chore(release): 5.1.0 by mikolalysenko · Pull Request #2032 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-11-06T16:03:05Z

Release 5.1.0

Version: 5.1.0 (minor). The notes have an ### Added section (agent-mode gem native-extension rebuild) and no Breaking or Removed entries. Per the CHANGELOG header rule, that makes this a minor release.

Covered range: v5.0.1..7bde3ba55a84e64281372ebc4fd53e7fab0e35fd: 50 first-parent PRs. That is far fewer than the ~300 commits the routine expected; the count is from git log --first-parent.

This PR changes only CHANGELOG.md and the files scripts/version-sync.sh 5.1.0 stamps (Cargo.toml, Cargo.lock, the 15 npm package.json files, the npm lockfile). Local checks: release-lint.sh --stable-only --tag-check passed, release.py changelog check --version 5.1.0 passed, and cargo check --locked passed.

Headline: Ruby native-extension patching (#1996, #1998)

When agent-mode apply (or scan/get --mode agent) patches a gem whose patch changes native-extension sources (ext/**/*.c, extconf.rb, …), it now rebuilds the extensions with RubyGems' own builder (the gem pristine --extensions step). It uses the Ruby that owns the gem home and rebuilds both the extensions/<platform>/<abi>/ copy and the lib/ copy, so Ruby stops loading the stale install-time build.

If the build fails, the original sources and build are restored (native_extension_build_failed).
A copy that can't be rebuilt in place is refused before anything is written (native_extensions_unsupported).
vex and apply --check attest the patch only once the rebuild is recorded; otherwise they report native_extension_not_rebuilt.
rollback/remove restore the original build.
--no-gem-native-rebuild (env SOCKET_NO_GEM_NATIVE_REBUILD) opts out for callers that compile the extension themselves.

These claims were checked against CLI_CONTRACT.md and args.rs.

Left out of the notes

Every merged PR is referenced, but these appear only in two condensed Maintenance bullets because they don't change user-visible behavior:

18 refactor sweeps, which state "output/behavior unchanged".
The Poetry/PDM lock-driver consolidation (Share one lock_fragments driver for PDM and Poetry (#1844) #1898).
10 test/CI-infrastructure PRs.

For a maintainer to double-check

The routine prompt mentioned CRLF Gemfile/Gemfile.lock, gemspec dev deps, and hosted/vendored gem-block fixes. Of those, only gemspec dev deps (Read gemspec directives and dev deps as Ruby code (#1932) #1936) and Bundler 4.1 overrides (Fix gem restore of Bundler 4.1 override targets (#1989) #1991) are in this range. The others either shipped earlier or are still open (e.g. Fix nightly gem e2e: attribute nested Gemfile source blocks #1999), so they are not in these notes.
Sweep scan/discovery.rs #1884 (a "sweep") and One serve GET and one vendor retry loop in api/client.rs (#1869) #1870 (an API client consolidation) carry small user-visible changes: Windows/% quoting of the nested-project remedy, and uniform download-error wording plus --debug logging. Both are listed under Fixed → General.
The new warnings redirect_npm_omit_lockfile_registry_resolved (Fix hosted npm ignoring omit-lockfile-registry-resolved (#1871) #1872) and redirect_pypi_no_lockfile (Fix silent PyPI hosted scan with no lockfile (#638) #1885), and the new refusal pypi_requirement_env_templated (Fix templated pip pins ignored beside pylock (#1873) #1874), are filed under Fixed because they close silent-failure cases. They could arguably go under Added; doing so would not change the version.

Maintainer checklist

Approve this PR.
After merge, confirm nothing else landed: git log --first-parent 7bde3ba55a84e64281372ebc4fd53e7fab0e35fd..origin/main (if something did, add notes first).
Actions → Release → Run workflow on main (optionally a dry-run: true run first).
Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

Generated by Claude Code

Note

Low Risk
Version and changelog-only release prep; no runtime code changes in this diff.

Overview
Cuts socket-patch 5.1.0: bumps the workspace and crate versions in Cargo.toml / Cargo.lock, and stamps 5.1.0 on the main npm package, all platform optionalDependencies, and package-lock.json (lockfile trimmed to root + @types/node only).

Documents the release in CHANGELOG.md with a new ## [5.1.0] — 2026-11-06 section: Added highlights agent-mode RubyGems rebuilds of native extensions (gem pristine–style) with new warnings/codes and --no-gem-native-rebuild; Fixed spans Bundler 4.1 overrides, gemspec parsing, pnpm/yarn/Bun/npm edge cases, PyPI/Pipenv/Poetry, Go replace correctness, Maven 4 implicit reactor, vendoring dry runs and refusals, and misc download/remedy behavior; Maintenance notes internal consolidation and CI/test work.

^{Reviewed by Cursor Bugbot for commit c6ef370. Configure here.}

Generated by Claude Code

Roll the notes for the 50 PRs merged since v5.0.1 into a 5.1.0 section and stamp 5.1.0 into every packaging site. Minor bump: gem native extension rebuild in agent mode is new behavior (#1996, #1998). Co-Authored-By: Claude <noreply@anthropic.com>

socket-security · 2026-11-06T16:04:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/@socketsecurity/socket-patch-android-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-ia32@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A

View full report

socket-security-staging · 2026-11-06T16:05:33Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/@socketsecurity/socket-patch-android-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-ia32@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A

View full report

Mikola Lysenko (mikolalysenko) · 2026-11-06T16:07:29Z

CI red that isn't caused by this PR: the e2e (ubuntu-latest, e2e_vex_build, … pdm:: --ignored …) check fails.

pdm lock crashes with [AttributeError]: module 'hishel' has no attribute 'SyncSqliteStorage'. A new hishel 2.x release breaks PDM, and both pdm::*_install_then_manifest_less_vex tests fail with it. This PR changes only CHANGELOG.md and the version stamps, so it can't cause this, and PDM's dependencies aren't pinned, so re-running the job would fail the same way. The same failure is red on other PRs right now.

