GeezerVison

What's Changed

• Read Python locks without copying them in VEX (#1473) by Mikola Lysenko (@mikolalysenko) in #1486
• CI: hermetic spawns in vlt test commons (#823) by Mikola Lysenko (@mikolalysenko) in #1488
• CI: hermetic spawns in VEX test commons (#823) by Mikola Lysenko (@mikolalysenko) in #1491
• Fix berry workspace globs with regex groups (#1490) by Mikola Lysenko (@mikolalysenko) in #1493
• CI: hermetic spawns in Go test suites (#823) by Mikola Lysenko (@mikolalysenko) in #1495
• Fix scans missing renamed yarn copies (#939, #1236) by Mikola Lysenko (@mikolalysenko) in #1489
• ci(release): skip npm packages an earlier attempt already staged by Mikola Lysenko (@mikolalysenko) in #1499
• Fix phantom version bump in release-readiness by Mikola Lysenko (@mikolalysenko) in #1497
• Fix Bun 1.3+ bun.lockb read as pre-1.3 (#1492) by Mikola Lysenko (@mikolalysenko) in #1496
• CI: hermetic spawns in NuGet/PyPI suites (#823) by Mikola Lysenko (@mikolalysenko) in #1498
• Fix npm alias links missed from a member (#1494) by Mikola Lysenko (@mikolalysenko) in #1500
• CI: hermetic spawns in Cargo/Composer suites (#823) by Mikola Lysenko (@mikolalysenko) in #1502
• Fix uv script no-sources in a parent config (#1501) by Mikola Lysenko (@mikolalysenko) in #1504
• CI: hermetic spawns in gem/vendor suites (#823) by Mikola Lysenko (@mikolalysenko) in #1505
• Fix Poetry source pin over a pre-2.1 lock (#1503) by Mikola Lysenko (@mikolalysenko) in #1506
• Fix Pipenv requirements remedy categories (#1507) by Mikola Lysenko (@mikolalysenko) in #1508
• Fix vendored npm VEX beside a file: dir copy (#1511) by Mikola Lysenko (@mikolalysenko) in #1513
• CI: hermetic spawns in npm/Bun suites (#823) by Mikola Lysenko (@mikolalysenko) in #1510
• CI: hermetic spawns in scan/policy/network suites (#823) by Mikola Lysenko (@mikolalysenko) in #1515
• CI: hermetic spawns in vex-vendor/rollback suites (#823) by Mikola Lysenko (@mikolalysenko) in #1518
• CI: hermetic spawns in the e2e_maven suite (#823) by Mikola Lysenko (@mikolalysenko) in #1519
• Fix yarn renamed-copy identity fail-open (#1516) by Mikola Lysenko (@mikolalysenko) in #1517
• Fix gem source-block detection for multi-line and brace openers (#1509) by Mikola Lysenko (@mikolalysenko) in #1520
• CI: hermetic spawns in e2e_redirect_cargo_shapes (#823) by Mikola Lysenko (@mikolalysenko) in #1522
• Fix untagged Bun 1.3.0/1.3.1 lock dialect (#1521) by Mikola Lysenko (@mikolalysenko) in #1523
• Fix nightly old-uv orphan-unwind failure in uv e2e by Mikola Lysenko (@mikolalysenko) in #1525
• CI: hermetic spawns in the production e2e suites (#823) by Mikola Lysenko (@mikolalysenko) in #1528
• Fix vendored PyPI revert of entries wired across flavors (#1524) by Mikola Lysenko (@mikolalysenko) in #1526
• CI: hermetic env for the PTY test spawns (#823) by Mikola Lysenko (@mikolalysenko) in #1530
• Fix pyproject product detection tables (#1527, #642) by Mikola Lysenko (@mikolalysenko) in #1529
• CI: hermetic env for production suites' tool spawns (#823) by Mikola Lysenko (@mikolalysenko) in #1532
• CI: remove suite asserts codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1535
• Fix pnpm trustLockfile env override ignored (#1514) by Mikola Lysenko (@mikolalysenko) in #1533
• CI: share one bundler scrub across test helpers (#823) by Mikola Lysenko (@mikolalysenko) in #1536
• Fix gem source block after a ; on the line (#1531) by Mikola Lysenko (@mikolalysenko) in #1537
• CI: repair suite asserts codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1539
• Fix vendored scans failing on nested npm projects (#1534) by Mikola Lysenko (@mikolalysenko) in #1543
• CI: vendor suite asserts codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1544
