From 1bf05d92876622ad0b706a284dbab51ba1c3e3e5 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Tue, 13 Oct 2026 09:53:09 -0400 Subject: [PATCH] chore(release): bump to 5.0.1 with release notes v5.0.0 is already tagged and published (immutable), so its CHANGELOG section is restored to the tagged text. The 22 PRs this branch had folded into [5.0.0] (in the 5.0.0 build but missing from its notes) plus the 9 user-facing fixes merged since v5.0.0 go into a new [5.0.1] section. Version stamped with scripts/release.py stamp 5.0.1. Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 89 +++++++++++++++++++ Cargo.lock | 8 +- Cargo.toml | 4 +- npm/socket-patch-android-arm64/package.json | 2 +- npm/socket-patch-darwin-arm64/package.json | 2 +- npm/socket-patch-darwin-x64/package.json | 2 +- npm/socket-patch-linux-arm-gnu/package.json | 2 +- npm/socket-patch-linux-arm-musl/package.json | 2 +- npm/socket-patch-linux-arm64-gnu/package.json | 2 +- .../package.json | 2 +- npm/socket-patch-linux-ia32-gnu/package.json | 2 +- npm/socket-patch-linux-ia32-musl/package.json | 2 +- npm/socket-patch-linux-x64-gnu/package.json | 2 +- npm/socket-patch-linux-x64-musl/package.json | 2 +- npm/socket-patch-win32-arm64/package.json | 2 +- npm/socket-patch-win32-ia32/package.json | 2 +- npm/socket-patch-win32-x64/package.json | 2 +- npm/socket-patch/package-lock.json | 32 +++---- npm/socket-patch/package.json | 30 +++---- 19 files changed, 140 insertions(+), 51 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 146c55df9..e20a84a8b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,95 @@ a version without a non-empty section in this file. ## [Unreleased] +## [5.0.1] — 2026-10-13 + +A bug-fix release. Some of these fixes were already in the 5.0.0 build +but were missing from its notes; the PR numbers are listed below either way. + +### Fixed + +- **npm family.** + - Hosted mode leaves pnpm locks alone when pnpm's `lockfile` setting is + off (`lockfile=false`, `lockfile: false` or `package-lock=false`), since + pnpm then installs from the registry; it warns + `redirect_pnpm_lockfile_disabled` and suggests vendored mode, and + lock-only `vex` no longer attests those pins (#1074). + - pnpm settings from the environment are read the way the project's pnpm + major reads them (`npm_config_*` on pnpm 10 and older, `pnpm_config_*` + on 11 and newer). An `npx socket-patch scan --mode hosted` in a pnpm 11+ + project with an npm-era `package-lock=false` no longer refuses with a + false `redirect_pnpm_lockfile_disabled`, and `git-branch-lockfile` / + `shared-workspace-lockfile` are read the same way (#1460). + - Yarn Berry rollback / remove after a `yarn remove` in one workspace + member restore the registry entry keyed only by the descriptors still + declared, so `yarn install --immutable` passes (#1435). + - Vendored Yarn Berry `vendor --revert`, `rollback` and `remove` rebuild + the `yarn.lock` entry from the current lock instead of splicing back the + one recorded at vendor time, so a yarn 4.0 → 4.1+ checksum respelling or + a member adding or removing a descriptor no longer leaves a lock that + fails `yarn install --immutable` (YN0028) (#759). + - Hosted `rollback` and `remove` behind a registry mirror that passes npmjs + tarball URLs through keep Berry's `::__archiveUrl=` binding and pnpm's + `tarball:` field instead of dropping them (#1465). + - Hosted yarn classic rescans read the patched `package.json` of a pin + written by v4, so a patch that adds a dependency the lock never locked + is reported, and `vex` no longer attests `not_affected` while that + dependency is missing (#1462). + - `.yarnrc.yml` settings are read the way yarn reads them, including + `${VAR:-default}` and quoted YAML values, so a PnP project configured + through a variable is refused as PnP (#1100). + - Appending `allow-remote=all` to a CRLF `.npmrc` with no final newline + keeps its line endings intact (#1196). +- **Cargo.