The fix is open as #2028 (ci-janitor/pdm-hishel-2, pins hishel<2). This release PR is limited to the changelog and version files, so I haven't ported that change here. Once #2028 merges, merge main into release/v5.1.0 (or update the branch) so CI runs again. Auto-merge is still armed.

Generated by a one-off release-staging routine.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-11-06T17:12:58Z

Labeled Ready for review by the burn-down agent.

Head: c6ef370ca6ca49ad5b1b4ba66fa3287a73bbad17
CI: 48/50 check runs green (29 success, 19 skipped). The two red ones come from a failure that also hits main: e2e (ubuntu-latest, e2e_vex_build, … pdm:: --ignored …) and the ci-ok aggregate that depends on it. pdm lock crashes because hishel 2.x removed SyncSqliteStorage. The pdm e2e is red on main too (e2e-macos … pdm:: at 7bde3ba). Fix pdm e2e red on every PR: pin hishel<2 #2028 fixes it.
Bugbot: reviewed this head with no findings.
For the reviewer: it changes only CHANGELOG.md, the version stamps and the lockfiles. Auto-merge is still armed. If you want this PR fully green before you approve, merge Fix pdm e2e red on every PR: pin hishel<2 #2028 first and update this branch.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-11-06T19:51:01Z

Final review brief (for the human approver)

What it does: cuts release 5.1.0. It adds a ## [5.1.0] section to CHANGELOG.md and stamps 5.1.0 into Cargo.toml, Cargo.lock and the 15 npm package.json files plus the npm lockfile. No Rust or JS code changes.

Risk: low. The diff touches only version stamps and the changelog. The real risk is in the release workflow you run after merging, not in this diff.

Look here

CHANGELOG.md:26: the new section. ### Added (gem native-extension rebuild, Agent-mode apply reports gem native-extension patches as applied without rebuilding #1996/Rebuild gem native extensions in agent-mode apply (#1996) #1998) is why this is a minor bump.
CHANGELOG.md:133 and :87: the judgment calls the PR body flags (sweeps with small visible changes; new warnings filed under Fixed rather than Added).
Cargo.toml:17: workspace version, and the =5.1.0 core pin on line 23.
npm/socket-patch/package-lock.json: the 14 platform package entries are gone. version-sync.sh does that on purpose, because 5.1.0 isn't published yet, and release.yml runs npm install rather than npm ci for this reason.

Verified

Base is current main (7bde3ba, Rebuild gem native extensions in agent-mode apply (#1996) #1998). No commits have landed on main since then.
Every PR merged on main since 5.0.1 (in the history I checked) is referenced in the notes. The only unreferenced numbers were issue numbers whose PRs are listed (Drive pdm.lock and poetry.lock rewrites through one lock_fragments driver instead of two mirrored triads #1844→Share one lock_fragments driver for PDM and Poetry (#1844) #1898, Share one scoped env-var test guard: EnvGuard is copy-pasted 11 times across core unit and integration tests #1889→Build: share one test env guard in core (#1889) #1891, Build every tests/apply fixture through apply_fixture: 9 suites in the apply binary re-write the manifest, blob, package and event-lookup helpers it already has #1941→Build tests/apply fixtures through apply_fixture (#1941) #1944, Run PTY test children through one common::pty_io::run: the openpty-spawn-feed-collect runner is copied 7×, and only 2 copies pin TERM #1942→Run PTY test children through one pty_io::run (#1942) #1955).
Every version stamp is consistent at 5.1.0. CHANGELOG changes are allowed here because this is a release/v* branch.
CI: 48/50 green. The two red checks are the pdm e2e leg and the ci-ok aggregate that depends on it. That failure comes from hishel 2.x breaking pdm lock on every branch, main included, and it isn't caused by this PR. The fix is Fix pdm e2e red on every PR: pin hishel<2 #2028.
Bugbot: reviewed this head, no findings.

Changes I made: none.

Open questions: none blocking. Merge #2028 first so this PR (and the rest of the open PRs) can go green. Auto-merge isn't armed: this PR doesn't qualify until ci-ok is green.

Generated by Claude Code

chore(release): 5.1.0

c6ef370

Roll the notes for the 50 PRs merged since v5.0.1 into a 5.1.0 section and stamp 5.1.0 into every packaging site. Minor bump: gem native extension rebuild in agent mode is new behavior (#1996, #1998). Co-Authored-By: Claude <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) enabled auto-merge November 6, 2026 16:03

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Nov 6, 2026

Mikola Lysenko (mikolalysenko) disabled auto-merge November 6, 2026 17:50

Navigation Menu

Repository navigation

chore(release): 5.1.0 - #2032

chore(release): 5.1.0#2032
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
release/v5.1.0

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 6, 2026

Uh oh!

socket-security-staging Bot commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 5.1.0

Headline: Ruby native-extension patching (#1996, #1998)

Left out of the notes

For a maintainer to double-check

Maintainer checklist

Uh oh!

socket-security Bot commented Nov 6, 2026

Uh oh!

socket-security-staging Bot commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Final review brief (for the human approver)

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 •

edited

Loading