• CI: apply suite asserts codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1546
• Fix yarn classic VEX for unlocked dep ranges (#1538) by Mikola Lysenko (@mikolalysenko) in #1548
• CI: vendor silent-error tests join vendor suite (#1089) by Mikola Lysenko (@mikolalysenko) in #1550
• Fix yarn berry absolute portal:/link: copies (#1540) by Mikola Lysenko (@mikolalysenko) in #1551
• CI: rollback tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1552
• CI: get tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1553
• Fix vlt extglob workspace members (#1542) by Mikola Lysenko (@mikolalysenko) in #1555
• CI: scan hosted tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1556
• CI: scan mod tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1560
• Fix vendored npm tarballs captured by Git LFS (#1541) by Mikola Lysenko (@mikolalysenko) in #1559
• CI: fold last top-level covgap test binaries (#1089) by Mikola Lysenko (@mikolalysenko) in #1568
• Fix PyPI direct refs not contesting wiring (#1549) by Mikola Lysenko (@mikolalysenko) in #1562
• CI: cli suite tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1565
• Fix yarn berry missing portal:/link: copies (#1561) by Mikola Lysenko (@mikolalysenko) in #1571
• Fix vlt 1.4 pnpm-workspace.yaml members (#1564) by Mikola Lysenko (@mikolalysenko) in #1574
• Fix uv project shadowing parent uv settings (#1545) by Mikola Lysenko (@mikolalysenko) in #1566
• CI: vex tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1563
• Fix pnpm 11 env booleans other than true/false (#1557) by Mikola Lysenko (@mikolalysenko) in #1575
• Fix VEX pyproject product purl name (#1547) by Mikola Lysenko (@mikolalysenko) in #1577
• CI: update tests assert codes, not sentences (#1089) by Mikola Lysenko (@mikolalysenko) in #1580
• Fix VEX gemspec reading commented-out name/version (#1573) by Mikola Lysenko (@mikolalysenko) in #1582
• CI: scan suite covgap files get real homes (#1089) by Mikola Lysenko (@mikolalysenko) in #1583
• CI: core covgap tests join their suites (#1089) by Mikola Lysenko (@mikolalysenko) in #1585
• Fix yarn portal copies read as no package (#1579) by Mikola Lysenko (@mikolalysenko) in #1586
• CI: move action pins off deprecated Node 20 (#1588) by Mikola Lysenko (@mikolalysenko) in #1590
• Fix hosted/vendored cargo floor reads (#653, #651) by Mikola Lysenko (@mikolalysenko) in #1429
• Restore withdrawn hosted pins upstream during scan by Mikola Lysenko (@mikolalysenko) in #1592
• Fix yarn copies with invalid manifest names (#1598) by Mikola Lysenko (@mikolalysenko) in #1605
• Fix Pipenv refusing split-version categories (#1616) by Mikola Lysenko (@mikolalysenko) in #1617
• Fix Bun installs getting npm self-update hints (#1621) by Mikola Lysenko (@mikolalysenko) in #1622
• Fix npm workspace members named build/dist skipped (#1627) by Mikola Lysenko (@mikolalysenko) in #1628
• Fix vlt vendoring of prepare-family scripts (#1633) by Mikola Lysenko (@mikolalysenko) in #1637
• Fix lockless nested npm projects in root scans (#1554) by Mikola Lysenko (@mikolalysenko) in #1591
• Fix yarn classic patched-manifest dependency model (#1558, #1578) by Mikola Lysenko (@mikolalysenko) in #1596
• Fix hosted uv missing uv<0.5.6 advisories (#1569) by Mikola Lysenko (@mikolalysenko) in #1609
• Make ci-watch.sh work in GraphQL-less cloud sessions by Mikola Lysenko (@mikolalysenko) in #1620
• Stop reuse self-tests posting fake CI notices by Mikola Lysenko (@mikolalysenko) in #1634
• Fix lock rewrites changing file owner (#1635) by Mikola Lysenko (@mikolalysenko) in #1636
• Fix pylock revert misplacing wheel hashes (#1623) by Mikola Lysenko (@mikolalysenko) in #1625
• Fix uv restore ignoring lock file filters (#1604, #1613) by Mikola Lysenko (@mikolalysenko) in #1614
• Fix bare requirements whe...

