Repository navigation
Tags: SocketDev/socket-patch
Tags
chore(release): 5.0.1 (#1485) * ci(release): publish npm from release.yml, not publish-npm.yml Every socket-patch npm package's trusted publisher is registered against release.yml, and npm allows only one publisher per package. The 5.0.0 release dispatched publish-npm.yml, whose OIDC token named that file, so npm rejected it with E401 before staging anything. Move the npm leg back inline as release.yml's npm-publish job (same steps as publish-npm.yml) and delete publish-npm.yml, so the existing registration keeps working. Add an `npm-retry-version` input that skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from an existing release's assets; this retries 5.0.0 now and replaces the manual Publish npm dispatch. crates.io stays dispatched through publish-cargo.yml, since crates.io allows several publishers per crate. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): fold 22 more PRs into the 5.0.0 notes Cover the PRs merged to main after #1432's base (1779317..4cb3643): Cargo source replacement and registry = "crates-io" (#338/#455, #386), pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc ${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir cascade and global home (#439/#686, #586), Go +incompatible vex (#484), gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988), Poetry source = "pypi" (#1282) and Hatch path characters (#547). No entries for #1411 (macOS fix to code #1393 added in this release; the #1393 entry already describes the intended behavior), #1426 (perf regression introduced and fixed within 5.0.0) or the CI/test/bench PRs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): cover #1419, #1434, #1440, #1442, #1444 in the 5.0.0 notes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): 5.0.1 Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9 (#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450, #1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452, #1454, #1457, #1459) have no entries. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): 5.0.1 notes for PRs merged since the cut Covers #1469, #1470, #1474, #1475, #1478, #1479, #1480 and #1482; #1484 is CI-only. The notes now cover main through 285a5e8. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
CI: hermetic spawns in cli/covgap tests (#823) (#1441) * Start fix for #823 (cli/covgap spawns) Assisted-by: Claude Code:claude-opus-5-5 * Make cli and covgap tests ignore SOCKET_* Twenty CLI test files spawned socket-patch with a bare Command::new and a hand-rolled SOCKET_* scrub. The copies disagreed: several only removed the global flag vars, so SOCKET_API_TOKEN, SOCKET_API_URL or a per-command var like SOCKET_SKIP_ROLLBACK from a developer shell still reached the child, cli_parse_list's two plain list runs scrubbed nothing, and none forced the update notifier off. All 20 now spawn through the shared hermetic builder in tests/common/hermetic.rs and leave PENDING_RAW_SPAWNS, so the ratchet keeps them hermetic. Deliberate opt-ins stay as caller env: the config layer suites still set SOCKET_NO_CONFIG=0 and the telemetry suite still re-enables telemetry. Suites whose in-process tests mutate SOCKET_* keep their unconditional removals for the spawn race. Refs #823 Assisted-by: Claude Code:claude-opus-5-5 * Close the in-process env race in the builder Some test binaries set flag-bound SOCKET_* vars in their own process (apply_env_toggles, env save/restore helpers). The hermetic builder only removed names present when it swept the parent environment, so a var set by a parallel test before the spawn still reached the child, and suites patched that with their own, already diverging, removal lists. hermetic::command now removes every flag-bound var by name, so the per-file lists go away, and SOCKET_CWD joins the hostile seeds. A new contract test sets vars after the builder runs and checks none leak. Refs #823 Assisted-by: Claude Code:claude-opus-5-5 --------- Co-authored-by: Claude <noreply@anthropic.com>
chore(release): bump version to 4.0.0 (#228) * chore(release): bump version to 4.0.0 Bump 3.3.0 -> 4.0.0 (major: removes the unlock subcommand and the --break-lock flag, reorders --help). Synced via scripts/bump-version.sh across Cargo.toml (workspace version + core dep pin), Cargo.lock, all npm packages (main + platform shims + lockfile), both pypi pyprojects, and both gemspecs + the launcher VERSION constant. Rolls CHANGELOG [Unreleased] into ## [4.0.0] and adds an intro describing the three patch-application modes (agent / vendored / hosted) with their v4.0 ecosystem coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(production-e2e): pin the two new activestorage 6.0.3 patches; note #222/#224/#226 in the 4.0.0 changelog Production published two more free activestorage@6.0.3 patches on 2026-08-20 — eeb6bf9f (GHSA-9xrj-h377-fr87 / CVE-2026-33195, disk_service) at 16:14Z and c1a1cd3c (GHSA-r4mg-4433-c7g3 / CVE-2025-24293, image_processing_transformer) at 20:31Z — and the server-ranked resolver now wires the newest, so the required hosted-e2e check went red on the gem leg (this PR's run 32436943099, and every push until the pins learn the new UUIDs). Both patches' /patch/view blobs live-verified: every touched file carries the Socket Community Patch header. - hosted suite: append both UUIDs to the GEM_UUIDS