GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — chore(release): 5.1.0 note for #1966 by mikolalysenko · Pull Request #2043 · SocketDev/socket-patch

Conversation

@mikolalysenko

@mikolalysenko Mikola Lysenko (mikolalysenko) commented Nov 9, 2026 •
edited by cursor Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Collaborator

Follow-up to #2038: three PRs merged while it was in the merge queue

#1966, #2041 and #2042 landed on main just before #2038 merged. They ship in 5.1.0. With this PR, the 5.1.0 notes cover main through 53286d4e.

This PR changes only CHANGELOG.md (+8/−1, inside ## [5.1.0]), and the version stays 5.1.0.

PR Section Note
#1966 (#1965) Fixed → npm family A registry dependency that root overrides send to a URL, git or path spec is skipped by hosted mode (redirect_npm_non_registry_entry_skipped), refused by vendored mode, and no longer attested by vex. This includes overrides scoped to a workspace member
#2041, #2042 Maintenance CI retries setup-ruby and setup-deno once on a release-CDN error

Local checks: release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 both passed.

Maintainer checklist

  • Approve and merge this PR before dispatching Release.
  • After merge, confirm nothing else landed: git log --first-parent 53286d4e..origin/main, ignoring this PR's own merge commit.
  • Actions → Release → Run workflow on main (optionally a dry-run: true run first).
  • Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

Generated by Claude Code

Note

Low Risk
Documentation-only edit to the changelog; no code or workflow changes in this diff.

Overview
This PR only updates CHANGELOG.md under ## [5.1.0] so release notes match what already merged on main (version stays 5.1.0).

Fixed → npm family: Documents that when root package.json overrides send a registry dependency to a tarball URL, git spec, or path (so npm installs that spec instead of the lock’s resolved), hosted mode skips with redirect_npm_non_registry_entry_skipped, vendored mode refuses, and vex no longer attests—including member-scoped overrides (#1965, #1966).

Maintenance: Notes that CI retries setup-ruby and setup-deno once after a release-CDN error (#2041, #2042).

Reviewed by Cursor Bugbot for commit 600182d. Configure here.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@claude
chore(release): add 5.1.0 notes for #1966, #2041 and #2042
600182d 
All three merged to main while #2038 was in the merge queue and ship
in 5.1.0.

Co-Authored-By: Claude <[email protected]>
@mikolalysenko
Mikola Lysenko (mikolalysenko) enabled auto-merge November 9, 2026 19:46
Wenxin-Jiang
Wenxin Jiang (Wenxin-Jiang) approved these changes Nov 9, 2026
View reviewed changes

@Wenxin-Jiang Wenxin Jiang (Wenxin-Jiang) left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[agent] Approving: the two notes match #1966 (reason code redirect_npm_non_registry_entry_skipped exists at head) and #2041/#2042, and stay inside ## [5.1.0].

Heads-up for the post-merge checklist step: three PRs landed on main after 53286d4e — #1893 (Go stale go.sum line after a downgrade, user-facing), #2039 and #2040 (CI maintenance). They need 5.1.0 notes before dispatching Release.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Claude (claude) added 2 commits November 9, 2026 20:58
@claude
Merge remote-tracking branch 'origin/main' into release/v5.1.0
540f008
@claude
chore(release): add 5.1.0 notes for #1893, #2039 and #2040
bc63299 
Co-Authored-By: Claude <[email protected]>
@mikolalysenko

Mikola Lysenko (mikolalysenko) commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator Author

Thanks, Wenxin-Jiang. I folded the three PRs you flagged into this PR so the release doesn't need another follow-up. I merged main (e0916be9) and added:

  • Fixed → Go: after a downgrade in a go 1.16-or-older module leaves stale go.sum lines, apply, apply --check, hosted mode and vex follow the module graph's selected version. If the cache can't answer, they fail closed (On a go 1.16 go.mod, Go apply, apply --check and vex trust a stale go.sum zip line left by a downgrade, so they report an inert replace as applied (or refuse a selected version) #1862, Fix Go stale go.sum line after a downgrade (#1862) #1893).
  • Maintenance: lint-ecosystems installs retry release 504s (Retry release 504s in lint-ecosystems installer steps #2040), and vexctl is cached on every OS (Cache vexctl on every OS so release 504s can't fail coverage #2039).

release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md. The 5.1.0 notes now cover main through e0916be9. This push may have dismissed your approval, so it may need re-approval.

Generated by a one-off release-staging routine.

Generated by Claude Code
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko
Mikola Lysenko (mikolalysenko) added this pull request to the merge queue Nov 9, 2026
Merged via the queue into main with commit 20381ab Nov 9, 2026
49 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@mikolalysenko
Mikola Lysenko (mikolalysenko) deleted the release/v5.1.0 branch November 9, 2026 21:13
@mikolalysenko Mikola Lysenko (mikolalysenko) mentioned this pull request Nov 10, 2026
chore(release): complete 5.1.0 notes for every PR since v5.0.1 #2047
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Wenxin-Jiang Wenxin Jiang (Wenxin-Jiang) Wenxin-Jiang approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@mikolalysenko @Wenxin-Jiang @claude
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.