Contributors

What's Changed

• CI: hermetic spawns in scan/vendor tests (#823) by Mikola Lysenko (@mikolalysenko) in #1448
• Fix vendor --check artifact failure message (#1467) by Mikola Lysenko (@mikolalysenko) in #1468
• Fix pnpm env settings read across majors (#1460) by Mikola Lysenko (@mikolalysenko) in #1461
• Fix vendored berry revert restoring stale lock (#759) by Mikola Lysenko (@mikolalysenko) in #1464
• Ride out crates.io blips in required cargo e2e legs by Mikola Lysenko (@mikolalysenko) in #1459
• Fix orphaned hosted uv override wiring (#1445) by Mikola Lysenko (@mikolalysenko) in #1453
• Fix Pipenv remedy for base-interpreter copies (#1450) by Mikola Lysenko (@mikolalysenko) in #1455
• Fix Poetry 1.3 source-pin guard (#1447) by Mikola Lysenko (@mikolalysenko) in #1451
• Fix hosted yarn classic rescan of v4 pins (#1462) by Mikola Lysenko (@mikolalysenko) in #1463
• Fix stale specifier on uv script-lock revert (#869) by Mikola Lysenko (@mikolalysenko) in #1458
• CI: hermetic spawns in redirect build tests (#823) by Mikola Lysenko (@mikolalysenko) in #1457
• CI: hermetic spawns in VEX tests (#823) by Mikola Lysenko (@mikolalysenko) in #1454
• CI: hermetic spawns in in_process tests (#823) by Mikola Lysenko (@mikolalysenko) in #1452
• Fix mirror archiveUrl dropped on berry restore (#1465) by Mikola Lysenko (@mikolalysenko) in #1466
• Reduce release build time and binary size by John-David Dalton (@jdalton) in #1449
• Fix silent hosted pnpm pin beside a file: copy by Mikola Lysenko (@mikolalysenko) in #1469
• Fix slow hosted Poetry lock rewrite (#1473) by Mikola Lysenko (@mikolalysenko) in #1475
• Fix gem source-block bang lost after x = if … end (#1476) by Mikola Lysenko (@mikolalysenko) in #1478
• Fix gem lockfile DSL call ignored (#1477) by Mikola Lysenko (@mikolalysenko) in #1479
• Fix workspace member globs for yarn 1 and npm (#1097) by Mikola Lysenko (@mikolalysenko) in #1480
• Fix path-scoped scan missing member alias links (#1266) by Mikola Lysenko (@mikolalysenko) in #1470
• Fix quadratic hosted Hatch rewrite (#1471) by Mikola Lysenko (@mikolalysenko) in #1474
• Fix npm file: copy attested by in-run VEX (#1481) by Mikola Lysenko (@mikolalysenko) in #1482
• CI: hermetic spawns in vendor build tests (#823) by Mikola Lysenko (@mikolalysenko) in #1484
• chore(release): 5.0.1 by Mikola Lysenko (@mikolalysenko) in #1485

