chore: bump version to 7.0.1

fix(catalog): sync the lib-stable alias to its 6.5.3 base

`stable-aliases-match-base` went red on main. The base catalog entry
`@socketsecurity/lib` moved to 6.5.3 in the cascade at 878be16 while the
`@socketsecurity/lib-stable` alias stayed pinned at 6.5.2, so imports of the
`-stable` surface resolved an older build than the catalog ships.

The rule is that a `-stable` alias pins the SAME version as its floating base:
update a Socket package, update its alias too. 6.5.3 is published, so the
alias resolves.

Found by CI rather than by the pre-push gate: the pre-push lane runs lint and
type-check, not the 213-check suite, so a catalog desync reaches main before
anything blocks it. `pnpm run fix` did not reconcile it in that lane despite
the check's own suggestion, so the entry is synced directly.

chore: bump version to 6.7.0

Merge origin/main: absorb #224 + CVE-fix commits already cherry-picke…

…d onto the 6.5.3 release train

v6.5.2

Reconciled by hand. The publish pipeline shipped 6.5.2 to npm on 2026-07-31
at 04:57 UTC but the version-bump commit was lost to a squash, so no commit
in history sets the version to 6.5.2 and release-reconcile could not derive
a tag on its own.

2fb463c is the last commit before that publish; the next commit (073e3fb)
points the self-pin at 'the published 6.5.2', which brackets it.

chore(wheelhouse): cascade template@705da6ebb

Auto-applied by socket-wheelhouse sync-scaffolding into socket-lib.
24 file(s) touched:
  - .claude/hooks/fleet/_shared/copyleft-upstreams.mts
  - .claude/hooks/fleet/_shared/payload.mts
  - .claude/hooks/fleet/no-copyleft-source-read/index.mts
  - .claude/hooks/fleet/playwright-launch-guard/README.md
  - .claude/hooks/fleet/playwright-launch-guard/index.mts
  - .claude/skills/fleet/cascading-fleet/lib/fleet-repos.json
  - .git-hooks/_shared/file-scan.mts
  - .git-hooks/_shared/helpers.mts
  - .git-hooks/fleet/pre-commit.mts
  - docs/agents.md/fleet/bypass-phrases.md
  - docs/agents.md/fleet/copyleft-boundaries.md
  - docs/agents.md/fleet/hook-registry.md
  - scripts/fleet/_shared/check-steps-paths.mts
  - scripts/fleet/check/playwright-launches-are-sanctioned.mts
  - scripts/fleet/check/private-paths-are-absent.mts
  - scripts/fleet/publish-infra/npm/approve.mts
  - scripts/fleet/publish-infra/npm/browser-session.mts
  - scripts/fleet/publish-infra/npm/scan.mts
  - scripts/fleet/publish-infra/npm/staged-browser-read.mts
  - scripts/fleet/publish-infra/npm/staged.mts
  ... and 4 more

chore: bump version to 6.5.0 (#212)

Co-authored-by: socket-release-bot[bot] <234652667+socket-release-bot[bot]@users.noreply.github.com>

fix(native-messaging): resolve XDG_CONFIG_HOME through the env rewire…

… so tests never leak the runner config

chore(build): regenerate the browser builtin map under node 26

aligns the tracked manifest with the release builder's output — node 26
dropped the legacy _stream_* modules the map enumerated under node 24.

chore: bump version to 6.2.3