Repository navigation
chore(release): 5.0.0 release notes for PRs merged since the bump - #1432
Merged
Merged
Conversation
Fold the 117 PRs merged to main after the 5.0.0 version bump (#1194, 6c01c7f..1779317) into the [5.0.0] section and re-date it 2026-10-12, so the release cut from main HEAD documents what it ships. - Breaking: mode kept from project state (#1088), one JSON envelope for every command (#931/#1062), one GC JSON shape (#1257/#1066), one package-target grammar with case-preserving identity (#453/#1292), --download-mode removed (#792). Existing bullets superseded by the envelope (agent failed events, hosted redirect.patches) updated. - Added: OS trust store + SSL_CERT_FILE, go env -w, Go resync warnings, Pipenv/uv sibling co-wiring, pnpm --update hints, stale Bundler plugin and yarn member-dir warnings, telemetry, v5 tiers. - Fixed: credential redaction, --manifest-path, GC/repair, plus per-ecosystem fixes (JVM, NuGet, Go, Composer, npm family, Cargo, RubyGems, PyPI). - Maintenance: docs, crate cleanup and CI condensed into three bullets. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Mikola Lysenko (mikolalysenko)
enabled auto-merge
October 12, 2026 14:13
Collaborator
Author
|
bugbot run Generated by Claude Code |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit a06a3ab. Configure here.
Mikola Lysenko (mikolalysenko)
added
the
Ready for review
Collaborator
Author
|
Ready for review (burn-down agent)
Generated by Claude Code |
Collaborator
Author
Final review briefWhat it does: Brings the untagged Risk: low. The change is docs only, and every new entry traces to a commit on main. No Look here
Verified
Changes I made: none. Open questions (non-blocking; the release agent can fold these into a follow-up)
Auto-merge (squash) is armed, so approving sends this straight to the merge queue. Generated by Claude Code |
Wenxin Jiang (Wenxin-Jiang)
approved these changes
Oct 12, 2026
This was referenced Oct 12, 2026
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Oct 13, 2026
* ci(release): publish npm from release.yml, not publish-npm.yml Every socket-patch npm package's trusted publisher is registered against release.yml, and npm allows only one publisher per package. The 5.0.0 release dispatched publish-npm.yml, whose OIDC token named that file, so npm rejected it with E401 before staging anything. Move the npm leg back inline as release.yml's npm-publish job (same steps as publish-npm.yml) and delete publish-npm.yml, so the existing registration keeps working. Add an `npm-retry-version` input that skips the version gate, build, tag, GitHub release and crates.io jobs and re-stages npm from an existing release's assets; this retries 5.0.0 now and replaces the manual Publish npm dispatch. crates.io stays dispatched through publish-cargo.yml, since crates.io allows several publishers per crate. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): fold 22 more PRs into the 5.0.0 notes Cover the PRs merged to main after #1432's base (1779317..4cb3643): Cargo source replacement and registry = "crates-io" (#338/#455, #386), pnpm lockfile=false (#1074), berry removed descriptors (#1435), yarnrc ${VAR} reads (#1100), CRLF .npmrc append (#1196), Composer vendor-dir cascade and global home (#439/#686, #586), Go +incompatible vex (#484), gem moved BUNDLE_GEMFILE and commented Gemfile revert (#952, #988), Poetry source = "pypi" (#1282) and Hatch path characters (#547). No entries for #1411 (macOS fix to code #1393 added in this release; the #1393 entry already describes the intended behavior), #1426 (perf regression introduced and fixed within 5.0.0) or the CI/test/bench PRs. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): cover #1419, #1434, #1440, #1442, #1444 in the 5.0.0 notes Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): 5.0.1 Cut [Unreleased] into [5.0.1] — 2026-10-13 and stamp 5.0.1 with scripts/version-sync.sh. The 5.0.1 notes cover main through 501c6d9 (#1449), i.e. every PR after the v5.0.0 tag (6ad6add): the npm publish fix (5.0.0 never reached npm or crates.io, 5.0.1 is the first v5 there), #1465, #759, #1460, #1462, #1445, #869, #1447, #1450, #1467, and #1449 under Maintenance. CI/test-only PRs (#1448, #1452, #1454, #1457, #1459) have no entries. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(release): 5.0.1 notes for PRs merged since the cut Covers #1469, #1470, #1474, #1475, #1478, #1479, #1480 and #1482; #1484 is CI-only. The notes now cover main through 285a5e8. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release-notes PR for the v5.0.0 cut. Editing CHANGELOG.md is allowed here: this is release work, not a feature PR.
What changed
The 5.0.0 version bump (#1194) merged on 2026-10-09. Since then, 117 PRs have landed on main (
6c01c7f78..17793173f). The release will be cut from main HEAD, so this PR adds those PRs to the existing## [5.0.0]section and changes its date to 2026-10-12.[Unreleased]stays empty, and version stamps are unchanged.scan/getkeeps the project's existing mode (Decide: make the command model read-only scan plus fix/undo/sync, with mode taken from project state, and make "nothing to undo" exit 0 #1088). Every command prints one--jsonenvelope (An unparseable .socket/manifest.json is reported under five different --json error codes depending on the command #931, scan exits 1 in human output but 0 with --json when every patch query returns nothing #1062). Artifact GC reports one JSON shape (Artifact GC is reported in four JSON shapes, and the bytesFreed/bytes fields the contract documents are emitted by no command #1257, rollback --json counters count only the agent leg, so hosted and vendored failures report failed: 0 #1066).get/remove/rollbackuse one package-target grammar with case-preserving identity (get <uuid>overrides socket.yml without the documentedpolicy_bypassedwarning (purl/CVE/GHSA forms do warn) #453, remove, rollback and get treat case-distinct packages as one:remove pkg:npm/jsonstreamalso removes JSONStream's patch #1292).--download-modeis removed (Decide: make --download-mode file the default and retire the diff download path #792). Three existing bullets that the envelope change superseded are updated: the first bullet on the hosted default, failed apply events, and hostedredirect.patches.SSL_CERT_FILEsupport, settings fromgo env -w, Go resync warnings, Pipenv/uv co-wiring of the exportedrequirements.txtandpylock.toml, pnpm--updatecommands, warnings for a stale Bundler plugin and yarn member-dir installs, telemetry additions, and the v5 support tiers.--manifest-path, GC/repair, and fixes grouped by ecosystem (JVM, NuGet, Go, Composer, npm family, Cargo, RubyGems, PyPI).Checks
scripts/release-lint.sh --stable-only --tag-check: all checks passed, with 157 entries in[5.0.0].python3 scripts/release.py changelog check --version 5.0.0passed.python3 -m unittest test_release.ChangelogTests: 8 tests OK.🤖 Generated with Claude Code
Note
Low Risk
Documentation-only release notes in CHANGELOG.md; no runtime or API code changes in this PR.
Overview
Updates the 5.0.0 changelog section (release date 2026-10-12) with user-facing notes for 117 PRs merged after the initial version bump, without touching version stamps or
[Unreleased].Breaking changes are expanded and aligned with shipped behavior: bare
scan/getpreserve an existing project mode; unified--jsonenvelopes and GC shape; shared package-target grammar; removal of--download-mode; wording fixes for hosted defaults and failed apply reporting.Added, Fixed, and maintenance bullets capture TLS/Go/pnpm telemetry, credential redaction,
--manifest-path, and ecosystem-grouped fixes (JVM, NuGet, Go, npm, Cargo, Ruby, PyPI), plus condensed docs/CI cleanup notes.Reviewed by Cursor Bugbot for commit a06a3ab. Configure here.
Generated by Claude Code