GeezerVison

Ready for review at 16af5bbccc351c6956773ed5e7d533e98eb28a93.

• CI: 31/31 checks pass (plus 19 skipped). No failures.
• Bugbot reviewed 16af5bb and found nothing. There are no open review threads.
• This is a release PR, so its CHANGELOG.md change is expected: it adds 15 lines inside ## [5.1.0], for Stop attesting npm-family pins pnpm or a user patch overrides #2010 and Never read or rewrite project files outside the git repository root #2025. Auto-merge is already armed, so approving the PR sends it to the queue.
• For the reviewer: check whether Never read or rewrite project files outside the git repository root #2025 belongs under ### Changed instead of ### Fixed, as the description asks.

Generated by Claude Code

Final review: the 5.1.0 notes were missing #2031, so I pushed fabe76f to add it.

#2031 (Keep the in-memory hosted engine off the disk for Go workspaces) merged on main at 01:23 UTC, which is after the f5b03744 cut-off this PR was written against. It changes Go behavior users can see:

• It finishes the go.work handling that Read the governing go.work in Go discovery #2011 started. A replace the workspace bypasses stays visible to list, rollback and remove. A root go.work replace that go never reads no longer withholds the root go.mod's copy of it. I added #2031 to the existing Read the governing go.work in Go discovery #2011 bullet.
• The in-memory hosted engine no longer checks the process's working directory when it judges a Go workspace. I added a new Go bullet for this.

The other PRs merged after f5b03744 don't need a note. #2002 states "No product code changes". #2034, #2035 and #2037 only touch tests and CI.

I re-ran release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 locally, and both pass. Because the head changed, I turned off auto-merge and removed Ready for review. The burn-down will add the label back once CI is green, and I'll post a review brief on the next pass. The open question about filing #2025 under ### Changed or ### Fixed is still for the approver.

bugbot run

Generated by Claude Code

Five more PRs merged to main after this PR was opened. Another session added the #2031 note (fabe76f3). I kept that commit and pushed two more on top of it:

• merged the latest main (568e376b) into this branch, since fabe76f3 was based on the older head;
• listed the four non-user-visible PRs under Maintenance: Move the Socket origin classifier into one module #2002 (origin classifier moved, no behavior change), Let the pdm e2e bootstrap install pdm 2.29.4+ #2034, Fix Windows-only scala_cli liveness test failure in nightly #2035 and Make NuGet walk tests ignore the host package cache #2037 (test fixes).

release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md. The 5.1.0 notes now cover main through 568e376b. Auto-merge is off. After you approve, merge by hand or re-arm it, then check git log --first-parent 568e376b..origin/main before you dispatch Release.

Generated by a one-off release-staging routine.

Generated by Claude Code

bugbot run

Generated by Claude Code

Ready for review at 999e5e847b56cd685110745ee095a97a008927d5.

• CI: 31/31 checks pass (30 CI + Cursor Bugbot), 19 skipped. No failures, no main-wide failures.
• Bugbot reviewed 999e5e8 and found nothing; no open review threads.
• Release PR: it only changes CHANGELOG.md (the 5.1.0 notes, now including Keep the in-memory hosted engine off the disk for Go workspaces #2031). Mergeable; waiting only on a human approval.

Generated by Claude Code

Final review brief

What it does. Release-notes-only PR for 5.1.0: it adds CHANGELOG.md entries for every PR merged to main since the last notes update (#2010, #2025, #2031, #2002, #2034, #2035, #2037). It changes no code.

Risk: low. One file, documentation only. It is a release/v* branch, so the CHANGELOG edit is allowed.

Look here

• CHANGELOG.md:103-106: Stop attesting npm-family pins pnpm or a user patch overrides #2010, the npm-family vex withholds
• CHANGELOG.md:134-144: Read the governing go.work in Go discovery #2011 extended with Keep the in-memory hosted engine off the disk for Go workspaces #2031 (Go workspace)
• CHANGELOG.md:203-213: Never read or rewrite project files outside the git repository root #2025, the git-root boundary. This is the most user-visible change in the batch.
• CHANGELOG.md:233-236: Maintenance (Move the Socket origin classifier into one module #2002 and the test fixes)

Verified

• Every PR on main since the previous notes PR (chore(release): 5.1.0 notes for PRs merged during review #2033) has an entry. main head is 568e376 (Move the Socket origin classifier into one module #2002).
• Each new reason code named in the notes exists in crates/ on this head: vex_pnpm_git_branch_lockfile, vex_npm_patched_dependency, redirect_cargo_config_outside_root, redirect_nuget_inherited_config_outside_root, pypi_requirements_outside_root, go_workspace_override.
• scripts/release-lint.sh 5.1.0 passes locally: version coherence, npm lock, and a [5.1.0] section with 12 entries.
• CI: 31/31 pass, 19 skipped. Bugbot found no issues on 999e5e8. There are no review threads.

Changes I made: none.

Open questions: The section is still dated 2026-11-06. If the tag is cut on a later day, the release agent may want to update the date.

Auto-merge is armed, so approving sends this PR straight to the merge queue.

Generated by Claude Code