From 640a0a5bc4af3d3f97ed77eb9c8cda852ef656c0 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Fri, 28 Aug 2026 11:43:07 -0400
Subject: [PATCH 1/2] fix(ci): regenerate the npm wrapper lock with CI's npm
 major
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

release-readiness regenerates the lock with the runner's npm 10, which
does not write the `libc` platform arrays npm >= 11 emits — so the
npm-11-shaped lock from #233 makes 'version-sync.sh 4.0.0 is not a
no-op' fail on every PR and on main. The check's npm is the effective
canon; note the npm-major dependence for whoever next refreshes the
lock locally.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 npm/socket-patch/package-lock.json | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/npm/socket-patch/package-lock.json b/npm/socket-patch/package-lock.json
index 987aca5f..0bd34b59 100644
--- a/npm/socket-patch/package-lock.json
+++ b/npm/socket-patch/package-lock.json
@@ -84,9 +84,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -100,9 +97,6 @@
       "cpu": [
         "arm"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -116,9 +110,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -132,9 +123,6 @@
       "cpu": [
         "arm64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -148,9 +136,6 @@
       "cpu": [
         "ia32"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -164,9 +149,6 @@
       "cpu": [
         "ia32"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -180,9 +162,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -196,9 +175,6 @@
       "cpu": [
         "x64"
       ],
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [

From 731d322cb05601e49eb16af2a9ca7bcd199367e2 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 31 Aug 2026 13:12:56 -0400
Subject: [PATCH 2/2] fix(ci): pin the npm wrapper lock refresh to npm@10 via
 npx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The release-readiness gate re-runs version-sync.sh and compares the
regenerated npm/socket-patch/package-lock.json byte-for-byte, so the
lock's canonical shape is defined by whatever npm regenerates it. npm 11
adds libc arrays that npm 10 omits, which is how the #233 refresh (made
locally with npm 11) broke the gate under CI's npm 10 — and the same
drift would recur in reverse the day the runner image jumps to npm 11.
Pinning the refresh via npx makes the gate independent of both the
runner default and the developer's local npm; bumping the pin now takes
a deliberate commit that refreshes the lock alongside it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 scripts/version-sync.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/scripts/version-sync.sh b/scripts/version-sync.sh
index 3451a9cb..48fde5f7 100755
--- a/scripts/version-sync.sh
+++ b/scripts/version-sync.sh
@@ -38,9 +38,17 @@ node -e "
 # Refresh the npm wrapper lockfile so package-lock.json stays in sync with the
 # bumped package.json (own version, optionalDependencies). Uses --package-lock-only
 # so node_modules is untouched.
+#
+# The npm major is pinned: the lock's byte shape depends on it (npm >= 11 adds
+# `libc` arrays to platform-package entries that npm 10 omits), and
+# release-lint.sh compares the regenerated lock byte-for-byte against the
+# committed one on every PR. An unpinned npm makes that gate depend on
+# whichever npm the runner or developer happens to have. Bumping this pin
+# requires refreshing the committed lock in the same commit.
+NPM_LOCK_REFRESH_VERSION="10"
 (
   cd "$REPO_ROOT/npm/socket-patch"
-  npm install --package-lock-only --ignore-scripts >/dev/null
+  npx --yes "npm@$NPM_LOCK_REFRESH_VERSION" install --package-lock-only --ignore-scripts >/dev/null
 )
 
 # Update all per-platform npm package versions