[Mikola Lysenko (mikolalysenko)]

Follow-up to #2032: notes for PRs merged after the 5.1.0 cut

#2032 stamped 5.1.0 and covered v5.0.1..7bde3ba. Seventeen more PRs have landed on main since then. The Release workflow hasn't been dispatched yet, so they will ship in 5.1.0 and need entries in its [5.1.0] section first. This PR covers main through c2be8547.

It changes only CHANGELOG.md, inside ## [5.1.0]. The version stays 5.1.0: every new entry is under Fixed or Maintenance.

PR	Section	Note
#1999 (#1997)	Fixed → RubyGems	Nested source … do blocks attributed to the innermost block
#2013	Fixed → npm family	Hosted vlt scans stop downloading archives; in-memory engine pins vlt deps
#2003	Fixed → npm family	Lock inventory skips unsafe Rush subspace locks
#2014	Fixed → PyPI	Hosted unwind restores uv 0.2 [[distribution]] pins
#2011	Fixed → Go	vex reads the governing go.work
#2016	Fixed → JVM	Hosted Maven keeps user lines in checksums.sha256
#2006	Fixed → JVM	Vendored Maven liveness no longer attests unpatched builds
#2004	Fixed → JVM	Vendored Gradle withholds attestation on lockfile overrides
#2030, #2008	Fixed → JVM	sbt hosted pin bypass / vendored resolution evidence
#2007	Fixed → NuGet	Other-version locks not attested
#2017	Fixed → Composer	BOM locks read everywhere; revert keeps live artifacts
#2015	Fixed → Vendoring	Same pre-download refusals on every vendored entry point
#2022	Fixed → Vendoring	Revert keep-check reads escaped paths
#2000, #2027, #2001	Maintenance	Test selftests, release workflow on Node 24 actions, lock-model design doc

Double-check: #2013 could arguably go under ### Changed. The version is minor either way.

Local checks on the head: release-lint.sh --stable-only --tag-check passed, and release.py changelog check --version 5.1.0 passed. CI is green.

Maintainer checklist

• Approve and merge this PR before dispatching Release, so the GitHub release notes include these entries.
• After merge, confirm nothing else landed: git log --first-parent c2be8547..origin/main (add notes first if anything user-visible did).
• Actions → Release → Run workflow on main (optionally a dry-run: true run first).
• Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aePdrBUA9L8Yo6bTo6v

---

Note

Low Risk
Documentation-only changelog staging for release notes; no runtime or CI behavior changes in this diff.

Overview
Updates only CHANGELOG.md under ## [5.1.0], documenting seventeen PRs that landed on main after the earlier 5.1.0 notes cut—no product code changes.

The new Fixed entries span RubyGems nested source attribution; npm/vlt scan behavior and Rush unsafe lock names; PyPI uv 0.2 [[distribution]] unwind; Go vex + go.work; JVM Maven checksum preservation, Maven/Gradle/sbt attestation guardrails; NuGet other-version locks; Composer BOM handling; and vendored pre-download refusals plus revert path escaping. Maintenance adds test selftests, Release workflow artifact steps on newer Node actions, and a unified lock-model design note.

The section is also restructured so Go and JVM fixes use dedicated sub-headings instead of inline bullets mixed with PyPI.

^{Reviewed by Cursor Bugbot for commit 4fd1702. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: 5d76313ab9447759ff248e15bbeeeb7621bdd6f2
• CI: 50/50 check runs green (31 success, 19 skipped); no main-wide failures.
• Bugbot: reviewed this head, no findings.
• Release PR (release/v5.1.0), so the CHANGELOG.md change is expected. Auto-merge is already armed; it needs an approval. Per the PR checklist, merge it before dispatching the Release workflow.
• Slack announcement not sent: the Slack send tool isn't available in this run, so the next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Adds [5.1.0] changelog entries for four PRs that landed while #2032 was in review: #1999 (RubyGems nested source blocks), #2013 (hosted vlt scans stop downloading archives), and #2000/#2027 (maintenance). Only CHANGELOG.md changes; this is a release/v* branch, so editing it is allowed.

Risk: low. Docs only, +12/−1, nothing runtime.

Look here

• CHANGELOG.md:65: RubyGems entry (Nightly gem e2e red on bundler 1.17/2.1: CRLF source-block rollback unattributable #1997, Fix nightly gem e2e: attribute nested Gemfile source blocks #1999)
• CHANGELOG.md:95: vlt hosted-scan entry (Stop downloading vlt artifacts during hosted scans #2013)
• CHANGELOG.md:159: maintenance bullet (Run tests/common selftests once, not in 118 binaries #2000, Move release.yml artifact steps off Node 20 actions #2027)

Verified: the diff against merge-base 502aa1fc is the 12 lines above, and each entry matches the merged PR it cites. CI 31/31 passed (19 skipped). Bugbot reviewed this head and rated it low risk. No unresolved review threads.

Changes I made: none.

Open questions

• Refuse vendored patches the same way everywhere #2015 isn't covered. "Refuse vendored patches the same way everywhere" (26e39db) merged to main at 22:06 UTC, after this PR's range (c6a4fda6..502aa1fc). It changes user-facing behavior and has no [5.1.0] entry yet. Merging this PR is still fine, but someone needs to add Refuse vendored patches the same way everywhere #2015 before Release is dispatched (step 2 of the checklist).
• As the PR body says, Stop downloading vlt artifacts during hosted scans #2013 could go under ### Changed. Either way the version stays minor.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

#2015 is now covered as well. The latest main (26e39db5) is merged into this branch, and a Fixed → Vendoring entry describes the user-visible change: every vendored entry point applies the same refusals before any download, get <uuid> --mode vendored reports them and writes nothing, and vendor refuses before restoring a hosted pin. This PR now covers through 26e39db5. release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md.

