diff --git a/CHANGELOG.md b/CHANGELOG.md index 146c55df9..e20a84a8b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,95 @@ a version without a non-empty section in this file. ## [Unreleased] +## [5.0.1] — 2026-10-13 + +A bug-fix release. Some of these fixes were already in the 5.0.0 build +but were missing from its notes; the PR numbers are listed below either way. + +### Fixed + +- **npm family.** + - Hosted mode leaves pnpm locks alone when pnpm's `lockfile` setting is + off (`lockfile=false`, `lockfile: false` or `package-lock=false`), since + pnpm then installs from the registry; it warns + `redirect_pnpm_lockfile_disabled` and suggests vendored mode, and + lock-only `vex` no longer attests those pins (#1074). + - pnpm settings from the environment are read the way the project's pnpm + major reads them (`npm_config_*` on pnpm 10 and older, `pnpm_config_*` + on 11 and newer). An `npx socket-patch scan --mode hosted` in a pnpm 11+ + project with an npm-era `package-lock=false` no longer refuses with a + false `redirect_pnpm_lockfile_disabled`, and `git-branch-lockfile` / + `shared-workspace-lockfile` are read the same way (#1460). + - Yarn Berry rollback / remove after a `yarn remove` in one workspace + member restore the registry entry keyed only by the descriptors still + declared, so `yarn install --immutable` passes (#1435). + - Vendored Yarn Berry `vendor --revert`, `rollback` and `remove` rebuild + the `yarn.lock` entry from the current lock instead of splicing back the + one recorded at vendor time, so a yarn 4.0 → 4.1+ checksum respelling or + a member adding or removing a descriptor no longer leaves a lock that + fails `yarn install --immutable` (YN0028) (#759). + - Hosted `rollback` and `remove` behind a registry mirror that passes npmjs + tarball URLs through keep Berry's `::__archiveUrl=` binding and pnpm's + `tarball:` field instead of dropping them (#1465). + - Hosted yarn classic rescans read the patched `package.json` of a pin + written by v4, so a patch that adds a dependency the lock never locked + is reported, and `vex` no longer attests `not_affected` while that + dependency is missing (#1462). + - `.yarnrc.yml` settings are read the way yarn reads them, including + `${VAR:-default}` and quoted YAML values, so a PnP project configured + through a variable is refused as PnP (#1100). + - Appending `allow-remote=all` to a CRLF `.npmrc` with no final newline + keeps its line endings intact (#1196). +- **Cargo.** + - Cargo source replacement (`[source.crates-io] replace-with` to a + directory source) is followed through every config cargo reads, so + agent mode patches, and `vex` / rollback judge, the copy cargo builds + from instead of assuming `/vendor`. A `vendor/` that no + `replace-with` wires is no longer crawled. Hosted mode skips every crate + when crates.io is replaced by an on-disk source + (`redirect_cargo_directory_source`) (#338, #455). + - Hosted mode pins a dependency declared with an explicit + `registry = "crates-io"` instead of skipping it (#386). +- **PyPI.** + - A Poetry dependency pinned to `source = "pypi"` is refused in a lock + written by Poetry 1.3–2.2, which can't install the rewired lock + (`redirect_poetry_lock_unsupported` / `pypi_poetry_source_constraint`); + other Poetry versions are rewired with a warning. Poetry 1.3 locks, + which carry no version stamp, are now recognized (#1282, #1447). + - Removing or upgrading the parent of a transitive uv package that hosted + mode pinned no longer locks the project out with + `hosted_wiring_contested`: the leftover override counts as Socket's own, + and `list` warns `hosted_resolution_orphaned` (#1445). + - Reverting a vendored PEP 723 script lock restores the `[manifest]` + specifier the script declares at revert time, not the one recorded when + vendoring, so `uv run --locked --script` keeps working (#869). + - The stale-install warning for a `--site-packages` Pipenv venv that + imports a package from its base interpreter suggests an install inside + the venv instead of the usual Pipenv remedy (#1450). + - Vendored Hatch refuses (`pypi_hatch_unsupported`) a checkout whose path + contains `%`, `#`, `;` or `?`, which Hatch's `{root:uri}` turns into a + broken file URL (#547). +- **RubyGems.** + - With `BUNDLE_GEMFILE` pointing into another directory (Appraisal-style + `gemfiles/rails_7.gemfile`), agent mode, `vex` and the stale-install + check probe the stores Bundler actually uses (#952). + - Vendored revert no longer half-reverts when the wired Gemfile line was + commented out (#988). +- **Composer.