Repository navigation
chore(release): 5.0.1 - #1485
Merged
Merged
Conversation
Every socket-patch npm package's trusted publisher is registered against release.yml, and npm allows only one publisher per package. The 5.0.0 release dispatched publish-npm.yml, whose OIDC token named that file, so npm rejected it with E401 before staging anything. Move the npm leg back inline as release.yml's npm-publish job (same steps as publish-npm.yml) and delete publish-npm.yml, so the existing registration keeps working. Add an `npm-retry-version` input that skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from an existing release's assets; this retries 5.0.0 now and replaces the manual Publish npm dispatch. crates.io stays dispatched through publish-cargo.yml, since crates.io allows several publishers per crate. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Cover the PRs merged to main after #1432's base (1779317..4cb3643): Cargo source replacement and registry = "crates-io" (#338/#455, #386), pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc ${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir cascade and global home (#439/#686, #586), Go +incompatible vex (#484), gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988), Poetry source = "pypi" (#1282) and Hatch path characters (#547). No entries for #1411 (macOS fix to code #1393 added in this release; the #1393 entry already describes the intended behavior), #1426 (perf regression introduced and fixed within 5.0.0) or the CI/test/bench PRs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9 (#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450, #1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452, #1454, #1457, #1459) have no entries. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Mikola Lysenko (mikolalysenko)
enabled auto-merge
October 13, 2026 14:14
This was referenced Oct 13, 2026
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Mikola Lysenko (mikolalysenko)
disabled auto-merge
October 13, 2026 14:50
Collaborator
Author
|
Final reviewer: disarmed auto-merge on 656c663 because The only failing job is Generated by Claude Code |
Tanmay Singla (Tanmay182003)
approved these changes
Oct 13, 2026
Wenxin Jiang (Wenxin-Jiang)
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One combined PR for the 5.0.1 release. It supersedes #1446 (5.0.0 notes) and #1483 (npm publish fix). Editing CHANGELOG.md is allowed here: this is the release PR.
Parts (one commit each)
release.yml, which is the filename the npm trusted publishers name.publish-npm.ymlis deleted, and Release gains annpm-retry-versioninput. crates.io still goes throughpublish-cargo.yml; its publisher is being fixed separately.[5.0.0]section now covers everything in thev5.0.0tag (6ad6add4a). That's the 22 PRs from chore(release): bump to 5.0.1 with release notes #1446 plus Fix crawl of --system-site-packages venvs (#409) #1419, Fix uv wiring under no-sources = true (#564) #1434, Fix bare scan/get converting hosted pins (#1437) #1440, Fix git-ignored bun.lockb workspace mirrors (#1116) #1442 and Fix unbounded registry lookups in upstream restore (#1220) #1444. The date stays 2026-10-12. CI/test-only PRs (CI: hermetic spawns in cli/covgap tests (#823) #1441, CI: test Maven 4 on 4.0.0-rc-7 (#267) #1443) have no entries.[Unreleased]fromgit log --first-parent 6ad6add4a..origin/main, which covers main through501c6d938(Reduce release build time and binary size #1449). I re-checked origin/main right before cutting and right before pushing; nothing newer had landed. Then I ranrelease.py changelog cut --version 5.0.1 --date 2026-10-13andversion-sync.sh 5.0.1.::__archiveUrl=binding when the project's mirror serves npmjs tarball URLs, so cold installs fetch a mirror path that 404s #1465, Vendored yarn berry revert restores the pre-vendor lock entry verbatim, so after upgrading from yarn 4.0.x it writes back a bare-hex checksum and everyyarn install --immutablefails YN0028 #759, Hosted pnpm scan refuses with redirect_pnpm_lockfile_disabled over env lockfile settings the project's pnpm major ignores (e.g. any pnpm 11/12 project run throughnpm execwith package-lock=false) #1460, Hosted yarn classic rescan and VEX accept a pin written by v4.0.0 whose patched package.json adds a dependency the lock doesn't have, so yarn installs the patched package without it #1462, Hosted uv: afteruv remove <parent>oruv lock --upgrade-package <parent>drops a hosted-pinned transitive package, its leftover override makes rollback, remove and list fail forever with hosted_wiring_contested #1445, Vendored uv script lock: after the user changes the vendored package's specifier in the PEP 723 block,vendor --revert/remove/rollbackwrite the stale==1.16.0back into<script>.py.lock, souv run --lockedfails (exit 0) #869, The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite asource = "pypi"dependency andpoetry install1.3 fails with a solver error #1447, Pipenv stale-install remedy can't replace a base-interpreter copy in a--site-packagesvenv:pip uninstallrefuses it andpipenv synckeeps it, so following the warning leaves the package unpatched #1450, vendor --check reports a missing or corrupt vendored artifact as a raw Rust Debug value (Corrupt { reason: "vendor_workspace_artifact_missing" }) with no remedy, thoughsocket-patch repairfixes it #1467.Checks
scripts/release-lint.sh --stable-only --tag-check: all checks passed ([5.0.1]has 11 entries, and there is nov5.0.1tag).release.py changelog checkpasses for 5.0.1 and 5.0.0.test_release.ChangelogTests: OK.actionlint .github/workflows/release.yml: clean.cargo check --lockedwith a privateCARGO_TARGET_DIR: OK. The lockfile diff only restamps the version.After merge, dispatch Release on
main. Don't start it from this PR.🤖 Generated with Claude Code
Note
Medium Risk
Changes the production npm release path and OIDC workflow identity; mistakes could block or mis-publish packages, though staging, idempotent skips, and digest checks limit blast radius.
Overview
5.0.1 release train: workspace and all
@socketsecurity/socket-patch*npm packages bump 5.0.0 → 5.0.1, with a new[5.0.1]changelog (fixes since v5.0.0 tag, lead note that npm/crates.io never got 5.0.0) and a fuller[5.0.0]section aligned with the tagged release.npm publishing is folded into
release.yml:publish-npm.ymlis deleted and the former dispatch leg becomes an inlinenpm-publishjob (OIDC trusted publisher is registered onrelease.yml). Release gainsnpm-retry-versionto skip build/tag/GitHub release/crates.io and re-stage npm from an existing release’s assets;cargo-publishstill dispatchespublish-cargo.yml. Concurrency, SHA256SUMS pinning, and staged-publish behavior move with the job.docs/releasing.md,scripts/dispatch-publish.sh, and a CI comment are updated accordingly.Reviewed by Cursor Bugbot for commit 656c663. Configure here.