chore(release): 5.0.0

Cargo.toml

@@ -14,13 +14,13 @@ default-members = [
 resolver = "2"
 
 [workspace.package]
-version = "4.0.0"
+version = "5.0.0"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/SocketDev/socket-patch"
 
 [workspace.dependencies]
-socket-patch-core = { path = "crates/socket-patch-core", version = "=4.0.0" }
+socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.0" }
 clap = { version = "=4.5.60", features = ["derive", "env"] }
 serde = { version = "=1.0.228", features = ["derive"] }
 serde_json = { version = "=1.0.149", features = ["preserve_order", "raw_value"] }

crates/socket-patch-cli/tests/e2e_vlt.rs

@@ -241,7 +241,7 @@ async fn vlt_pinned_matrix_agent_launcher() {
     let Some(leg) = agent_leg("launcher") else {
         return;
     };
-    if !hermetic_registry(leg.version()) {
+    if !hermetic_registry(leg.version()) || registry_config_ignored(leg.version()) {
         return leg.skip("non-hermetic-registry");
     }
     let (pkgs, host) = launcher_packages();

crates/socket-patch-cli/tests/vlt-leg-manifest.json

@@ -880,6 +880,20 @@
       "conditions": [],
       "reason": "non-hermetic-registry"
     },
+    {
+      "boundary": "the configured registry is ignored: every install resolves from public npm",
+      "suite": "agent",
+      "legs": [
+        "launcher"
+      ],
+      "except": [],
+      "versions": {
+        "op": "<=",
+        "a": "0.0.0-13"
+      },
+      "conditions": [],
+      "reason": "non-hermetic-registry"
+    },
     {
       "boundary": "`npm:` alias specs resolve against public npm even with `registries.npm`",
       "suite": "agent",

crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs

@@ -295,6 +295,13 @@ pub fn scalar_registry_ignored(v: VltVersion) -> bool {
     (VltVersion::rc(7)..=VltVersion::rc(29)).contains(&v)
 }
 
+/// vlt.json's `registry` (and `--registry`) is ignored: every install
+/// resolves from public npm, so a package only the harness registry serves
+/// (the launcher at an unpublished version) cannot install.
+pub fn registry_config_ignored(v: VltVersion) -> bool {
+    v <= VltVersion::zero(13)
+}
+
 /// The harness can run every install against its own registry.
 pub fn hermetic_registry(v: VltVersion) -> bool {
     !scalar_registry_ignored(v)

docs/testing/vlt-compatibility.md

@@ -128,7 +128,7 @@ The capstones serve npmjs bytes from a local wiremock registry `R` and write
 
 | Era window | vlt.json | Hermetic | Notes |
 |---|---|---|---|
-| ≤ 0.0.0-13 | flat `{"registry": R}` | yes | `vlt-workspaces.json` for workspaces ≤ 0.0.0-12 |
+| ≤ 0.0.0-13 | flat `{"registry": R}` | no: vlt ignores the configured registry (and `--registry`), so every install resolves from public npm | `vlt-workspaces.json` for workspaces ≤ 0.0.0-12; legs pass because R serves npmjs bytes, except the launcher leg (its package exists only in R), which logs `skip:non-hermetic-registry` |
 | 0.0.0-14 … rc.6 | `{"config":{"registry": R}}` (+ `"modifiers":{}` for 0.0.0-16 … 24, except the ignored-lock leg) | yes | URL-segment DepIDs carry R's port |
 | rc.7 … rc.29 | `{"config":{"registry": "https://registry.npmjs.org/"}}` | no: lock-driven installs reach public npm | the dead-registry assertions log `skip:non-hermetic-registry`; the patch service stays local |
 | rc.30 … rc.32 | `{"config":{"registry": R}}` | yes | URL-segment DepIDs |
@@ -285,6 +285,7 @@ store-linker knob, `unset` when not given), `cache_root` and `upgrade`
 | a cache on another filesystem falls back to copies | `all` | `cache_root=set` | safety | `private_copies` | `store-linker-hardlinks` |
 | as above | `all` | `cache_root=unset` | safety | `cross_device_cache` | `no-cache-root` |
 | a scalar `registry` makes lock-driven installs re-resolve from public npm | `1.0.0-rc.7 … 1.0.0-rc.29` | — | agent | `scan_apply_rollback_list`, `launcher` | `non-hermetic-registry` |
+| the configured registry is ignored: every install resolves from public npm | `<= 0.0.0-13` | — | agent | `launcher` | `non-hermetic-registry` |
 | `npm:` alias specs resolve against public npm even with `registries.npm` | `1.0.0-rc.30 … 1.0.0-rc.32` | — | agent | `scan_apply_rollback_list` | `non-hermetic-registry` |
 | `lockfileVersion` 0 with legacy (`·`/`§`) DepIDs | `0.0.0-19 … 1.0.0-rc.14` | — | — | — | — |
 | `lockfileVersion` 1, tilde DepIDs | `>= 1.0.0-rc.15` | — | — | — | — |

npm/socket-patch-android-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-android-arm64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Android ARM64",
   "os": [
     "android"

npm/socket-patch-darwin-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-darwin-arm64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for macOS ARM64",
   "os": [
     "darwin"

npm/socket-patch-darwin-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-darwin-x64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for macOS x64",
   "os": [
     "darwin"

npm/socket-patch-linux-arm-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-arm-gnu",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ARM (glibc)",
   "os": [
     "linux"

npm/socket-patch-linux-arm-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-arm-musl",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ARM (musl)",
   "os": [
     "linux"

npm/socket-patch-linux-arm64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-arm64-gnu",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ARM64 (glibc)",
   "os": [
     "linux"

npm/socket-patch-linux-arm64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-arm64-musl",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ARM64 (musl)",
   "os": [
     "linux"

npm/socket-patch-linux-ia32-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-ia32-gnu",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ia32 (glibc)",
   "os": [
     "linux"

npm/socket-patch-linux-ia32-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-ia32-musl",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux ia32 (musl)",
   "os": [
     "linux"

npm/socket-patch-linux-x64-gnu/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-x64-gnu",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux x64 (glibc)",
   "os": [
     "linux"

npm/socket-patch-linux-x64-musl/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-linux-x64-musl",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Linux x64 (musl)",
   "os": [
     "linux"

npm/socket-patch-win32-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-win32-arm64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Windows ARM64",
   "os": [
     "win32"

npm/socket-patch-win32-ia32/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-win32-ia32",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Windows ia32",
   "os": [
     "win32"

npm/socket-patch-win32-x64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-win32-x64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Windows x64",
   "os": [
     "win32"