New Contributors

• John-David Dalton (@jdalton) made their first contribution in #1449

Full Changelog: v5.0.0...v5.0.1

Contributors

What's Changed

• fix(test): unflake the apply_lock orphaned-inode race; extend the hosted gem pin for production's fifth 6.0.3 patch by Mikola Lysenko (@mikolalysenko) in #232
• ci(release): decompose registry publishing into independently dispatchable per-registry workflows by Mikola Lysenko (@mikolalysenko) in #230
• fix(maven): send the official Maven CLI user agent to the maven2 registry; refresh npm wrapper lock for published 4.0.0 platform packages by Mikola Lysenko (@mikolalysenko) in #233
• feat!: scan↔rollback duality — full-state rollback default, --preserve-state, path targeting by Mikola Lysenko (@mikolalysenko) in #231
• test(e2e): demote the cargo production legs to canary status — free cargo tier is unpublished by Mikola Lysenko (@mikolalysenko) in #235
• fix(ci): regenerate the npm wrapper lock with CI's npm major by Mikola Lysenko (@mikolalysenko) in #234
• Coverage audit: 39 bug fixes + test extension to 98.2% line coverage by Mikola Lysenko (@mikolalysenko) in #236
• Preserve pip patch markers and hash checks by Mikola Lysenko (@mikolalysenko) in #237
• Preserve Python patches across uv lockfiles by Mikola Lysenko (@mikolalysenko) in #238
• Harden uv lockfile patch preservation and verify every uv release family by Mikola Lysenko (@mikolalysenko) in #239
• Fix pnpm hosted redirects across legacy and peer lock entries by Mikola Lysenko (@mikolalysenko) in #240
• Support hosted and legacy Poetry patches by Mikola Lysenko (@mikolalysenko) in #241
• Support hosted and vendored Hatch patches by Mikola Lysenko (@mikolalysenko) in #244
• Support hosted Pipenv patches and safe vendoring by Mikola Lysenko (@mikolalysenko) in #242
• Support hosted and vendored PDM patches by Mikola Lysenko (@mikolalysenko) in #243
• Fix Bun patch compatibility and annotations by Mikola Lysenko (@mikolalysenko) in #245
• Add native bun.lockb patching for hosted and vendored modes by Mikola Lysenko (@mikolalysenko) in #246
• Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode by Mikola Lysenko (@mikolalysenko) in #247
• Consolidated terminal UI and CLI-wide output polish by Mikola Lysenko (@mikolalysenko) in #248
• Harden vendored-mode trust in patch-service artifacts by Mikola Lysenko (@mikolalysenko) in #249
• Keep vendored re-runs idempotent across patch-service outages by Mikola Lysenko (@mikolalysenko) in #250
• feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5) by Mikola Lysenko (@mikolalysenko) in #251
• Stop hosted Go redirects claiming unpatched deps by Mikola Lysenko (@mikolalysenko) in #252
• Fix Windows (yarn berry CRLF support) and first-run real-PM CI failures after #251 by Mikola Lysenko (@mikolalysenko) in #253
• Wire vendored cargo patches through Cargo.toml and tag the copy by Mikola Lysenko (@mikolalysenko) in #254
• Fix Cargo hosted workspace redirects by Mikola Lysenko (@mikolalysenko) in #256
• Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters by Mikola Lysenko (@mikolalysenko) in #257
• Add in-memory hosted engine and napi addon by Mikola Lysenko (@mikolalysenko) in #276
• Fix four vendored/hosted correctness bugs found while profiling by Mikola Lysenko (@mikolalysenko) in #268
• Support vlt in hosted, vendored and agent modes by Mikola Lysenko (@mikolalysenko) in #269
• Give the CI test job 50 minutes so Windows can finish by Mikola Lysenko (@mikolalysenko) in #278
• Match Composer patch versions like Composer does by Mikola Lysenko (@mikolalysenko) in #270
• Keep NuGet patches installed with and NuGet.config by Mikola Lysenko (@mikolalysenko) in #284
• v5 prerelease: scan → vex → vendor workflow, hosted by default by Mikola Lysenko (@mikolalysenko) in #277
• Fix #258: state the real Maven Trusted Checksums floor by Mikola Lysenko (@mikolalysenko) in #322
