[Mikola Lysenko (mikolalysenko)]

Follow-up to #2038: three PRs merged while it was in the merge queue

#1966, #2041 and #2042 landed on main just before #2038 merged. They ship in 5.1.0. With this PR, the 5.1.0 notes cover main through 53286d4e.

This PR changes only CHANGELOG.md (+8/−1, inside ## [5.1.0]), and the version stays 5.1.0.

PR	Section	Note
#1966 (#1965)	Fixed → npm family	A registry dependency that root overrides send to a URL, git or path spec is skipped by hosted mode (redirect_npm_non_registry_entry_skipped), refused by vendored mode, and no longer attested by vex. This includes overrides scoped to a workspace member
#2041, #2042	Maintenance	CI retries setup-ruby and setup-deno once on a release-CDN error

Local checks: release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 both passed.

Maintainer checklist

• Approve and merge this PR before dispatching Release.
• After merge, confirm nothing else landed: git log --first-parent 53286d4e..origin/main, ignoring this PR's own merge commit.
• Actions → Release → Run workflow on main (optionally a dry-run: true run first).
• Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

---

Note

Low Risk
Documentation-only edit to the changelog; no code or workflow changes in this diff.

Overview
This PR only updates CHANGELOG.md under ## [5.1.0] so release notes match what already merged on main (version stays 5.1.0).

Fixed → npm family: Documents that when root package.json overrides send a registry dependency to a tarball URL, git spec, or path (so npm installs that spec instead of the lock’s resolved), hosted mode skips with redirect_npm_non_registry_entry_skipped, vendored mode refuses, and vex no longer attests—including member-scoped overrides (#1965, #1966).

Maintenance: Notes that CI retries setup-ruby and setup-deno once after a release-CDN error (#2041, #2042).

^{Reviewed by Cursor Bugbot for commit 600182d. Configure here.}

[Wenxin Jiang (Wenxin-Jiang)]

[agent] Approving: the two notes match #1966 (reason code redirect_npm_non_registry_entry_skipped exists at head) and #2041/#2042, and stay inside ## [5.1.0].

Heads-up for the post-merge checklist step: three PRs landed on main after 53286d4e — #1893 (Go stale go.sum line after a downgrade, user-facing), #2039 and #2040 (CI maintenance). They need 5.1.0 notes before dispatching Release.

[Mikola Lysenko (mikolalysenko)]

Thanks, Wenxin-Jiang. I folded the three PRs you flagged into this PR so the release doesn't need another follow-up. I merged main (e0916be9) and added:

• Fixed → Go: after a downgrade in a go 1.16-or-older module leaves stale go.sum lines, apply, apply --check, hosted mode and vex follow the module graph's selected version. If the cache can't answer, they fail closed (On a go 1.16 go.mod, Go apply, apply --check and vex trust a stale go.sum zip line left by a downgrade, so they report an inert replace as applied (or refuse a selected version) #1862, Fix Go stale go.sum line after a downgrade (#1862) #1893).
• Maintenance: lint-ecosystems installs retry release 504s (Retry release 504s in lint-ecosystems installer steps #2040), and vexctl is cached on every OS (Cache vexctl on every OS so release 504s can't fail coverage #2039).

release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md. The 5.1.0 notes now cover main through e0916be9. This push may have dismissed your approval, so it may need re-approval.

Generated by a one-off release-staging routine.

---

Generated by Claude Code