[Mikola Lysenko (mikolalysenko)]

Summary

The ## [5.1.0] section came out of a release-staging routine running on a shallow clone, so it cited only about 80 of the 342 PRs merged since v5.0.1 (#2032 says its covered range was 50 first-parent PRs). This PR rewrites the section to cover all of them, including the PRs merged today (#2005, #2009, #2012, #2018, #2021, #2046):

• User-visible changes are grouped by ecosystem under Added / Changed / Fixed / Performance.
• CI, test, refactor and dependency PRs with no change in behavior are listed under Maintenance.
• A script confirmed that every PR in v5.0.1..c75172472 is cited, except the release chores chore(release): 5.1.0 #2032/chore(release): 5.1.0 notes for PRs merged during review #2033/chore(release): 5.1.0 notes for #2010 and #2025 #2038/chore(release): 5.1.0 note for #1966 #2043.
• scripts/release-lint.sh --stable-only --tag-check and release.py changelog check --version 5.1.0 both pass.

#1646 ships as a fix in 5.1.0

#1646 makes scan/apply skip, and get/vendor refuse, packages the project patches itself (pnpm/yarn/patch-package/npm/Bun/Composer/Cargo/Go). Agent apply also stops overwriting unknown file drift. CLI_CONTRACT classified this as MAJOR. The maintainer decision is to ship it in 5.1.0 as a fix: a Socket patch on top of a project's own patch leaves an install that fails or runs only one of the two, and --allow-patch-conflicts is the explicit per-run opt-in to the old behavior. This PR:

• leads ### Changed with that rationale;
• updates CLI_CONTRACT's "Release classification: MAJOR" paragraph to match.

Other changes that tighten defaults (all documented under Changed/Fixed)

Some other changes turn a "success" exit 0 into a refusal. In each case the old run left the build unpatched or broken: gitignored vendor ledger/artifacts (#1640/#1593/#1656), an unreadable manifest → manifest_unreadable (#1776), vendor from an npm workspace member (#1928), Maven profile-bypassed pins refused (#2005), and GOFLAGS=-modfile (#1800). Other notable changes:

• fix: vendor hosted patches directly from lockfiles #1648: plain vendor with hosted pins now ejects only the lockfile's hosted patches.
• Build(deps): Bump zod from 3.25.76 to 4.6.6 in /npm/socket-patch #1702: the npm schema export moves to zod 4.

The date line stays 2026-11-06. Update it if you want it to match the dispatch day.

Release blocker found in smoke testing (separate PR)

Agent-mode native rebuild of nokogiri failed under the default crawl root, because GEM_PATH and the spec path were passed relative. The fix, on branch fix/gem-native-relative-gem-home, needs to land before Release is dispatched.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes to release notes and CLI contract wording; no runtime behavior in this diff.

Overview
Fills in the ## [5.1.0] CHANGELOG so it documents every user-facing and maintenance PR merged since v5.0.1, not the earlier partial set. New bullets are grouped by ecosystem under Added, Changed, Fixed, and Performance, with no-behavior PRs lumped under Maintenance (including a long issue-number roll call).

Updates CLI_CONTRACT.md for “Existing project patches”: release classification moves from MAJOR to fix (shipped in 5.1.0), with rationale that skipping/refusing when the project already patches the same package avoids broken installs and that --allow-patch-conflicts is the explicit per-run opt-in.

^{Reviewed by Cursor Bugbot for commit 01e242a. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: 01e242aac4d8bb0c84f51c4a0aff7c55bc0e4d15
• CI: every check on this head passed or was skipped by the dispatcher (ci-ok success). No main-wide failures.
• Bugbot: reviewed this head, no findings.
• Mergeable, no conflicts. This is a release PR, so its CHANGELOG.md changes are expected.
• For reviewers: the PR body says the nokogiri relative-crawl-root fix (Rebuild gem native extensions from a relative crawl root #2048) must land before Release is dispatched. Also look at the CLI_CONTRACT.md reclassification of fix(cli)!: require consent before patching user-patched packages #1646 from MAJOR to fix.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does. Release-notes-only PR for 5.1.0: rewrites the ## [5.1.0] CHANGELOG section so it cites every PR merged since v5.0.1 (the earlier draft came from a shallow clone and cited ~80 of 342), and reclassifies #1646 (project-owned-patch protection) in CLI_CONTRACT.md from MAJOR to a fix shipped in 5.1.0. No code changes.

Risk: low. Two Markdown files. Merging doesn't publish anything: release.yml runs only on manual dispatch.

Look here

• CHANGELOG.md:77: the lead ### Changed entry that ships fix(cli)!: require consent before patching user-patched packages #1646 as a fix. This is the semver call the approver is signing off on.
• CLI_CONTRACT.md:146: the matching MAJOR → fix reclassification.
• CHANGELOG.md:138: ### Fixed, which lists the other defaults that now refuse instead of exiting 0 (Fix gitignored ledger/manifest silently dropped (#1638) #1640/Fix PyPI vendored wheels lost to gitignore/LFS (#1572) #1593/Fix repair leaving npm vendor dirs uncommittable (#1581) #1656, Fix manifest read errors treated as absent (#998, #1063, #1123) #1776, Fix vendor in a workspace member exiting 0 (#1921) #1928, Fix Maven VEX false attestation through profiles, properties and coordinates #2005, Fix Go patches ignoring GOFLAGS=-modfile (#1799) #1800).
• CHANGELOG.md:26: the date line still says 2026-11-06.

Verified

• Coverage: on a full-history clone, git log v5.0.1..origin/main lists 342 squash-merged PRs. Every one is cited in [5.1.0] except the release chores chore(release): 5.1.0 #2032/chore(release): 5.1.0 notes for PRs merged during review #2033/chore(release): 5.1.0 notes for #2010 and #2025 #2038/chore(release): 5.1.0 note for #1966 #2043, as the description says. No PR merged before v5.0.1 is cited, and the extra #N references in the section are not PRs merged in this range (they appear to be issue numbers). Text removed from the old section (e.g. Stop attesting NuGet versions the writers refuse #2007, Read BOM composer locks and pin that no lock pin drives a download #2017) is still covered in the rewrite.
• scripts/release-lint.sh --stable-only --tag-check: all checks pass (versions are already 5.1.0, the npm lock matches, tag v5.1.0 doesn't exist yet). release.py changelog check --version 5.1.0 passes.
• CI: ci-ok and clippy are green on 01e242aac4. Bugbot reviewed this head and found nothing. No open review threads, no conflicts.
• CHANGELOG.md changes are expected here because this is a release/v* branch.

Changes I made: none.

Open questions (not blocking)

• Rebuild gem native extensions from a relative crawl root #2048 (the nokogiri relative-crawl-root fix) is a release blocker per the description, but [5.1.0] doesn't mention it yet. Once Rebuild gem native extensions from a relative crawl root #2048 merges, the release agent should add a Fixed line for it before Release is dispatched.
• Should the date line be bumped to the dispatch day?

Auto-merge (squash) is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code