• Fix npm VEX attesting packages with an unpatched bundled copy (#325) by Mikola Lysenko (@mikolalysenko) in #337
• Fix Poetry venv discovery to match Poetry (#327, #329) by Mikola Lysenko (@mikolalysenko) in #330
• Fix npm rewiring git/URL/file lock entries (#326) by Mikola Lysenko (@mikolalysenko) in #345
• Fix JSON writers dropping CRLF/BOM/indent (#324, #351) by Mikola Lysenko (@mikolalysenko) in #357
• Keep Composer redirects and rollback consistent by Mikola Lysenko (@mikolalysenko) in #358
• Fix requirements.txt writers ignoring pip hash mode (#376) by Mikola Lysenko (@mikolalysenko) in #383
• Fix Pipenv venv discovery order (#334, #384) by Mikola Lysenko (@mikolalysenko) in #388
• Fix pnpm-workspace.yaml key detection and appends (#400, #402) by Mikola Lysenko (@mikolalysenko) in #414
• Fix ETXTBSY flake in vlt npx shim self-test by Mikola Lysenko (@mikolalysenko) in #441
• Fix global scan missing pipx venvs (#415) by Mikola Lysenko (@mikolalysenko) in #418
• Fix Pipenv matrix flake on 503/DNS transport blips by Mikola Lysenko (@mikolalysenko) in #419
• Fix hosted scan not reading the Pipfile (#333) by Mikola Lysenko (@mikolalysenko) in #425
• Fix -g touching the cwd project's state (#436, #445) by Mikola Lysenko (@mikolalysenko) in #446
• Fix vlt e2e legs failing when api.socket.dev blips by Mikola Lysenko (@mikolalysenko) in #448
• Fix Python crawler missing .egg-info installs (#447) by Mikola Lysenko (@mikolalysenko) in #452
• Fix agent scan/get skipping apply for recorded patches (#454) by Mikola Lysenko (@mikolalysenko) in #456
• Fix gem rollback pinning redirected transitive gems (#457) by Mikola Lysenko (@mikolalysenko) in #460
• Fix gem modes wiring a manifest Bundler ignores (#341, #390) by Mikola Lysenko (@mikolalysenko) in #431
• Fix npm crawler missing relocated dependency stores (#359, #362) by Mikola Lysenko (@mikolalysenko) in #365
• Fix vendored rescans failing on unwired ledger entries (#541) by Mikola Lysenko (@mikolalysenko) in #543
• Fix PyPI agent apply patching only one installed copy (#529, #501) by Mikola Lysenko (@mikolalysenko) in #538
• Fix Maven e2e flake when Central briefly serves a plugin as absent by Mikola Lysenko (@mikolalysenko) in #494
• Fix vendor -g rewiring the cwd project (#498) by Mikola Lysenko (@mikolalysenko) in #499
• Download vexctl instead of compiling it on Linux/Windows by Mikola Lysenko (@mikolalysenko) in #500
• Fix vendor prefetch breaker-test flake and outage over-requests by Mikola Lysenko (@mikolalysenko) in #510
• Fix uv pylock rollback shape (#407, #408) by Mikola Lysenko (@mikolalysenko) in #512
• Fix global Python scan missing uv and PDM installs (#449, #451) by Mikola Lysenko (@mikolalysenko) in #522
• Fix Poetry venv selection ignoring envs.toml (#476, #526) by Mikola Lysenko (@mikolalysenko) in #527
• Fix lock-only requirements.txt discovery (#412, #523) by Mikola Lysenko (@mikolalysenko) in #530
• Fix yarnrc compressionLevel comment refusal (#370) by Mikola Lysenko (@mikolalysenko) in #508
• Fix uv sources unwind on dotted/sub-table spellings (#544, #524) by Mikola Lysenko (@mikolalysenko) in #545
• Fix Bundler settings resolution order (#483, #507) by Mikola Lysenko (@mikolalysenko) in #532
• Fix Bun/vlt bundled copies left unpatched (#469, #471) by Mikola Lysenko (@mikolalysenko) in #472
• Fix Bun backtest flake: retry cells on vex-step transport errors by Mikola Lysenko (@mikolalysenko) in #565
• Fix npm crawler missing configured install roots (#493, #518) by Mikola Lysenko (@mikolalysenko) in #520
• Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) by Mikola Lysenko (@mikolalysenko) in #540
• Fix npm overrides of git deps being refused (#490) by Mikola Lysenko (@mikolalysenko) in #491
• Fix vendored Python reverts refusing sibling edits (#385, #474) by Mikola Lysenko (@mikolalysenko) in #481
• Fix agent apply writing into shared package stores (#332, #361) by Mikola Lysenko (@mikolalysenko) in #486
• ...

