Summary
release-readiness is red on main (and on every PR): the version-sync.sh 4.0.0 is not a no-op gate fails on npm/socket-patch/package-lock.json.
Root cause: the lock refresh in #233 was generated with npm ≥ 11, which writes libc platform arrays on the optional platform-package entries. The CI runner's npm 10 does not emit that field, so npm install --package-lock-only inside version-sync.sh strips 24 lines and the no-op check fails — on main itself, independent of any PR content.
This regenerates the lock with CI's npm major (npx npm@10 install --package-lock-only --ignore-scripts), making the gate a no-op again. Verified locally: with this lock, npm 10 regeneration is byte-stable.
Follow-up included (731d322): version-sync.sh now runs the lock refresh through npx --yes npm@10, so the gate's canon no longer depends on the runner default or the developer's local npm. Without the pin, anyone refreshing the lock with npm ≥ 11 would re-introduce the libc fields (verified: npm 11.16 fresh-resolve writes 8 of them; npm 10 writes none and reproduces this PR's lock byte-for-byte), and the gate would flip in reverse the day the runner image jumps to npm 11. Bumping the pin is now a deliberate commit that refreshes the lock alongside it.
Not addressed here (separate, also main-wide): hosted-e2e fails because production no longer publishes a free patch for pkg:cargo/[email protected] (the suite's pinned cargo leg; the public proxy now returns not_found for it). Fixing that needs a catalog decision — republish the patch, or pick a replacement pinned package per the suite's own guidance.
🤖 Generated with Claude Code
Note
Low Risk
Lockfile-only change with no application code; risk is limited to install/resolution metadata consistency across npm versions.
Overview
Regenerates npm/socket-patch/package-lock.json so it matches what CI’s npm 10 writes when version-sync.sh runs npm install --package-lock-only.
The diff removes the optional libc arrays (glibc / musl) from the Linux @socketsecurity/socket-patch-* platform entries. Those fields appear when the lock is refreshed with npm ≥ 11; npm 10 omits them, so the release-readiness version-sync no-op check was failing even on unrelated changes.
No runtime or package logic changes—only lockfile metadata so the gate stays byte-stable on the runner.
Reviewed by Cursor Bugbot for commit 640a0a5. Configure here.