** + - `scan -g` and agent-mode scans find installs whose `vendor-dir` is set + in the global or another inherited config, not only the project's + `composer.json` (#439, #686). + - Global discovery finds a Composer 2 home in the XDG config dir even when + an old `~/.composer` directory remains (#586). +- **Go.** `vex` attests an applied agent-mode patch for a `+incompatible` + module instead of reporting `not_applied` (#484). +- **Vendoring.** `vendor --check` names the missing or changed artifact and + the step that fixes it, instead of printing an internal Rust value (#1467). + +### Maintenance + +- Release builds use one codegen unit, giving a smaller binary (#1449). + ## [5.0.0] — 2026-10-12 v5 centers the workflow on `scan` (hosted patches), `vex` (OpenVEX attestations), diff --git a/Cargo.lock b/Cargo.lock index 4d57d54b3..35faf6ba6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1891,7 +1891,7 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" [[package]] name = "socket-patch-bench" -version = "5.0.0" +version = "5.0.1" dependencies = [ "base64", "clap", @@ -1910,7 +1910,7 @@ dependencies = [ [[package]] name = "socket-patch-cli" -version = "5.0.0" +version = "5.0.1" dependencies = [ "base64", "clap", @@ -1944,7 +1944,7 @@ dependencies = [ [[package]] name = "socket-patch-core" -version = "5.0.0" +version = "5.0.1" dependencies = [ "aho-corasick", "base64", @@ -1986,7 +1986,7 @@ dependencies = [ [[package]] name = "socket-patch-node" -version = "5.0.0" +version = "5.0.1" dependencies = [ "napi", "napi-build", diff --git a/Cargo.toml b/Cargo.toml index df6c364af..ff4d145d8 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -14,13 +14,13 @@ default-members = [ resolver = "2" [workspace.package] -version = "5.0.0" +version = "5.0.1" edition = "2021" license = "MIT" repository = "https://github.com/SocketDev/socket-patch" [workspace.dependencies] -socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.0" } +socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.1" } clap = { version = "=4.5.60", features = ["derive", "env"] } serde = { version = "=1.0.228", features = ["derive"] } serde_json = { version = "=1.0.149", features = ["preserve_order", "raw_value"] } diff --git a/npm/socket-patch-android-arm64/package.json b/npm/socket-patch-android-arm64/package.json index 97cc09d24..9864dab47 100644 --- a/npm/socket-patch-android-arm64/package.json +++ b/npm/socket-patch-android-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-android-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Android ARM64", "os": [ "android" diff --git a/npm/socket-patch-darwin-arm64/package.json b/npm/socket-patch-darwin-arm64/package.json index 62052f624..6c5cef673 100644 --- a/npm/socket-patch-darwin-arm64/package.json +++ b/npm/socket-patch-darwin-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-darwin-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for macOS ARM64", "os": [ "darwin" diff --git a/npm/socket-patch-darwin-x64/package.json b/npm/socket-patch-darwin-x64/package.json index 7bf94c87c..540f74c88 100644 --- a/npm/socket-patch-darwin-x64/package.json +++ b/npm/socket-patch-darwin-x64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-darwin-x64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for macOS x64", "os": [ "darwin" diff --git a/npm/socket-patch-linux-arm-gnu/package.json b/npm/socket-patch-linux-arm-gnu/package.json index 6cb1a85e2..9d5156389 100644 --- a/npm/socket-patch-linux-arm-gnu/package.json +++ b/npm/socket-patch-linux-arm-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm-musl/package.json b/npm/socket-patch-linux-arm-musl/package.json index 19e611d92..98c779b1f 100644 --- a/npm/socket-patch-linux-arm-musl/package.json +++ b/npm/socket-patch-linux-arm-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm64-gnu/package.json b/npm/socket-patch-linux-arm64-gnu/package.json index d29c560bb..752ada98c 100644 --- a/npm/socket-patch-linux-arm64-gnu/package.json +++ b/npm/socket-patch-linux-arm64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm64-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM64 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm64-musl/package.json b/npm/socket-patch-linux-arm64-musl/package.json index 04b5b1f32..c2317409f 100644 --- a/npm/socket-patch-linux-arm64-musl/package.json +++ b/npm/socket-patch-linux-arm64-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm64-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM64 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-ia32-gnu/package.json