Contributors

What's Changed

• test(setup): experimental end-to-end setup-flow matrix (all ecosystems, workspaces, monorepo) by Mikola Lysenko (@mikolalysenko) in #98
• ci: remove changelog rollover from release workflow by Mikola Lysenko (@mikolalysenko) in #97
• feat(setup): add --check and --remove flags with dry-run + edit previews by Mikola Lysenko (@mikolalysenko) in #99
• feat: package-manager-agnostic PyPI post-install patch hook (.pth) by Mikola Lysenko (@mikolalysenko) in #100
• feat(cargo): project-local [patch]-redirect backend + single fail-closed guard by Mikola Lysenko (@mikolalysenko) in #102
• feat(golang): project-local go.mod [replace]-redirect backend + fail-closed guard by Mikola Lysenko (@mikolalysenko) in #104
• feat(study-crates): test-file target + reward-hacking benchmark prompt by Mikola Lysenko (@mikolalysenko) in #101
• feat(setup): fix cargo release blocker, close all 5 contract gaps, add composer + gem publishing by Mikola Lysenko (@mikolalysenko) in #105
• fix: correctness bug sweep + hardening tests across crawlers, patch, and vex by Mikola Lysenko (@mikolalysenko) in #106
• refactor(cargo): patch crates in place; drop the [patch]-redirect backend + build guard by Mikola Lysenko (@mikolalysenko) in #107
• feat(api): batch patch lookups through the public proxy in scan by Mikola Lysenko (@mikolalysenko) in #108
• feat: socket-patch vendor — committable vendoring of patched dependencies by Mikola Lysenko (@mikolalysenko) in #109
• feat: integrate vendor with scan/apply/vex — scan --vendor/--detached, vendor-aware lifecycle by Mikola Lysenko (@mikolalysenko) in #110
• fix: second-pass bug sweep — crawler traversal guards, FIFO hangs, atomic writes, CLI contract by Mikola Lysenko (@mikolalysenko) in #111
• feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply by Mikola Lysenko (@mikolalysenko) in #115
• feat(vendor): download prebuilt patched packages from patch.socket.dev (--vendor-source) by Mikola Lysenko (@mikolalysenko) in #116
• feat: three patch-apply modes — hosted, vendored, agent — with full ecosystem + VEX coverage by Mikola Lysenko (@mikolalysenko) in #117
• cleanup: CLI simplify pass, correctness fixes, core dedups, scan split, docs sync (−587 net lines) by Mikola Lysenko (@mikolalysenko) in #120
• fix(vendor): verify the extracted tree after a service-download, not just the archive bytes by Mikola Lysenko (@mikolalysenko) in #122
• ci: fix cargo cache eviction — rust-cache, per-suite e2e keys, main-only saves by Mikola Lysenko (@mikolalysenko) in #121
• chore(deps): Bump serde_with from 3.20.0 to 3.21.0 by Dependabot (@dependabot)[bot] in #123
• feat!: remove unlock + --break-lock, fold lock cleanup into repair, reorder --help by Mikola Lysenko (@mikolalysenko) in #124
• feat(config): socket login now configures socket-patch — socket-cli config.json fallback + SOCKET_CLI_* aliases by Mikola Lysenko (@mikolalysenko) in #125
• fix(test): e2e_safety_pnpm — don't follow pnpm 10.34's store→project symlinks by Mikola Lysenko (@mikolalysenko) in #126
• docs: README overhaul on the Divio model + ecosystems doc split + auth/config alignment by Mikola Lysenko (@mikolalysenko) in #127
• feat: socket-patch --update self-update + passive update notifier by Mikola Lysenko (@mikolalysenko) in #128
• test(vendor): yarn 1 dev-flow e2e — lockfile re-save survival + strapi-incident guards by Mikola Lysenko (@mikolalysenko) in #129
• feat(cli): hidden --mode aliases — vendor/host by Mikola Lysenko (@mikolalysenko) in #130
• test(redirect): yarn classic hosted-mode capstone e2e by Mikola Lysenko (@mikolalysenko) in #132
• fix(redirect): fail closed on non-npm: berry descriptors + yarn layering regression suite by Mikola Lysenko (@mikolalysenko) in #131
• feat(vendor): warn when a wired classic yarn.lock is one berry install from silent de-patching by Mikola Lysenko (@mikolalysenko) in #133
• fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch by Mikola Lysenko (@mikolalysenko) in #134
