GeezerVison is showing github.com — chore(release): complete 5.1.0 notes for every PR since v5.0.1 by mikolalysenko · Pull Request #2047 · SocketDev/socket-patch
Conversation
Summary
The ## [5.1.0] section came out of a release-staging routine running on a shallow clone, so it cited only about 80 of the 342 PRs merged since v5.0.1 (#2032 says its covered range was 50 first-parent PRs). This PR rewrites the section to cover all of them, including the PRs merged today (#2005, #2009, #2012, #2018, #2021, #2046):
#1646 ships as a fix in 5.1.0
#1646 makes scan/apply skip, and get/vendor refuse, packages the project patches itself (pnpm/yarn/patch-package/npm/Bun/Composer/Cargo/Go). Agent apply also stops overwriting unknown file drift. CLI_CONTRACT classified this as MAJOR. The maintainer decision is to ship it in 5.1.0 as a fix: a Socket patch on top of a project's own patch leaves an install that fails or runs only one of the two, and --allow-patch-conflicts is the explicit per-run opt-in to the old behavior. This PR:
- leads
### Changed with that rationale;
- updates CLI_CONTRACT's "Release classification: MAJOR" paragraph to match.
Other changes that tighten defaults (all documented under Changed/Fixed)
Some other changes turn a "success" exit 0 into a refusal. In each case the old run left the build unpatched or broken: gitignored vendor ledger/artifacts (#1640/#1593/#1656), an unreadable manifest → manifest_unreadable (#1776), vendor from an npm workspace member (#1928), Maven profile-bypassed pins refused (#2005), and GOFLAGS=-modfile (#1800). Other notable changes:
The date line stays 2026-11-06. Update it if you want it to match the dispatch day.
Release blocker found in smoke testing (separate PR)
Agent-mode native rebuild of nokogiri failed under the default crawl root, because GEM_PATH and the spec path were passed relative. The fix, on branch fix/gem-native-relative-gem-home, needs to land before Release is dispatched.
🤖 Generated with Claude Code
Note Low Risk
Documentation-only changes to release notes and CLI contract wording; no runtime behavior in this diff.
Overview
Fills in the ## [5.1.0] CHANGELOG so it documents every user-facing and maintenance PR merged since v5.0.1, not the earlier partial set. New bullets are grouped by ecosystem under Added, Changed, Fixed, and Performance, with no-behavior PRs lumped under Maintenance (including a long issue-number roll call).
Updates CLI_CONTRACT.md for “Existing project patches”: release classification moves from MAJOR to fix (shipped in 5.1.0), with rationale that skipping/refusing when the project already patches the same package avoids broken installs and that --allow-patch-conflicts is the explicit per-run opt-in.
Reviewed by Cursor Bugbot for commit 01e242a. Configure here.
Generated by Claude Code
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
The 5.1.0 section was written from a shallow clone and cited only about
80 of the 342 PRs merged since v5.0.1. Rewrite it to cover all of them:
user-visible changes by ecosystem under Added / Changed / Fixed /
Performance, and the rest listed under Maintenance. It also picks up the
PRs merged on 2026-11-09 (#2005, #2009, #2012, #2018, #2021, #2046).
#1646 (skip/refuse packages the project patches itself unless
--allow-patch-conflicts) ships in 5.1.0 as a fix: patching over a
project's own patch leaves an install that fails or runs only one of the
two, and the flag is the explicit opt-in. Lead the Changed section with
it, and update CLI_CONTRACT's "Release classification: MAJOR" paragraph
to say so.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
|
Labeled Ready for review by the burn-down agent.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Final review brief
What it does. Release-notes-only PR for 5.1.0: rewrites the ## [5.1.0] CHANGELOG section so it cites every PR merged since v5.0.1 (the earlier draft came from a shallow clone and cited ~80 of 342), and reclassifies #1646 (project-owned-patch protection) in CLI_CONTRACT.md from MAJOR to a fix shipped in 5.1.0. No code changes.
Risk: low. Two Markdown files. Merging doesn't publish anything: release.yml runs only on manual dispatch.
Look here
Verified
Changes I made: none.
Open questions (not blocking)
Auto-merge (squash) is armed, so approving sends this straight to the merge queue.
Generated by Claude Code
|
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Labels
Ready for review
Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|