chore(release): 5.1.0 by mikolalysenko · Pull Request #2032 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-11-06T16:03:05Z

Release 5.1.0

Version: 5.1.0 (minor). The notes have an ### Added section (agent-mode gem native-extension rebuild) and no Breaking or Removed entries. Per the CHANGELOG header rule, that makes this a minor release.

Covered range: v5.0.1..7bde3ba55a84e64281372ebc4fd53e7fab0e35fd: 50 first-parent PRs. That is far fewer than the ~300 commits the routine expected; the count is from git log --first-parent.

This PR changes only CHANGELOG.md and the files scripts/version-sync.sh 5.1.0 stamps (Cargo.toml, Cargo.lock, the 15 npm package.json files, the npm lockfile). Local checks: release-lint.sh --stable-only --tag-check passed, release.py changelog check --version 5.1.0 passed, and cargo check --locked passed.

Headline: Ruby native-extension patching (#1996, #1998)

When agent-mode apply (or scan/get --mode agent) patches a gem whose patch changes native-extension sources (ext/**/*.c, extconf.rb, …), it now rebuilds the extensions with RubyGems' own builder (the gem pristine --extensions step). It uses the Ruby that owns the gem home and rebuilds both the extensions/<platform>/<abi>/ copy and the lib/ copy, so Ruby stops loading the stale install-time build.

If the build fails, the original sources and build are restored (native_extension_build_failed).
A copy that can't be rebuilt in place is refused before anything is written (native_extensions_unsupported).
vex and apply --check attest the patch only once the rebuild is recorded; otherwise they report native_extension_not_rebuilt.
rollback/remove restore the original build.
--no-gem-native-rebuild (env SOCKET_NO_GEM_NATIVE_REBUILD) opts out for callers that compile the extension themselves.

These claims were checked against CLI_CONTRACT.md and args.rs.

Left out of the notes

Every merged PR is referenced, but these appear only in two condensed Maintenance bullets because they don't change user-visible behavior:

18 refactor sweeps, which state "output/behavior unchanged".
The Poetry/PDM lock-driver consolidation (Share one lock_fragments driver for PDM and Poetry (#1844) #1898).
10 test/CI-infrastructure PRs.

For a maintainer to double-check

The routine prompt mentioned CRLF Gemfile/Gemfile.lock, gemspec dev deps, and hosted/vendored gem-block fixes. Of those, only gemspec dev deps (Read gemspec directives and dev deps as Ruby code (#1932) #1936) and Bundler 4.1 overrides (Fix gem restore of Bundler 4.1 override targets (#1989) #1991) are in this range. The others either shipped earlier or are still open (e.g. Fix nightly gem e2e: attribute nested Gemfile source blocks #1999), so they are not in these notes.
Sweep scan/discovery.rs #1884 (a "sweep") and One serve GET and one vendor retry loop in api/client.rs (#1869) #1870 (an API client consolidation) carry small user-visible changes: Windows/% quoting of the nested-project remedy, and uniform download-error wording plus --debug logging. Both are listed under Fixed → General.
The new warnings redirect_npm_omit_lockfile_registry_resolved (Fix hosted npm ignoring omit-lockfile-registry-resolved (#1871) #1872) and redirect_pypi_no_lockfile (Fix silent PyPI hosted scan with no lockfile (#638) #1885), and the new refusal pypi_requirement_env_templated (Fix templated pip pins ignored beside pylock (#1873) #1874), are filed under Fixed because they close silent-failure cases. They could arguably go under Added; doing so would not change the version.

Maintainer checklist

Approve this PR.
After merge, confirm nothing else landed: git log --first-parent 7bde3ba55a84e64281372ebc4fd53e7fab0e35fd..origin/main (if something did, add notes first).
Actions → Release → Run workflow on main (optionally a dry-run: true run first).
Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

Generated by Claude Code

Note

Low Risk
Version and changelog-only release prep; no runtime code changes in this diff.

Overview
Cuts socket-patch 5.1.0: bumps the workspace and crate versions in Cargo.toml / Cargo.lock, and stamps 5.1.0 on the main npm package, all platform optionalDependencies, and package-lock.json (lockfile trimmed to root + @types/node only).

