GeezerVison is showing github.com — chore(release): 5.0.1 by mikolalysenko · Pull Request #1485 · SocketDev/socket-patch
Conversation
One combined PR for the 5.0.1 release. It supersedes #1446 (5.0.0 notes) and #1483 (npm publish fix). Editing CHANGELOG.md is allowed here: this is the release PR.
Parts (one commit each)
- npm publish fix (from ci(release): publish npm from release.yml, not publish-npm.yml #1483, cherry-picked): npm publishes inline from
release.yml, which is the filename the npm trusted publishers name. publish-npm.yml is deleted, and Release gains an npm-retry-version input. crates.io still goes through publish-cargo.yml; its publisher is being fixed separately.
- 5.0.0 notes: the
[5.0.0] section now covers everything in the v5.0.0 tag (6ad6add4a). That's the 22 PRs from chore(release): bump to 5.0.1 with release notes #1446 plus Fix crawl of --system-site-packages venvs (#409) #1419, Fix uv wiring under no-sources = true (#564) #1434, Fix bare scan/get converting hosted pins (#1437) #1440, Fix git-ignored bun.lockb workspace mirrors (#1116) #1442 and Fix unbounded registry lookups in upstream restore (#1220) #1444. The date stays 2026-10-12. CI/test-only PRs (CI: hermetic spawns in cli/covgap tests (#823) #1441, CI: test Maven 4 on 4.0.0-rc-7 (#267) #1443) have no entries.
- 5.0.1 cut: I wrote
[Unreleased] from git log --first-parent 6ad6add4a..origin/main, which covers main through 501c6d938 (Reduce release build time and binary size #1449). I re-checked origin/main right before cutting and right before pushing; nothing newer had landed. Then I ran release.py changelog cut --version 5.0.1 --date 2026-10-13 and version-sync.sh 5.0.1.
- The lead entry says that 5.0.0 never reached npm or crates.io, and that 5.0.1 is the first v5 published there.
- Fixes: Hosted yarn berry rollback/remove drop the
::__archiveUrl= binding when the project's mirror serves npmjs tarball URLs, so cold installs fetch a mirror path that 404s #1465, Vendored yarn berry revert restores the pre-vendor lock entry verbatim, so after upgrading from yarn 4.0.x it writes back a bare-hex checksum and every yarn install --immutable fails YN0028 #759, Hosted pnpm scan refuses with redirect_pnpm_lockfile_disabled over env lockfile settings the project's pnpm major ignores (e.g. any pnpm 11/12 project run through npm exec with package-lock=false) #1460, Hosted yarn classic rescan and VEX accept a pin written by v4.0.0 whose patched package.json adds a dependency the lock doesn't have, so yarn installs the patched package without it #1462, Hosted uv: after uv remove <parent> or uv lock --upgrade-package <parent> drops a hosted-pinned transitive package, its leftover override makes rollback, remove and list fail forever with hosted_wiring_contested #1445, Vendored uv script lock: after the user changes the vendored package's specifier in the PEP 723 block, vendor --revert / remove / rollback write the stale ==1.16.0 back into <script>.py.lock, so uv run --locked fails (exit 0) #869, The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a source = "pypi" dependency and poetry install 1.3 fails with a solver error #1447, Pipenv stale-install remedy can't replace a base-interpreter copy in a --site-packages venv: pip uninstall refuses it and pipenv sync keeps it, so following the warning leaves the package unpatched #1450, vendor --check reports a missing or corrupt vendored artifact as a raw Rust Debug value (Corrupt { reason: "vendor_workspace_artifact_missing" }) with no remedy, though socket-patch repair fixes it #1467.
- Maintenance: Reduce release build time and binary size #1449 (smaller release binaries) and the npm workflow change.
Checks
scripts/release-lint.sh --stable-only --tag-check: all checks passed ([5.0.1] has 11 entries, and there is no v5.0.1 tag).release.py changelog check passes for 5.0.1 and 5.0.0.test_release.ChangelogTests: OK.actionlint .github/workflows/release.yml: clean.cargo check --locked with a private CARGO_TARGET_DIR: OK. The lockfile diff only restamps the version.
After merge, dispatch Release on main. Don't start it from this PR.
🤖 Generated with Claude Code
Note Medium Risk
Changes the production npm release path and OIDC workflow identity; mistakes could block or mis-publish packages, though staging, idempotent skips, and digest checks limit blast radius.
Overview
5.0.1 release train: workspace and all @socketsecurity/socket-patch* npm packages bump 5.0.0 → 5.0.1, with a new [5.0.1] changelog (fixes since v5.0.0 tag, lead note that npm/crates.io never got 5.0.0) and a fuller [5.0.0] section aligned with the tagged release.
npm publishing is folded into release.yml: publish-npm.yml is deleted and the former dispatch leg becomes an inline npm-publish job (OIDC trusted publisher is registered on release.yml). Release gains npm-retry-version to skip build/tag/GitHub release/crates.io and re-stage npm from an existing release’s assets; cargo-publish still dispatches publish-cargo.yml. Concurrency, SHA256SUMS pinning, and staged-publish behavior move with the job. docs/releasing.md, scripts/dispatch-publish.sh, and a CI comment are updated accordingly.
Reviewed by Cursor Bugbot for commit 656c663. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Every socket-patch npm package's trusted publisher is registered against
release.yml, and npm allows only one publisher per package. The 5.0.0
release dispatched publish-npm.yml, whose OIDC token named that file, so
npm rejected it with E401 before staging anything.
Move the npm leg back inline as release.yml's npm-publish job (same steps
as publish-npm.yml) and delete publish-npm.yml, so the existing
registration keeps working. Add an `npm-retry-version` input that skips
the version gate, build, tag, GitHub release and crates.io jobs and
re-stages npm from an existing release's assets; this retries 5.0.0 now
and replaces the manual Publish npm dispatch. crates.io stays dispatched
through publish-cargo.yml, since crates.io allows several publishers per
crate.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Cover the PRs merged to main after #1432's base (1779317..4cb3643):
Cargo source replacement and registry = "crates-io" (#338/#455, #386),
pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc
${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir
cascade and global home (#439/#686, #586), Go +incompatible vex (#484),
gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988),
Poetry source = "pypi" (#1282) and Hatch path characters (#547).
No entries for #1411 (macOS fix to code #1393 added in this release;
the #1393 entry already describes the intended behavior), #1426 (perf
regression introduced and fixed within 5.0.0) or the CI/test/bench PRs.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with
scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9
(#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm
publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first
v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450,
#1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452,
#1454, #1457, #1459) have no entries.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
This was referenced Oct 13, 2026
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
|
Final reviewer: disarmed auto-merge on 656c663 because ci-ok is red, and the PR isn't approved yet.
The only failing job is coverage. It failed on patch::redirect::upstream::npm::tests::project_registry_decides_a_mirrors_tarball_urls (npm.rs:4072). That's the known SOCKET_NPM_REGISTRY env race, which #1487 fixes. #1487 is approved and its auto-merge is now armed. I re-ran the failed jobs once (run 38411696131). Auto-merge gets re-armed once this PR is green and approved.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|