Before you dispatch Release, re-check with git log --first-parent 26e39db5..origin/main.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (update)

What it does: Since my last brief (5d76313a), this release-notes PR merged main and added one [5.1.0] entry for #2015 ("Refuse vendored patches the same way everywhere"). That closes the open question from the earlier brief. Only CHANGELOG.md changes, and this is a release/v* branch, so editing it is allowed.

Risk: low. Docs only, nothing runtime.

Look here

• CHANGELOG.md:142: the new Refuse vendored patches the same way everywhere #2015 entry under ### Fixed

Verified: the new entry matches #2015's "Behavior changes" section: the scan download phase refuses before fetching any patch view, get --mode vendored refuses before writing anything, vendor refuses before restoring a hosted pin, and codes and details are unchanged. The merge from main brings in only #2015's code, which is already on main. CI on 367b95d4: 30 passed, 19 skipped, none failed. No unresolved review threads.

Changes I made: none.

Open questions: none new. (#2013 under ### Changed vs ### Fixed is still the author's call; either way the version stays minor.)

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Twelve more PRs merged to main overnight (26e39db5..c2be8547). They ship in 5.1.0, so I merged main into this branch and added their notes:

• Go: governing go.work read by vex (Read the governing go.work in Go discovery #2011). The Go entry is now a group.
• JVM (was "Maven"): hosted Maven keeps user lines in checksums.sha256 (Read Maven checksums.sha256 one way and never drop user lines #2016); vendored Maven liveness (Stop vendored Maven liveness attesting unpatched builds #2006); vendored Gradle lockfile overrides (Stop vendored Gradle liveness attesting a version the lockfile overrides #2004); sbt hosted pin bypass (Stop attesting sbt pins a build reassignment or uncommitted wiring bypasses #2030) and vendored evidence (Require sbt resolution evidence before attesting vendored pins #2008).
• NuGet: other-version locks not attested (Stop attesting NuGet versions the writers refuse #2007).
• Composer: BOM locks; revert no longer deletes a live artifact (Read BOM composer locks and pin that no lock pin drives a download #2017).
• PyPI: uv 0.2 hosted pins restored (Restore the uv 0.2 pins hosted mode writes #2014).
• npm family: unsafe Rush subspace locks skipped (Skip unsafe Rush subspace locks in the lock inventory #2003).
• Vendoring: escaped-path keep-check (Keep vendored artifacts a lock references through escaped paths #2022).
• Maintenance: lock-model design doc and budget (Plan one lock model for every lockfile reader #2001).

The version stays 5.1.0, and all new entries are under Fixed or Maintenance. release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md. This PR now covers main through c2be8547. Before you dispatch Release, re-check with git log --first-parent c2be8547..origin/main.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

[cursor]

Stale Bugbot comment from a previous run.

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4fd1702. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Final review brief (head 4fd1702)

What it does. Adds 5.1.0 release notes for the PRs that merged to main after the earlier 5.1.0 cut (#2032). Since the last brief, the head picked up a merge from main plus one commit (4fd1702) with entries for #2003, #2004, #2006, #2007, #2008, #2011, #2014, #2016, #2017, #2022, #2030 and #2001. The PR diff against main changes only CHANGELOG.md. That's expected on a release/v* branch.

Risk: low. It changes docs only, and only inside ## [5.1.0]. No code or CI behavior changes.

Look here

• npm family: Rush lock note (#2003)
• PyPI uv 0.2 and the new Go / JVM split (#2014, #2011, #2016, #2006, #2004, #2030, #2008)
• NuGet and Composer (#2007, #2017)
• Vendoring escaped-path revert (#2022)
• Maintenance: lock-model design doc (#2001)

Verified

• Compared git log --first-parent 7bde3ba..origin/main (through c2be854, the current main head) against the entries. Every user-visible PR has an entry.
• Ran scripts/release-lint.sh --stable-only --tag-check and scripts/release.py changelog check --version 5.1.0 on the head. Both pass.
• CI: 31 checks passed and 19 skipped, none failed. ci-ok and clippy are green. Bugbot reviewed 4fd1702 and opened no threads. No review threads are unresolved.

Changes I made. None.

Open questions

• Fix pdm e2e red on every PR: pin hishel<2 #2028 (pins hishel<2 in the PDM e2e bootstrap) has no entry. It's CI-only, so leaving it out seems right, but the Maintenance line lists other test-infra PRs. Add it there if you want the list complete.
• Six more PRs (Fix Windows-only scala_cli liveness test failure in nightly #2035, Let the pdm e2e bootstrap install pdm 2.29.4+ #2034, Keep the in-memory hosted engine off the disk for Go workspaces #2031, Never read or rewrite project files outside the git repository root #2025, Stop attesting npm-family pins pnpm or a user patch overrides #2010, Move the Socket origin classifier into one module #2002) are armed for auto-merge. If any of them lands before Release is dispatched, it will need a note too (see the checklist's post-merge git log step).

Auto-merge is armed, so approving this sends it straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: Ready for review re-confirmed at the current head 4fd1702b. The label was first applied at 5d76313a.

• Mergeable: yes. No conflicts with main at c2be8547, which is the commit the notes cover through.
• CI: 50/50 checks green on 4fd1702b (31 passed, 19 skipped). No failures.
• Bugbot: reviewed 4fd1702b, no unresolved findings.
• This is a release PR, so its CHANGELOG.md changes are expected.
• Slack: not announced this run. The Slack send tool isn't available to this routine, so no slack-announced marker was added.

---

Generated by Claude Code