What's Changed

• test(setup): experimental end-to-end setup-flow matrix (all ecosystems, workspaces, monorepo) by Mikola Lysenko (@mikolalysenko) in #98
• ci: remove changelog rollover from release workflow by Mikola Lysenko (@mikolalysenko) in #97
• feat(setup): add --check and --remove flags with dry-run + edit previews by Mikola Lysenko (@mikolalysenko) in #99
• feat: package-manager-agnostic PyPI post-install patch hook (.pth) by Mikola Lysenko (@mikolalysenko) in #100
• feat(cargo): project-local [patch]-redirect backend + single fail-closed guard by Mikola Lysenko (@mikolalysenko) in #102
• feat(golang): project-local go.mod [replace]-redirect backend + fail-closed guard by Mikola Lysenko (@mikolalysenko) in #104
• feat(study-crates): test-file target + reward-hacking benchmark prompt by Mikola Lysenko (@mikolalysenko) in #101
• feat(setup): fix cargo release blocker, close all 5 contract gaps, add composer + gem publishing by Mikola Lysenko (@mikolalysenko) in #105
• fix: correctness bug sweep + hardening tests across crawlers, patch, and vex by Mikola Lysenko (@mikolalysenko) in #106
• refactor(cargo): patch crates in place; drop the [patch]-redirect backend + build guard by Mikola Lysenko (@mikolalysenko) in #107
• feat(api): batch patch lookups through the public proxy in scan by Mikola Lysenko (@mikolalysenko) in #108
• feat: socket-patch vendor — committable vendoring of patched dependencies by Mikola Lysenko (@mikolalysenko) in #109
• feat: integrate vendor with scan/apply/vex — scan --vendor/--detached, vendor-aware lifecycle by Mikola Lysenko (@mikolalysenko) in #110
• fix: second-pass bug sweep — crawler traversal guards, FIFO hangs, atomic writes, CLI contract by Mikola Lysenko (@mikolalysenko) in #111
• feat: vendor/scan/apply overhaul — lockfile-driven discovery, verified auto-fetch, mismatch-tolerant apply by Mikola Lysenko (@mikolalysenko) in #115
• feat(vendor): download prebuilt patched packages from patch.socket.dev (--vendor-source) by Mikola Lysenko (@mikolalysenko) in #116
• feat: three patch-apply modes — hosted, vendored, agent — with full ecosystem + VEX coverage by Mikola Lysenko (@mikolalysenko) in #117
• cleanup: CLI simplify pass, correctness fixes, core dedups, scan split, docs sync (−587 net lines) by Mikola Lysenko (@mikolalysenko) in #120
• fix(vendor): verify the extracted tree after a service-download, not just the archive bytes by Mikola Lysenko (@mikolalysenko) in #122
• ci: fix cargo cache eviction — rust-cache, per-suite e2e keys, main-only saves by Mikola Lysenko (@mikolalysenko) in #121
• chore(deps): Bump serde_with from 3.20.0 to 3.21.0 by Dependabot (@dependabot)[bot] in #123
• feat!: remove unlock + --break-lock, fold lock cleanup into repair, reorder --help by Mikola Lysenko (@mikolalysenko) in #124
• feat(config): socket login now configures socket-patch — socket-cli config.json fallback + SOCKET_CLI_* aliases by Mikola Lysenko (@mikolalysenko) in #125
• fix(test): e2e_safety_pnpm — don't follow pnpm 10.34's store→project symlinks by Mikola Lysenko (@mikolalysenko) in #126
• docs: README overhaul on the Divio model + ecosystems doc split + auth/config alignment by Mikola Lysenko (@mikolalysenko) in #127
• feat: socket-patch --update self-update + passive update notifier by Mikola Lysenko (@mikolalysenko) in #128
• test(vendor): yarn 1 dev-flow e2e — lockfile re-save survival + strapi-incident guards by Mikola Lysenko (@mikolalysenko) in #129
• feat(cli): hidden --mode aliases — vendor/host by Mikola Lysenko (@mikolalysenko) in #130
• test(redirect): yarn classic hosted-mode capstone e2e by Mikola Lysenko (@mikolalysenko) in #132
• fix(redirect): fail closed on non-npm: berry descriptors + yarn layering regression suite by Mikola Lysenko (@mikolalysenko) in #131
• feat(vendor): warn when a wired classic yarn.lock is one berry install from silent de-patching by Mikola Lysenko (@mikolalysenko) in #133
• fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch by Mikola Lysenko (@mikolalysenko) in #134
