[Mikola Lysenko (mikolalysenko)]

Follow-up to #2033: two PRs merged while it was in the merge queue

#2010 and #2025 landed on main while #2033 was queued. They ship in 5.1.0, so they need entries before Release is dispatched. With this PR, the 5.1.0 notes cover main through 568e376 (#2031 added by the final reviewer; #2002, #2034, #2035, #2037 need no note).

This PR changes only CHANGELOG.md (inside ## [5.1.0]), and the version stays 5.1.0.

PR	Section	Note
#2010	Fixed → npm family	vex no longer attests pnpm pins under gitBranchLockfile (vex_pnpm_git_branch_lockfile), nor npm or Bun packages the project patches itself (vex_npm_patched_dependency)
#2025	Fixed → General	Workspace runs never read or rewrite files outside the git repository root. There are new refusals (redirect_cargo_config_outside_root, redirect_nuget_inherited_config_outside_root, pypi_requirements_outside_root), and vendored writers only claim .socket/vendor/ paths anchored at this project. Global runs and projects outside a checkout are unchanged

Double-check: #2025 changes behavior for projects whose workspace root or settings live above the git root, which are now refused or withheld. It could arguably go under ### Changed. The version stays minor either way. All five codes are documented in CLI_CONTRACT.md on main.

Local checks: release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 both passed.

Maintainer checklist

• Approve and merge this PR before dispatching Release.
• After merge, confirm nothing else landed: git log --first-parent 568e376..origin/main, ignoring this PR's own merge commit.
• Actions → Release → Run workflow on main (optionally a dry-run: true run first).
• Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

---

Note

Low Risk
Documentation-only CHANGELOG.md edits with no runtime or packaging changes.

Overview
Updates the 5.1.0 section in CHANGELOG.md so release notes match main through the planned cut (including items that landed while a prior notes PR was queued).

The new Fixed bullets document shipped behavior: vex withholding for npm-family pins writers already refuse (#2010); broader Go go.work / hosted-engine workspace handling (#2011, #2031); and General git-root scoping that refuses or withholds out-of-repo workspace/config reads and anchors vendored paths (#2025, with the new redirect_* / pypi_requirements_outside_root codes).

Maintenance notes now mention consolidating the Socket-origin classifier (#2002) and recent test/CI fixes (#2034, #2035, #2037). No code or version bump—release prep only.

^{Reviewed by Cursor Bugbot for commit 999e5e8. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review at 16af5bbccc351c6956773ed5e7d533e98eb28a93.

• CI: 31/31 checks pass (plus 19 skipped). No failures.
• Bugbot reviewed 16af5bb and found nothing. There are no open review threads.
• This is a release PR, so its CHANGELOG.md change is expected: it adds 15 lines inside ## [5.1.0], for Stop attesting npm-family pins pnpm or a user patch overrides #2010 and Never read or rewrite project files outside the git repository root #2025. Auto-merge is already armed, so approving the PR sends it to the queue.
• For the reviewer: check whether Never read or rewrite project files outside the git repository root #2025 belongs under ### Changed instead of ### Fixed, as the description asks.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review: the 5.1.0 notes were missing #2031, so I pushed fabe76f to add it.

#2031 (Keep the in-memory hosted engine off the disk for Go workspaces) merged on main at 01:23 UTC, which is after the f5b03744 cut-off this PR was written against. It changes Go behavior users can see:

• It finishes the go.work handling that Read the governing go.work in Go discovery #2011 started. A replace the workspace bypasses stays visible to list, rollback and remove. A root go.work replace that go never reads no longer withholds the root go.mod's copy of it. I added #2031 to the existing Read the governing go.work in Go discovery #2011 bullet.
• The in-memory hosted engine no longer checks the process's working directory when it judges a Go workspace. I added a new Go bullet for this.

The other PRs merged after f5b03744 don't need a note. #2002 states "No product code changes". #2034, #2035 and #2037 only touch tests and CI.

I re-ran release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 locally, and both pass. Because the head changed, I turned off auto-merge and removed Ready for review. The burn-down will add the label back once CI is green, and I'll post a review brief on the next pass. The open question about filing #2025 under ### Changed or ### Fixed is still for the approver.

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Five more PRs merged to main after this PR was opened. Another session added the #2031 note (fabe76f3). I kept that commit and pushed two more on top of it:

• merged the latest main (568e376b) into this branch, since fabe76f3 was based on the older head;
• listed the four non-user-visible PRs under Maintenance: Move the Socket origin classifier into one module #2002 (origin classifier moved, no behavior change), Let the pdm e2e bootstrap install pdm 2.29.4+ #2034, Fix Windows-only scala_cli liveness test failure in nightly #2035 and Make NuGet walk tests ignore the host package cache #2037 (test fixes).

release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md. The 5.1.0 notes now cover main through 568e376b. Auto-merge is off. After you approve, merge by hand or re-arm it, then check git log --first-parent 568e376b..origin/main before you dispatch Release.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 999e5e8. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 999e5e847b56cd685110745ee095a97a008927d5.

• CI: 31/31 checks pass (30 CI + Cursor Bugbot), 19 skipped. No failures, no main-wide failures.
• Bugbot reviewed 999e5e8 and found nothing; no open review threads.
• Release PR: it only changes CHANGELOG.md (the 5.1.0 notes, now including Keep the in-memory hosted engine off the disk for Go workspaces #2031). Mergeable; waiting only on a human approval.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Release-notes-only PR for 5.1.0: it adds CHANGELOG.md entries for every PR merged to main since the last notes update (#2010, #2025, #2031, #2002, #2034, #2035, #2037). It changes no code.

Risk: low. One file, documentation only. It is a release/v* branch, so the CHANGELOG edit is allowed.

Look here

• CHANGELOG.md:103-106: Stop attesting npm-family pins pnpm or a user patch overrides #2010, the npm-family vex withholds
• CHANGELOG.md:134-144: Read the governing go.work in Go discovery #2011 extended with Keep the in-memory hosted engine off the disk for Go workspaces #2031 (Go workspace)
• CHANGELOG.md:203-213: Never read or rewrite project files outside the git repository root #2025, the git-root boundary. This is the most user-visible change in the batch.
• CHANGELOG.md:233-236: Maintenance (Move the Socket origin classifier into one module #2002 and the test fixes)

Verified

• Every PR on main since the previous notes PR (chore(release): 5.1.0 notes for PRs merged during review #2033) has an entry. main head is 568e376 (Move the Socket origin classifier into one module #2002).
• Each new reason code named in the notes exists in crates/ on this head: vex_pnpm_git_branch_lockfile, vex_npm_patched_dependency, redirect_cargo_config_outside_root, redirect_nuget_inherited_config_outside_root, pypi_requirements_outside_root, go_workspace_override.
• scripts/release-lint.sh 5.1.0 passes locally: version coherence, npm lock, and a [5.1.0] section with 12 entries.
• CI: 31/31 pass, 19 skipped. Bugbot found no issues on 999e5e8. There are no review threads.

Changes I made: none.

Open questions: The section is still dated 2026-11-06. If the tag is cut on a later day, the release agent may want to update the date.

Auto-merge is armed, so approving sends this PR straight to the merge queue.

---

Generated by Claude Code