Documents the release in CHANGELOG.md with a new ## [5.1.0] — 2026-11-06 section: Added highlights agent-mode RubyGems rebuilds of native extensions (gem pristine–style) with new warnings/codes and --no-gem-native-rebuild; Fixed spans Bundler 4.1 overrides, gemspec parsing, pnpm/yarn/Bun/npm edge cases, PyPI/Pipenv/Poetry, Go replace correctness, Maven 4 implicit reactor, vendoring dry runs and refusals, and misc download/remedy behavior; Maintenance notes internal consolidation and CI/test work.

^{Reviewed by Cursor Bugbot for commit c6ef370. Configure here.}

Generated by Claude Code

Roll the notes for the 50 PRs merged since v5.0.1 into a 5.1.0 section and stamp 5.1.0 into every packaging site. Minor bump: gem native extension rebuild in agent mode is new behavior (#1996, #1998). Co-Authored-By: Claude <noreply@anthropic.com>

socket-security · 2026-11-06T16:04:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/@socketsecurity/socket-patch-android-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-ia32@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A

View full report

socket-security-staging · 2026-11-06T16:05:33Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/@socketsecurity/socket-patch-android-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-darwin-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-arm64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-ia32-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-gnu@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-linux-x64-musl@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-arm64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-ia32@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A
npm/@socketsecurity/socket-patch-win32-x64@5.0.1 ⏵ 5.1.0	N/A	N/A	N/A	N/A	N/A

View full report

Mikola Lysenko (mikolalysenko) · 2026-11-06T16:07:29Z

CI red that isn't caused by this PR: the e2e (ubuntu-latest, e2e_vex_build, … pdm:: --ignored …) check fails.

pdm lock crashes with [AttributeError]: module 'hishel' has no attribute 'SyncSqliteStorage'. A new hishel 2.x release breaks PDM, and both pdm::*_install_then_manifest_less_vex tests fail with it. This PR changes only CHANGELOG.md and the version stamps, so it can't cause this, and PDM's dependencies aren't pinned, so re-running the job would fail the same way. The same failure is red on other PRs right now.

The fix is open as #2028 (ci-janitor/pdm-hishel-2, pins hishel<2). This release PR is limited to the changelog and version files, so I haven't ported that change here. Once #2028 merges, merge main into release/v5.1.0 (or update the branch) so CI runs again. Auto-merge is still armed.

Generated by a one-off release-staging routine.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-11-06T17:12:58Z

Labeled Ready for review by the burn-down agent.

Head: c6ef370ca6ca49ad5b1b4ba66fa3287a73bbad17
CI: 48/50 check runs green (29 success, 19 skipped). The two red ones come from a failure that also hits main: e2e (ubuntu-latest, e2e_vex_build, … pdm:: --ignored …) and the ci-ok aggregate that depends on it. pdm lock crashes because hishel 2.x removed SyncSqliteStorage. The pdm e2e is red on main too (e2e-macos … pdm:: at 7bde3ba). Fix pdm e2e red on every PR: pin hishel<2 #2028 fixes it.
Bugbot: reviewed this head with no findings.
For the reviewer: it changes only CHANGELOG.md, the version stamps and the lockfiles. Auto-merge is still armed. If you want this PR fully green before you approve, merge Fix pdm e2e red on every PR: pin hishel<2 #2028 first and update this branch.

Generated by Claude Code

chore(release): 5.1.0

c6ef370

Roll the notes for the 50 PRs merged since v5.0.1 into a 5.1.0 section and stamp 5.1.0 into every packaging site. Minor bump: gem native extension rebuild in agent mode is new behavior (#1996, #1998). Co-Authored-By: Claude <noreply@anthropic.com>

Mikola Lysenko (mikolalysenko) enabled auto-merge November 6, 2026 16:03

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Nov 6, 2026

Navigation Menu

Repository navigation

chore(release): 5.1.0 - #2032

chore(release): 5.1.0#2032
Mikola Lysenko (mikolalysenko) wants to merge 1 commit into
mainfrom
release/v5.1.0

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 6, 2026

Uh oh!

socket-security-staging Bot commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 5.1.0

Headline: Ruby native-extension patching (#1996, #1998)

Left out of the notes

For a maintainer to double-check

Maintainer checklist

Uh oh!

socket-security Bot commented Nov 6, 2026

Uh oh!

socket-security-staging Bot commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Nov 6, 2026 •

edited

Loading