• test: fix hostile-decoy env race flaking the setup-matrix and e2e suites by Mikola Lysenko (@mikolalysenko) in #135
• test: exclude crawler-e2e siblings from #[serial] env swaps via #[parallel] by Mikola Lysenko (@mikolalysenko) in #136
• chore(deps): Bump quinn-proto from 0.11.14 to 0.11.16 by Dependabot (@dependabot)[bot] in #137
• feat(release): publish to every supported ecosystem from one release dispatch (Maven Central + NuGet + consolidated release.yml) by Mikola Lysenko (@mikolalysenko) in #138
• feat(release): version-bump automation + shared release-readiness gate by Mikola Lysenko (@mikolalysenko) in #139
• fix(update): retry sanity-exec on ETXTBSY — deflake coverage and harden self-update against the fork/exec fd race by Mikola Lysenko (@mikolalysenko) in #140
• test(hosted): production e2e for scan --mode hosted across every ecosystem and package manager by Mikola Lysenko (@mikolalysenko) in #141
• test: hermetic package-manager caches — squash of #142/#143/#144 + review fixes + hosted-e2e unblock by Mikola Lysenko (@mikolalysenko) in #146
• fix(scan,get): rank patches by severity, then merge state, then patch recency by Mikola Lysenko (@mikolalysenko) in #147
• test(hosted): decide the gem tolerance by probing the server by Mikola Lysenko (@mikolalysenko) in #149
• Structure-review batch: sweep fixes, module taxonomy, npm-family dedup, coverage gaps, CI honesty by Mikola Lysenko (@mikolalysenko) in #150
• chore: blame-ignore the #150 squash; retry the bun download in the npm image by Mikola Lysenko (@mikolalysenko) in #156
• fix(get,scan): retain patch-added new files; guard empty patch records by Mikola Lysenko (@mikolalysenko) in #158
• fix(scan): warn to run pnpm install --trust-lockfile after a hosted pnpm redirect by Mikola Lysenko (@mikolalysenko) in #159
• fix(test): unbreak main — give four get edge-case fixtures a real file for #158's guardrail by Mikola Lysenko (@mikolalysenko) in #168
• fix(scan): honor --vendor-source in the vendored flow by Mikola Lysenko (@mikolalysenko) in #160
• fix(test): deflake update-notifier e2e on Windows CI (grace-budget race) by Mikola Lysenko (@mikolalysenko) in #171
• feat: promote maven and nuget to fully available — retire the SOCKET_EXPERIMENTAL_* gates by Mikola Lysenko (@mikolalysenko) in #170
• fix(vendor/pypi_uv): reconstruct [package.metadata] for path-sourced uv packages by Mikola Lysenko (@mikolalysenko) in #167
• fix(vendor): count skipped packages, not advisory warnings by Mikola Lysenko (@mikolalysenko) in #166
• fix(vendor): recover pypi wheels for pdm/poetry/pipenv, not just uv by Mikola Lysenko (@mikolalysenko) in #165
• fix(scan): keep hosted --json envelope schema-consistent across discovery by Mikola Lysenko (@mikolalysenko) in #163
• fix(scan): stop the false [UPDATE] nag for equal-or-older batch-ranked patches by Mikola Lysenko (@mikolalysenko) in #162
• fix(vendor): resolve installed packages via the qualified-purl-aware lookup by Mikola Lysenko (@mikolalysenko) in #157
• test(vendored): real-production e2e for scan --mode vendored across every package manager by Mikola Lysenko (@mikolalysenko) in #169
• fix(scan): warn when a mode takeover leaves the other ledger stale by Mikola Lysenko (@mikolalysenko) in #164
• fix(gem): bundler vendored+hosted audit — 13 confirmed bugs fixed, tests hardened by Mikola Lysenko (@mikolalysenko) in #175
• fix(vendor): match bun tuples on version, keep CRLF by Mikola Lysenko (@mikolalysenko) in #180
• fix(hosted): honest warnings for pnpm/yarn/bun and CRLF locks by Mikola Lysenko (@mikolalysenko) in #182
• fix(hosted): re-redirect stale bun.lock URLs, fail closed on drift by Mikola Lysenko (@mikolalysenko) in #186
• fix(vendor): accurate refusals for bundled/alias/CRLF lock shapes by Mikola Lysenko (@mikolalysenko) in #185
• fix(redirect): atomic fail-closed ledger, ledger-aware updates[] by Mikola Lysenko (@mikolalysenko) in #192
• fix(vendor): carry berry lock original across patch updates by Mikola Lysenko (@mikolalysenko) in #190
• fix(vendor): refuse catalo...

