#409), #1440 (#1437) and #1434 (#564). (#1441 and #1443 are CI-only.) They need another fold before the tag is cut, either in this PR or in a follow-up.
Auto-merge is armed, so approving sends this straight to the merge queue.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
v5.0.0 is already tagged and published (immutable), so its CHANGELOG
section is restored to the tagged text. The 22 PRs this branch had folded
into [5.0.0] (in the 5.0.0 build but missing from its notes) plus the 9
user-facing fixes merged since v5.0.0 go into a new [5.0.1] section.
Version stamped with scripts/release.py stamp 5.0.1.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Superseded by #1485 (combined 5.0.1 release PR). Its 5.0.0 notes are carried there, extended to cover the whole v5.0.0 tag.
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Labels
Ready for review
Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|