b/npm/socket-patch-linux-ia32-gnu/package.json index 009ed71d0..e9b93747f 100644 --- a/npm/socket-patch-linux-ia32-gnu/package.json +++ b/npm/socket-patch-linux-ia32-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-ia32-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ia32 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-ia32-musl/package.json b/npm/socket-patch-linux-ia32-musl/package.json index 0a6fb2e6a..c2357f9e1 100644 --- a/npm/socket-patch-linux-ia32-musl/package.json +++ b/npm/socket-patch-linux-ia32-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-ia32-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ia32 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-x64-gnu/package.json b/npm/socket-patch-linux-x64-gnu/package.json index ccf23d031..2790f998f 100644 --- a/npm/socket-patch-linux-x64-gnu/package.json +++ b/npm/socket-patch-linux-x64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-x64-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux x64 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-x64-musl/package.json b/npm/socket-patch-linux-x64-musl/package.json index 76e7a031a..58d717bc2 100644 --- a/npm/socket-patch-linux-x64-musl/package.json +++ b/npm/socket-patch-linux-x64-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-x64-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux x64 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-win32-arm64/package.json b/npm/socket-patch-win32-arm64/package.json index 747eb7bc5..ed1a96f5c 100644 --- a/npm/socket-patch-win32-arm64/package.json +++ b/npm/socket-patch-win32-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows ARM64", "os": [ "win32" diff --git a/npm/socket-patch-win32-ia32/package.json b/npm/socket-patch-win32-ia32/package.json index cdc357f6a..df3d1a3a4 100644 --- a/npm/socket-patch-win32-ia32/package.json +++ b/npm/socket-patch-win32-ia32/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-ia32", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows ia32", "os": [ "win32" diff --git a/npm/socket-patch-win32-x64/package.json b/npm/socket-patch-win32-x64/package.json index 340df8ee6..be495250b 100644 --- a/npm/socket-patch-win32-x64/package.json +++ b/npm/socket-patch-win32-x64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-x64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows x64", "os": [ "win32" diff --git a/npm/socket-patch/package-lock.json b/npm/socket-patch/package-lock.json index 9dfd24de9..57c89b8a1 100644 --- a/npm/socket-patch/package-lock.json +++ b/npm/socket-patch/package-lock.json @@ -1,12 +1,12 @@ { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "license": "MIT", "dependencies": { "zod": "3.25.76" @@ -22,20 +22,20 @@ "node": ">=18.0.0" }, "optionalDependencies": { - "@socketsecurity/socket-patch-android-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-x64": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-musl": "5.0.0", - "@socketsecurity/socket-patch-win32-arm64": "5.0.0", - "@socketsecurity/socket-patch-win32-ia32": "5.0.0", - "@socketsecurity/socket-patch-win32-x64": "5.0.0" + "@socketsecurity/socket-patch-android-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-x64": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-musl": "5.0.1", + "@socketsecurity/socket-patch-win32-arm64": "5.0.1", + "@socketsecurity/socket-patch-win32-ia32": "5.0.1", + "@socketsecurity/socket-patch-win32-x64": "5.0.1" } }, "node_modules/@types/node": { diff --git a/npm/socket-patch/package.json b/npm/socket-patch/package.json index 7130a3bd3..c536f8554 100644 --- a/npm/socket-patch/package.json +++ b/npm/socket-patch/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "description": "CLI tool and schema library for applying security patches to dependencies", "bin": { "socket-patch": "bin/socket-patch" @@ -49,19 +49,19 @@ "@types/node": "20.19.41" }, "optionalDependencies": { - "@socketsecurity/socket-patch-android-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-x64": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-musl": "5.0.0", - "@socketsecurity/socket-patch-win32-arm64": "5.0.0", - "@socketsecurity/socket-patch-win32-ia32": "5.0.0", - "@socketsecurity/socket-patch-win32-x64": "5.0.0" + "@socketsecurity/socket-patch-android-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-x64": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-musl": "5.0.1", + "@socketsecurity/socket-patch-win32-arm64": "5.0.1", + "@socketsecurity/socket-patch-win32-ia32": "5.0.1", + "@socketsecurity/socket-patch-win32-x64": "5.0.1" } }