What's Changed

• docs: consolidate global CLI options + document OpenVEX generation by Mikola Lysenko (@mikolalysenko) in #93
• feat(apply,scan): generate OpenVEX document inline via --vex by Mikola Lysenko (@mikolalysenko) in #94
• chore(deps): Bump tar from 0.4.45 to 0.4.46 by Dependabot (@dependabot)[bot] in #95
• chore(release): bump version to 3.3.0 by Mikola Lysenko (@mikolalysenko) in #96

Full Changelog: v3.2.0...v3.3.0

What's Changed

• ci(release): adopt npm staged publishing via OIDC by Mikola Lysenko (@mikolalysenko) in #87
• refactor: dedupe ecosystem dispatch, telemetry, API client, cleanup, get by Mikola Lysenko (@mikolalysenko) in #88
• test(args): regression coverage for BoolishValueParser on env bools by Mikola Lysenko (@mikolalysenko) in #89
• feat(pypi): narrow/broad release breadth + multi-variant remove/rollback fixes by Mikola Lysenko (@mikolalysenko) in #90
• feat(gem,maven): extend multi-platform release patching to RubyGems + Maven by Mikola Lysenko (@mikolalysenko) in #91
• fix: repo-wide correctness, security & filesystem-safety hardening pass (v3.2.0) by Mikola Lysenko (@mikolalysenko) in #92

Full Changelog: v3.1.0...v3.2.0

What's Changed

• fix: use npx/pnpm dlx @socketsecurity/socket-patch and add dependencies script by Mikola Lysenko (@mikolalysenko) in #63
• chore(deps): Bump quinn-proto from 0.11.13 to 0.11.14 by Dependabot (@dependabot)[bot] in #40
• chore(deps): Bump rand from 0.9.2 to 0.9.4 by Dependabot (@dependabot)[bot] in #65
• chore(deps): Bump rustls-webpki from 0.103.9 to 0.103.13 by Dependabot (@dependabot)[bot] in #66
• feat(patch): add package- and diff-level patch sources by Mikola Lysenko (@mikolalysenko) in #67
• test(cli): foundation for CLI-contract unit-test campaign by Mikola Lysenko (@mikolalysenko) in #68
• feat(scan): unified auto-update engine — --sync, --prune, --dry-run (v3.0) by Mikola Lysenko (@mikolalysenko) in #79
• feat(apply): safety hardening — atomicity, locking, pnpm CoW, sidecars, Maven gate by Mikola Lysenko (@mikolalysenko) in #80
• feat(vex): OpenVEX 0.2.0 attestation generator by Mikola Lysenko (@mikolalysenko) in #81
• feat: telemetry coverage for read-side commands + paid-tier fallback (3.1.0) by Mikola Lysenko (@mikolalysenko) in #82
• update release workflow by Mikola Lysenko (@mikolalysenko) in #84
• ci(release): tag after build + fix rustup toolchain setup by Mikola Lysenko (@mikolalysenko) in #85
• ci(release): pin newer cross NDK image for aarch64-linux-android by Mikola Lysenko (@mikolalysenko) in #86

New Contributors

• Dependabot (@dependabot)[bot] made their first contribution in #40

Full Changelog: v2.1.4...v3.1.0

What's Changed

• fix: tolerate already-published npm packages in release workflow by Wenxin Jiang (@Wenxin-Jiang) in #61
• v2.1.4: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #62

Full Changelog: v2.1.3...v2.1.4

What's Changed

• fix: pin Node 22.22.1 in release workflow by Wenxin Jiang (@Wenxin-Jiang) in #58
• v2.1.3: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #59

Full Changelog: v2.1.2...v2.1.3

What's Changed

• Add explicit node types for TypeScript 6 compat by Jake Verbaten (@Raynos) in #51
• fix: harden core error handling, blob verification, and force-mode reporting by Wenxin Jiang (@Wenxin-Jiang) in #56
• fix: add apply diagnostics for silent no-op failures by Wenxin Jiang (@Wenxin-Jiang) in #53
• fix: surface crawler find_by_purls errors instead of swallowing by Wenxin Jiang (@Wenxin-Jiang) in #55
• fix: add error handling to get command for blob/decode failures by Wenxin Jiang (@Wenxin-Jiang) in #54
• v2.1.2: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #57

New Contributors

• Jake Verbaten (@Raynos) made their first contribution in #51

Full Changelog: v2.1.1...v2.1.2

What's Changed

• fix: use npx @socketsecurity/socket-patch for postinstall command by Mikola Lysenko (@mikolalysenko) in #39
• feat: unflag Ruby gem support and add e2e bundler tests by Mikola Lysenko (@mikolalysenko) in #41
• fix: harden GitHub Actions workflows by Ryan Eberhardt (@reberhardt7) in #44
• fix: prioritize pnpm-workspace.yaml detection and restrict setup to root package.json by Wenxin Jiang (@Wenxin-Jiang) in #45
• fix: split release workflow into PR-based prep + auto-publish by Wenxin Jiang (@Wenxin-Jiang) in #47
• fix: simplify release to workflow_dispatch (no bot commits) by Wenxin Jiang (@Wenxin-Jiang) in #48
• v2.1.1: bump and sync package versions by Wenxin Jiang (@Wenxin-Jiang) in #49

New Contributors

• Wenxin Jiang (@Wenxin-Jiang) made their first contribution in #45

Full Changelog: v2.1.0...v2.1.1

What's Changed

• feat: add full glibc/musl support for all Linux architectures by Mikola Lysenko (@mikolalysenko) in #38

Full Changelog: v2.0.0...v2.1.0

What's Changed

• feat: interactive prompts and smart patch selection by Mikola Lysenko (@mikolalysenko) in #37

Full Changelog: v1.7.1...v2.0.0