any-of set (the leg already content-verifies the wired patch against its /patch/view manifest, so the pin is the only per-patch knowledge it needs). - vendored suite: the single GEM_UUID pin also hardcoded the marker FILE (s3_service.rb, specific to the 15e960b5 patch). Replace it with a GEM_PATCHES (uuid, marker-file) table; the leg now asserts pristine across every candidate file up front, resolves the wired uuid from the download envelope, and probes that patch's own file + vendor path. - docs/testing catalogs updated to match. Also add the 4.0.0 CHANGELOG entries for the three user-facing changes merged from main without notes: get --mode hosted|vendored (#226), the bun 1.4 lockfileVersion-2 acceptance (#224), and the gem multi-copy / bundle-path-precedence apply fix (#222). Validated live against production: e2e_hosted_production 16/16, e2e_vendored_production 13/13, e2e_redirect_bun_build 9/9. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
chore(release): bump version to 3.3.0 (#96) Bump 3.2.0 -> 3.3.0 (minor) for the inline OpenVEX feature already staged under CHANGELOG `## [Unreleased]`. Synced via scripts/version-sync.sh across Cargo.toml (workspace version + core dep pin), Cargo.lock, all npm packages (main + platform shims + lockfile), and pypi/pyproject.toml. The Release workflow reads this version from Cargo.toml; once merged it can be dispatched to publish v3.3.0 and roll the CHANGELOG over. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix: repo-wide correctness, security & filesystem-safety hardening pa… …ss (v3.2.0) (#92) * fix: repo-wide correctness, security & filesystem-safety hardening pass (v3.2.0) Reviewed every source file in both crates line by line, fixed the bugs found, and added regression tests throughout. Highlights: Security - patch/package.rs: path-traversal via validate-before-normalize (package//etc/passwd escaped the package tree) - patch/diff.rs: clamp unbounded Vec preallocation from untrusted bsdiff target-size header (OOM/abort on a hostile delta) - vex/verify.rs: omit zero-file patches instead of emitting an evidence-free not_affected attestation Filesystem safety / atomicity / rollback - apply: DirWriteGuard for read-only dirs, chown-before-chmod to keep setuid/setgid, parent-dir fsync after rename - cow: atomic rename-over symlink (no pre-unlink), stage cleanup - rollback: delegate to hardened apply_file_patch; AlreadyOriginal before blob check; read-only-dir new-file delete - file_hash/git_sha256: open-once + fstat (TOCTOU), regular-file guard, size/body mismatch detection - cargo/nuget sidecars: hardened writes/deletes in read-only caches - cleanup_blobs: symlink-tolerant, accurate counts - apply_lock: classify genuine flock errors as Io, clamp timeout sleep Crawlers (on-disk layout & metadata) - composer v-prefix + malformed-entry tolerance + on-disk check - go cache-at-root, version case-encoding, GOPATH list, module directive - npm symlink following + nested-recursion guard - nuget global-cache version casing - python macOS framework layout + dist-info dir-name fallback - deno macOS cache path, XDG_CACHE_HOME, empty DENO_DIR - maven XML-comment stripping + skip-section depth - cargo TOML header tolerance + dir-name version split - shared utils/fs::entry_is_dir follows symlinks API client, commands & misc - proxy-url override on binary downloads; deterministic org/title/batch flag; case-insensitive hash compare - USER_AGENT + telemetry version track CARGO_PKG_VERSION (was 1.0.0) - apply release-variant NotFound spurious-failure fix - get/scan/remove char-safe truncation (UTF-8 panic) - setup/repair honest non-zero exit codes + telemetry - rollback no-op miscount; unlock released-snapshot; vex qualified PURLs - package.json non-object/dedup/glob/key-order (preserve_order) - json_envelope status invariant + oldUuid; list ordering; fuzzy_match tie-break; lock_cli sub-second timeout; vex schema/product fixes Updated stale repair/python_crawler e2e expectations to the corrected contracts. Bumped version to 3.2.0 and added the scripts/study-crates.ts audit harness used to drive the review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: fix Windows-only file_hash directory-rejection assertion `File::open` on a directory fails outright on Windows (different OS error kind), whereas on Unix it opens and the is_file() guard rejects it with InvalidInput. The production code rejects directories on both platforms; only pin the specific InvalidInput kind off-Windows. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ci(release): pin newer cross NDK image for aarch64-linux-android (#86) The default image bundled with cross 0.2.5 ships an NDK whose sysroot lacks libunwind on the linker path. Modern rustc emits `-lunwind` for Android targets, so the release build fails with `ld: cannot find -lunwind`. Override just the Android target to a digest-pinned cross main image, which ships an NDK that has libunwind available. All other targets keep their default cross 0.2.5 images. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
v2.1.3: bump and sync package versions (#59) Re-release of v2.1.2 content — the v2.1.2 release workflow failed mid-way (npm publish hit broken Node 22.22.2) leaving a stuck tag that can't be deleted due to tag protection rules. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
PreviousNext