From 16af5bbccc351c6956773ed5e7d533e98eb28a93 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 01:04:54 +0000 Subject: [PATCH 1/3] chore(release): add 5.1.0 notes for #2010 and #2025 Both merged to main while #2033 was in the merge queue and ship in 5.1.0. Co-Authored-By: Claude --- CHANGELOG.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1ad320219..09fcbeb0e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -100,6 +100,10 @@ a version without a non-empty section in this file. instead of withholding them as offline (#2013). - The lock inventory skips Rush subspace locks with unsafe names, as lockfile discovery already did (#2003). + - `vex` no longer attests npm-family pins the hosted and vendored writers + refuse: pnpm pins while `gitBranchLockfile` is on and a branch lock + exists (`vex_pnpm_git_branch_lockfile`), and npm or Bun packages the + project patches itself (`vex_npm_patched_dependency`) (#2010). - **PyPI.** - A requirements line pinned through an environment variable (`six==${SIXV}`) is refused by `vendor` with @@ -189,6 +193,17 @@ a version without a non-empty section in this file. an escaped path spelling (`\/` in an older `composer.lock`, Windows backslashes) instead of deleting it (#2022). - **General.** + - Workspace runs never read or rewrite project files outside the + enclosing git repository root. Ancestor workspace roots, settings + files, `go.work`, NuGet parent configs, `.cargo/config` and + out-of-tree requirements above the root are not read: writers refuse + (new `redirect_cargo_config_outside_root`, + `redirect_nuget_inherited_config_outside_root`, + `pypi_requirements_outside_root`) and `vex` withholds. Vendored writers + and `vendor --revert` only claim `.socket/vendor/` paths anchored at + this project, so a sibling checkout's wiring is never rewritten. + Global runs (`-g`, `--global-prefix`) and projects outside a git + checkout are unchanged (#2025). - The nested-project remedy quotes its path for the shell it prints for, including Windows and `%` (#1859, #1884). - Patch and vendor download errors read the same on every path (size From fabe76f3801c450a435118ff87d9ed290499984c Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 02:49:34 +0000 Subject: [PATCH 2/3] Add the 5.1.0 note for #2031 #2031 landed on main at 01:23 UTC, after the f5b03744 cut-off these notes were written against, and changes user-visible Go behavior: it completes the go.work handling #2011 introduced (bypassed replaces stay refs; an unread root go.work no longer withholds the root go.mod) and stops the in-memory hosted engine from probing the process cwd for Go workspaces. The other PRs merged since f5b03744 (#2002, #2034, #2035, #2037) change no shipped behavior and need no note. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_011f9aeRVgqkQL2WXrHEqeDJ --- CHANGELOG.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09fcbeb0e..bf89a4231 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -134,7 +134,14 @@ a version without a non-empty section in this file. - `vex` reads the `go.work` that governs the project (`GOWORK`, else the nearest one at or above it, with members anywhere), as hosted and vendored modes already did, and no longer attests a Socket replace the - workspace keeps out of the build (`go_workspace_override`) (#2011). + workspace keeps out of the build (`go_workspace_override`). Such a + replace stays visible to `list`, `rollback` and `remove`, and a root + `go.work` replace that `go` never reads no longer withholds the root + `go.mod`'s copy of it (#2011, #2031). + - The in-memory hosted engine judges a Go workspace from the project's + own files instead of probing the process's working directory, so a + root module the `go.work` does not `use` is no longer refused for a + missing `go.mod` (or answered from the server's) (#2031). - **JVM.** - A Maven 4 root that builds its subdirectories implicitly (model 4.1.0, `pom` packaging, no ``) is treated as a reactor by hosted From 999e5e847b56cd685110745ee095a97a008927d5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 02:50:52 +0000 Subject: [PATCH 3/3] chore(release): list #2002, #2034, #2035, #2037 under 5.1.0 Maintenance Co-Authored-By: Claude --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bf89a4231..b9d764173 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -230,7 +230,10 @@ a version without a non-empty section in this file. #1944, #1955, #1964, #1972, #1978, #1988, #1994, #2000); release workflow artifact steps move off Node 20 actions (#2027). A design doc and line-count budget plan one lock model for every lockfile reader - (#2001). + (#2001), and the Socket-origin classifier moves into one module (#2002). + Test fixes: PDM e2e compat pins bounded by release, a Windows-only + scala-cli liveness test, NuGet walk tests isolated from the host cache + (#2034, #2035, #2037). ## [5.0.1] — 2026-10-13