• test: fix hostile-decoy env race flaking the setup-matrix and e2e suites by Mikola Lysenko (@mikolalysenko) in #135
• test: exclude crawler-e2e siblings from #[serial] env swaps via #[parallel] by Mikola Lysenko (@mikolalysenko) in #136
• chore(deps): Bump quinn-proto from 0.11.14 to 0.11.16 by Dependabot (@dependabot)[bot] in #137
• feat(release): publish to every supported ecosystem from one release dispatch (Maven Central + NuGet + consolidated release.yml) by Mikola Lysenko (@mikolalysenko) in #138
• feat(release): version-bump automation + shared release-readiness gate by Mikola Lysenko (@mikolalysenko) in #139
• fix(update): retry sanity-exec on ETXTBSY — deflake coverage and harden self-update against the fork/exec fd race by Mikola Lysenko (@mikolalysenko) in #140
• test(hosted): production e2e for scan --mode hosted across every ecosystem and package manager by Mikola Lysenko (@mikolalysenko) in #141
• test: hermetic package-manager caches — squash of #142/#143/#144 + review fixes + hosted-e2e unblock by Mikola Lysenko (@mikolalysenko) in #146
• fix(scan,get): rank patches by severity, then merge state, then patch recency by Mikola Lysenko (@mikolalysenko) in #147
• test(hosted): decide the gem tolerance by probing the server by Mikola Lysenko (@mikolalysenko) in #149
• Structure-review batch: sweep fixes, module taxonomy, npm-family dedup, coverage gaps, CI honesty by Mikola Lysenko (@mikolalysenko) in #150
• chore: blame-ignore the #150 squash; retry the bun download in the npm image by Mikola Lysenko (@mikolalysenko) in #156
• fix(get,scan): retain patch-added new files; guard empty patch records by Mikola Lysenko (@mikolalysenko) in #158
• fix(scan): warn to run pnpm install --trust-lockfile after a hosted pnpm redirect by Mikola Lysenko (@mikolalysenko) in #159
• fix(test): unbreak main — give four get edge-case fixtures a real file for #158's guardrail by Mikola Lysenko (@mikolalysenko) in #168
• fix(scan): honor --vendor-source in the vendored flow by Mikola Lysenko (@mikolalysenko) in #160
• fix(test): deflake update-notifier e2e on Windows CI (grace-budget race) by Mikola Lysenko (@mikolalysenko) in #171
• feat: promote maven and nuget to fully available — retire the SOCKET_EXPERIMENTAL_* gates by Mikola Lysenko (@mikolalysenko) in #170
• fix(vendor/pypi_uv): reconstruct [package.metadata] for path-sourced uv packages by Mikola Lysenko (@mikolalysenko) in #167
• fix(vendor): count skipped packages, not advisory warnings by Mikola Lysenko (@mikolalysenko) in #166
• fix(vendor): recover pypi wheels for pdm/poetry/pipenv, not just uv by Mikola Lysenko (@mikolalysenko) in #165
• fix(scan): keep hosted --json envelope schema-consistent across discovery by Mikola Lysenko (@mikolalysenko) in #163
• fix(scan): stop the false [UPDATE] nag for equal-or-older batch-ranked patches by Mikola Lysenko (@mikolalysenko) in #162
• fix(vendor): resolve installed packages via the qualified-purl-aware lookup by Mikola Lysenko (@mikolalysenko) in #157
• test(vendored): real-production e2e for scan --mode vendored across every package manager by Mikola Lysenko (@mikolalysenko) in #169
• fix(scan): warn when a mode takeover leaves the other ledger stale by Mikola Lysenko (@mikolalysenko) in #164
• fix(gem): bundler vendored+hosted audit — 13 confirmed bugs fixed, tests hardened by Mikola Lysenko (@mikolalysenko) in #175
• fix(vendor): match bun tuples on version, keep CRLF by Mikola Lysenko (@mikolalysenko) in #180
• fix(hosted): honest warnings for pnpm/yarn/bun and CRLF locks by Mikola Lysenko (@mikolalysenko) in #182
• fix(hosted): re-redirect stale bun.lock URLs, fail closed on drift by Mikola Lysenko (@mikolalysenko) in #186
• fix(vendor): accurate refusals for bundled/alias/CRLF lock shapes by Mikola Lysenko (@mikolalysenko) in #185
• fix(redirect): atomic fail-closed ledger, ledger-aware updates[] by Mikola Lysenko (@mikolalysenko) in #192
• fix(vendor): carry berry lock original across patch updates by Mikola Lysenko (@mikolalysenko) in #190
• fix(vendor): refuse catalo...