** + - Cargo source replacement (`[source.crates-io] replace-with` to a + directory source) is followed through every config cargo reads, so + agent mode patches, and `vex` / rollback judge, the copy cargo builds + from instead of assuming `/vendor`. A `vendor/` that no + `replace-with` wires is no longer crawled. Hosted mode skips every crate + when crates.io is replaced by an on-disk source + (`redirect_cargo_directory_source`) (#338, #455). + - Hosted mode pins a dependency declared with an explicit + `registry = "crates-io"` instead of skipping it (#386). +- **PyPI.** + - A Poetry dependency pinned to `source = "pypi"` is refused in a lock + written by Poetry 1.3–2.2, which can't install the rewired lock + (`redirect_poetry_lock_unsupported` / `pypi_poetry_source_constraint`); + other Poetry versions are rewired with a warning. Poetry 1.3 locks, + which carry no version stamp, are now recognized (#1282, #1447). + - Removing or upgrading the parent of a transitive uv package that hosted + mode pinned no longer locks the project out with + `hosted_wiring_contested`: the leftover override counts as Socket's own, + and `list` warns `hosted_resolution_orphaned` (#1445). + - Reverting a vendored PEP 723 script lock restores the `[manifest]` + specifier the script declares at revert time, not the one recorded when + vendoring, so `uv run --locked --script` keeps working (#869). + - The stale-install warning for a `--site-packages` Pipenv venv that + imports a package from its base interpreter suggests an install inside + the venv instead of the usual Pipenv remedy (#1450). + - Vendored Hatch refuses (`pypi_hatch_unsupported`) a checkout whose path + contains `%`, `#`, `;` or `?`, which Hatch's `{root:uri}` turns into a + broken file URL (#547). +- **RubyGems.** + - With `BUNDLE_GEMFILE` pointing into another directory (Appraisal-style + `gemfiles/rails_7.gemfile`), agent mode, `vex` and the stale-install + check probe the stores Bundler actually uses (#952). + - Vendored revert no longer half-reverts when the wired Gemfile line was + commented out (#988). +- **Composer.** + - `scan -g` and agent-mode scans find installs whose `vendor-dir` is set + in the global or another inherited config, not only the project's + `composer.json` (#439, #686). + - Global discovery finds a Composer 2 home in the XDG config dir even when + an old `~/.composer` directory remains (#586). +- **Go.** `vex` attests an applied agent-mode patch for a `+incompatible` + module instead of reporting `not_applied` (#484). +- **Vendoring.** `vendor --check` names the missing or changed artifact and + the step that fixes it, instead of printing an internal Rust value (#1467). + +### Maintenance + +- Release builds use one codegen unit, giving a smaller binary (#1449). + ## [5.0.0] — 2026-10-12 v5 centers the workflow on `scan` (hosted patches), `vex` (OpenVEX attestations), diff --git a/Cargo.lock b/Cargo.lock index 4d57d54b3..35faf6ba6 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1891,7 +1891,7 @@ checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" [[package]] name = "socket-patch-bench" -version = "5.0.0" +version = "5.0.1" dependencies = [ "base64", "clap", @@ -1910,7 +1910,7 @@ dependencies = [ [[package]] name = "socket-patch-cli" -version = "5.0.0" +version = "5.0.1" dependencies = [ "base64", "clap", @@ -1944,7 +1944,7 @@ dependencies = [ [[package]] name = "socket-patch-core" -version = "5.0.0" +version = "5.0.1" dependencies = [ "aho-corasick", "base64", @@ -1986,7 +1986,7 @@ dependencies = [ [[package]] name = "socket-patch-node" -version = "5.0.0" +version = "5.0.1" dependencies = [ "napi", "napi-build", diff --git a/Cargo.toml b/Cargo.toml index df6c364af..ff4d145d8 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -14,13 +14,13 @@ default-members = [ resolver = "2" [workspace.package] -version = "5.0.0" +version = "5.0.1" edition = "2021" license = "MIT" repository = "https://github.com/SocketDev/socket-patch" [workspace.dependencies] -socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.0" } +socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.1" } clap = { version = "=4.5.60", features = ["derive", "env"] } serde = { version = "=1.0.228", features = ["derive"] } serde_json = { version = "=1.0.149", features = ["preserve_order", "raw_value"] } diff --git a/npm/socket-patch-android-arm64/package.json b/npm/socket-patch-android-arm64/package.json index 97cc09d24..9864dab47 100644 --- a/npm/socket-patch-android-arm64/package.json +++ b/npm/socket-patch-android-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-android-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Android ARM64", "os": [ "android" diff --git a/npm/socket-patch-darwin-arm64/package.json b/npm/socket-patch-darwin-arm64/package.json index 62052f624..6c5cef673 100644 --- a/npm/socket-patch-darwin-arm64/package.json +++ b/npm/socket-patch-darwin-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-darwin-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for macOS ARM64", "os": [ "darwin" diff --git a/npm/socket-patch-darwin-x64/package.json b/npm/socket-patch-darwin-x64/package.json index 7bf94c87c..540f74c88 100644 --- a/npm/socket-patch-darwin-x64/package.json +++ b/npm/socket-patch-darwin-x64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-darwin-x64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for macOS x64", "os": [ "darwin" diff --git a/npm/socket-patch-linux-arm-gnu/package.json b/npm/socket-patch-linux-arm-gnu/package.json index 6cb1a85e2..9d5156389 100644 --- a/npm/socket-patch-linux-arm-gnu/package.json +++ b/npm/socket-patch-linux-arm-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm-musl/package.json b/npm/socket-patch-linux-arm-musl/package.json index 19e611d92..98c779b1f 100644 --- a/npm/socket-patch-linux-arm-musl/package.json +++ b/npm/socket-patch-linux-arm-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm64-gnu/package.json b/npm/socket-patch-linux-arm64-gnu/package.json index d29c560bb..752ada98c 100644 --- a/npm/socket-patch-linux-arm64-gnu/package.json +++ b/npm/socket-patch-linux-arm64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm64-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM64 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-arm64-musl/package.json b/npm/socket-patch-linux-arm64-musl/package.json index 04b5b1f32..c2317409f 100644 --- a/npm/socket-patch-linux-arm64-musl/package.json +++ b/npm/socket-patch-linux-arm64-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-arm64-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ARM64 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-ia32-gnu/package.json b/npm/socket-patch-linux-ia32-gnu/package.json index 009ed71d0..e9b93747f 100644 --- a/npm/socket-patch-linux-ia32-gnu/package.json +++ b/npm/socket-patch-linux-ia32-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-ia32-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ia32 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-ia32-musl/package.json b/npm/socket-patch-linux-ia32-musl/package.json index 0a6fb2e6a..c2357f9e1 100644 --- a/npm/socket-patch-linux-ia32-musl/package.json +++ b/npm/socket-patch-linux-ia32-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-ia32-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux ia32 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-linux-x64-gnu/package.json b/npm/socket-patch-linux-x64-gnu/package.json index ccf23d031..2790f998f 100644 --- a/npm/socket-patch-linux-x64-gnu/package.json +++ b/npm/socket-patch-linux-x64-gnu/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-x64-gnu", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux x64 (glibc)", "os": [ "linux" diff --git a/npm/socket-patch-linux-x64-musl/package.json b/npm/socket-patch-linux-x64-musl/package.json index 76e7a031a..58d717bc2 100644 --- a/npm/socket-patch-linux-x64-musl/package.json +++ b/npm/socket-patch-linux-x64-musl/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-linux-x64-musl", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Linux x64 (musl)", "os": [ "linux" diff --git a/npm/socket-patch-win32-arm64/package.json b/npm/socket-patch-win32-arm64/package.json index 747eb7bc5..ed1a96f5c 100644 --- a/npm/socket-patch-win32-arm64/package.json +++ b/npm/socket-patch-win32-arm64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-arm64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows ARM64", "os": [ "win32" diff --git a/npm/socket-patch-win32-ia32/package.json b/npm/socket-patch-win32-ia32/package.json index cdc357f6a..df3d1a3a4 100644 --- a/npm/socket-patch-win32-ia32/package.json +++ b/npm/socket-patch-win32-ia32/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-ia32", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows ia32", "os": [ "win32" diff --git a/npm/socket-patch-win32-x64/package.json b/npm/socket-patch-win32-x64/package.json index 340df8ee6..be495250b 100644 --- a/npm/socket-patch-win32-x64/package.json +++ b/npm/socket-patch-win32-x64/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch-win32-x64", - "version": "5.0.0", + "version": "5.0.1", "description": "socket-patch binary for Windows x64", "os": [ "win32" diff --git a/npm/socket-patch/package-lock.json b/npm/socket-patch/package-lock.json index 9dfd24de9..57c89b8a1 100644 --- a/npm/socket-patch/package-lock.json +++ b/npm/socket-patch/package-lock.json @@ -1,12 +1,12 @@ { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "license": "MIT", "dependencies": { "zod": "3.25.76" @@ -22,20 +22,20 @@ "node": ">=18.0.0" }, "optionalDependencies": { - "@socketsecurity/socket-patch-android-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-x64": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-musl": "5.0.0", - "@socketsecurity/socket-patch-win32-arm64": "5.0.0", - "@socketsecurity/socket-patch-win32-ia32": "5.0.0", - "@socketsecurity/socket-patch-win32-x64": "5.0.0" + "@socketsecurity/socket-patch-android-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-x64": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-musl": "5.0.1", + "@socketsecurity/socket-patch-win32-arm64": "5.0.1", + "@socketsecurity/socket-patch-win32-ia32": "5.0.1", + "@socketsecurity/socket-patch-win32-x64": "5.0.1" } }, "node_modules/@types/node": { diff --git a/npm/socket-patch/package.json b/npm/socket-patch/package.json index 7130a3bd3..c536f8554 100644 --- a/npm/socket-patch/package.json +++ b/npm/socket-patch/package.json @@ -1,6 +1,6 @@ { "name": "@socketsecurity/socket-patch", - "version": "5.0.0", + "version": "5.0.1", "description": "CLI tool and schema library for applying security patches to dependencies", "bin": { "socket-patch": "bin/socket-patch" @@ -49,19 +49,19 @@ "@types/node": "20.19.41" }, "optionalDependencies": { - "@socketsecurity/socket-patch-android-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-arm64": "5.0.0", - "@socketsecurity/socket-patch-darwin-x64": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.0", - "@socketsecurity/socket-patch-linux-x64-musl": "5.0.0", - "@socketsecurity/socket-patch-win32-arm64": "5.0.0", - "@socketsecurity/socket-patch-win32-ia32": "5.0.0", - "@socketsecurity/socket-patch-win32-x64": "5.0.0" + "@socketsecurity/socket-patch-android-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-arm64": "5.0.1", + "@socketsecurity/socket-patch-darwin-x64": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-arm64-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-ia32-musl": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-gnu": "5.0.1", + "@socketsecurity/socket-patch-linux-x64-musl": "5.0.1", + "@socketsecurity/socket-patch-win32-arm64": "5.0.1", + "@socketsecurity/socket-patch-win32-ia32": "5.0.1", + "@socketsecurity/socket-patch-win32-x64": "5.0.1" } }