From 600182d34096ea300eb6e39bf9ac902f71515ff0 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 19:46:25 +0000 Subject: [PATCH 1/2] chore(release): add 5.1.0 notes for #1966, #2041 and #2042 All three merged to main while #2038 was in the merge queue and ship in 5.1.0. Co-Authored-By: Claude --- CHANGELOG.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b9d764173..f8d602138 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -104,6 +104,12 @@ a version without a non-empty section in this file. refuse: pnpm pins while `gitBranchLockfile` is on and a branch lock exists (`vex_pnpm_git_branch_lockfile`), and npm or Bun packages the project patches itself (`vex_npm_patched_dependency`) (#2010). + - A registry dependency that the root `package.json` `overrides` send to a + tarball URL, git or path spec (npm installs that spec, not the lock's + `resolved`) is skipped by hosted mode with + `redirect_npm_non_registry_entry_skipped`, refused by vendored mode, + and no longer attested by `vex`, including overrides scoped to a + workspace member (#1965, #1966). - **PyPI.** - A requirements line pinned through an environment variable (`six==${SIXV}`) is refused by `vendor` with @@ -233,7 +239,8 @@ a version without a non-empty section in this file. (#2001), and the Socket-origin classifier moves into one module (#2002). Test fixes: PDM e2e compat pins bounded by release, a Windows-only scala-cli liveness test, NuGet walk tests isolated from the host cache - (#2034, #2035, #2037). + (#2034, #2035, #2037); CI retries `setup-ruby` and `setup-deno` once + on a release-CDN error (#2041, #2042). ## [5.0.1] — 2026-10-13 From bc63299a78aba90ac37c8ea2bdbfefd5c19705cd Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 9 Nov 2026 20:58:52 +0000 Subject: [PATCH 2/2] chore(release): add 5.1.0 notes for #1893, #2039 and #2040 Co-Authored-By: Claude --- CHANGELOG.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f8d602138..79688b972 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -137,6 +137,12 @@ a version without a non-empty section in this file. `apply --check`, hosted mode and `vex` read the module graph to tell whether the patch is really built, instead of reporting it applied while `go build` linked the unpatched code (#1840, #1843). + - In a go 1.16-or-older module where a downgrade left the old version's + `go.sum` lines behind, `apply`, `apply --check`, hosted mode and `vex` + use the version the module graph selects instead of the highest + `go.sum` line. When the module cache can't answer, they fail closed: + `apply` refuses with a remedy, `apply --check` reports drift, and the + patch is not pinned or attested (#1862, #1893). - `vex` reads the `go.work` that governs the project (`GOWORK`, else the nearest one at or above it, with members anywhere), as hosted and vendored modes already did, and no longer attests a Socket replace the @@ -240,7 +246,8 @@ a version without a non-empty section in this file. Test fixes: PDM e2e compat pins bounded by release, a Windows-only scala-cli liveness test, NuGet walk tests isolated from the host cache (#2034, #2035, #2037); CI retries `setup-ruby` and `setup-deno` once - on a release-CDN error (#2041, #2042). + on a release-CDN error (#2041, #2042), `lint-ecosystems` installs retry + release 504s, and `vexctl` is cached on every OS (#2040, #2039). ## [5.0.1] — 2026-10-13