Contributors

What's Changed

• docs: consolidate global CLI options + document OpenVEX generation by Mikola Lysenko (@mikolalysenko) in #93
• feat(apply,scan): generate OpenVEX document inline via --vex by Mikola Lysenko (@mikolalysenko) in #94
• chore(deps): Bump tar from 0.4.45 to 0.4.46 by Dependabot (@dependabot)[bot] in #95
• chore(release): bump version to 3.3.0 by Mikola Lysenko (@mikolalysenko) in #96

Full Changelog: v3.2.0...v3.3.0

Contributors

What's Changed

• ci(release): adopt npm staged publishing via OIDC by Mikola Lysenko (@mikolalysenko) in #87
• refactor: dedupe ecosystem dispatch, telemetry, API client, cleanup, get by Mikola Lysenko (@mikolalysenko) in #88
• test(args): regression coverage for BoolishValueParser on env bools by Mikola Lysenko (@mikolalysenko) in #89
• feat(pypi): narrow/broad release breadth + multi-variant remove/rollback fixes by Mikola Lysenko (@mikolalysenko) in #90
• feat(gem,maven): extend multi-platform release patching to RubyGems + Maven by Mikola Lysenko (@mikolalysenko) in #91
• fix: repo-wide correctness, security & filesystem-safety hardening pass (v3.2.0) by Mikola Lysenko (@mikolalysenko) in #92

Full Changelog: v3.1.0...v3.2.0

Contributors

What's Changed

• fix: use npx/pnpm dlx @socketsecurity/socket-patch and add dependencies script by Mikola Lysenko (@mikolalysenko) in #63
• chore(deps): Bump quinn-proto from 0.11.13 to 0.11.14 by Dependabot (@dependabot)[bot] in #40
• chore(deps): Bump rand from 0.9.2 to 0.9.4 by Dependabot (@dependabot)[bot] in #65
• chore(deps): Bump rustls-webpki from 0.103.9 to 0.103.13 by Dependabot (@dependabot)[bot] in #66
• feat(patch): add package- and diff-level patch sources by Mikola Lysenko (@mikolalysenko) in #67
• test(cli): foundation for CLI-contract unit-test campaign by Mikola Lysenko (@mikolalysenko) in #68
• feat(scan): unified auto-update engine — --sync, --prune, --dry-run (v3.0) by Mikola Lysenko (@mikolalysenko) in #79
• feat(apply): safety hardening — atomicity, locking, pnpm CoW, sidecars, Maven gate by Mikola Lysenko (@mikolalysenko) in #80
• feat(vex): OpenVEX 0.2.0 attestation generator by Mikola Lysenko (@mikolalysenko) in #81
• feat: telemetry coverage for read-side commands + paid-tier fallback (3.1.0) by Mikola Lysenko (@mikolalysenko) in #82
• update release workflow by Mikola Lysenko (@mikolalysenko) in #84
• ci(release): tag after build + fix rustup toolchain setup by Mikola Lysenko (@mikolalysenko) in #85
• ci(release): pin newer cross NDK image for aarch64-linux-android by Mikola Lysenko (@mikolalysenko) in #86

New Contributors

• Dependabot (@dependabot)[bot] made their first contribution in #40

Full Changelog: v2.1.4...v3.1.0

Contributors

What's Changed

• fix: tolerate already-published npm packages in release workflow by Wenxin Jiang (@Wenxin-Jiang) in #61
• v2.1.4: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #62

Full Changelog: v2.1.3...v2.1.4

Contributors

What's Changed

• fix: pin Node 22.22.1 in release workflow by Wenxin Jiang (@Wenxin-Jiang) in #58
• v2.1.3: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #59

Full Changelog: v2.1.2...v2.1.3

Contributors

What's Changed

• Add explicit node types for TypeScript 6 compat by Jake Verbaten (@Raynos) in #51
• fix: harden core error handling, blob verification, and force-mode reporting by Wenxin Jiang (@Wenxin-Jiang) in #56
• fix: add apply diagnostics for silent no-op failures by Wenxin Jiang (@Wenxin-Jiang) in #53
• fix: surface crawler find_by_purls errors instead of swallowing by Wenxin Jiang (@Wenxin-Jiang) in #55
• fix: add error handling to get command for blob/decode failures by Wenxin Jiang (@Wenxin-Jiang) in #54
• v2.1.2: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #57

New Contributors

• Jake Verbaten (@Raynos) made their first contribution in #51

Full Changelog: v2.1.1...v2.1.2

Contributors