v5.0.0

What's Changed

• fix(test): unflake the apply_lock orphaned-inode race; extend the hosted gem pin for production's fifth 6.0.3 patch by Mikola Lysenko (@mikolalysenko) in #232
• ci(release): decompose registry publishing into independently dispatchable per-registry workflows by Mikola Lysenko (@mikolalysenko) in #230
• fix(maven): send the official Maven CLI user agent to the maven2 registry; refresh npm wrapper lock for published 4.0.0 platform packages by Mikola Lysenko (@mikolalysenko) in #233
• feat!: scan↔rollback duality — full-state rollback default, --preserve-state, path targeting by Mikola Lysenko (@mikolalysenko) in #231
• test(e2e): demote the cargo production legs to canary status — free cargo tier is unpublished by Mikola Lysenko (@mikolalysenko) in #235
• fix(ci): regenerate the npm wrapper lock with CI's npm major by Mikola Lysenko (@mikolalysenko) in #234
• Coverage audit: 39 bug fixes + test extension to 98.2% line coverage by Mikola Lysenko (@mikolalysenko) in #236
• Preserve pip patch markers and hash checks by Mikola Lysenko (@mikolalysenko) in #237
• Preserve Python patches across uv lockfiles by Mikola Lysenko (@mikolalysenko) in #238
• Harden uv lockfile patch preservation and verify every uv release family by Mikola Lysenko (@mikolalysenko) in #239
• Fix pnpm hosted redirects across legacy and peer lock entries by Mikola Lysenko (@mikolalysenko) in #240
• Support hosted and legacy Poetry patches by Mikola Lysenko (@mikolalysenko) in #241
• Support hosted and vendored Hatch patches by Mikola Lysenko (@mikolalysenko) in #244
• Support hosted Pipenv patches and safe vendoring by Mikola Lysenko (@mikolalysenko) in #242
• Support hosted and vendored PDM patches by Mikola Lysenko (@mikolalysenko) in #243
• Fix Bun patch compatibility and annotations by Mikola Lysenko (@mikolalysenko) in #245
• Add native bun.lockb patching for hosted and vendored modes by Mikola Lysenko (@mikolalysenko) in #246
• Cleanup: no .socket residue, locks that never outlive a command, manifest-free vendored mode by Mikola Lysenko (@mikolalysenko) in #247
• Consolidated terminal UI and CLI-wide output polish by Mikola Lysenko (@mikolalysenko) in #248
• Harden vendored-mode trust in patch-service artifacts by Mikola Lysenko (@mikolalysenko) in #249
• Keep vendored re-runs idempotent across patch-service outages by Mikola Lysenko (@mikolalysenko) in #250
• feat(vex): manifest-less VEX from hosted/vendored lockfiles + npm 12 allow-remote auto-config (v5) by Mikola Lysenko (@mikolalysenko) in #251
• Stop hosted Go redirects claiming unpatched deps by Mikola Lysenko (@mikolalysenko) in #252
• Fix Windows (yarn berry CRLF support) and first-run real-PM CI failures after #251 by Mikola Lysenko (@mikolalysenko) in #253
• Wire vendored cargo patches through Cargo.toml and tag the copy by Mikola Lysenko (@mikolalysenko) in #254
• Fix Cargo hosted workspace redirects by Mikola Lysenko (@mikolalysenko) in #256
• Speed up hosted and vendored scans: concurrent API requests, parallel crawl, single-pass rewriters by Mikola Lysenko (@mikolalysenko) in #257
• Add in-memory hosted engine and napi addon by Mikola Lysenko (@mikolalysenko) in #276
• Fix four vendored/hosted correctness bugs found while profiling by Mikola Lysenko (@mikolalysenko) in #268
• Support vlt in hosted, vendored and agent modes by Mikola Lysenko (@mikolalysenko) in #269
• Give the CI test job 50 minutes so Windows can finish by Mikola Lysenko (@mikolalysenko) in #278
• Match Composer patch versions like Composer does by Mikola Lysenko (@mikolalysenko) in #270
• Keep NuGet patches installed with and NuGet.config by Mikola Lysenko (@mikolalysenko) in #284
• v5 prerelease: scan → vex → vendor workflow, hosted by default by Mikola Lysenko (@mikolalysenko) in #277
• Fix #258: state the real Maven Trusted Checksums floor by Mikola Lysenko (@mikolalysenko) in #322
• Fix npm VEX attesting packages with an unpatched bundled copy (#325) by Mikola Lysenko (@mikolalysenko) in #337
• Fix Poetry venv discovery to match Poetry (#327, #329) by Mikola Lysenko (@mikolalysenko) in #330
• Fix npm rewiring git/URL/file lock entries (#326) by Mikola Lysenko (@mikolalysenko) in #345
• Fix JSON writers dropping CRLF/BOM/indent (#324, #351) by Mikola Lysenko (@mikolalysenko) in #357
• Keep Composer redirects and rollback consistent by Mikola Lysenko (@mikolalysenko) in #358
• Fix requirements.txt writers ignoring pip hash mode (#376) by Mikola Lysenko (@mikolalysenko) in #383
• Fix Pipenv venv discovery order (#334, #384) by Mikola Lysenko (@mikolalysenko) in #388
• Fix pnpm-workspace.yaml key detection and appends (#400, #402) by Mikola Lysenko (@mikolalysenko) in #414
• Fix ETXTBSY flake in vlt npx shim self-test by Mikola Lysenko (@mikolalysenko) in #441
• Fix global scan missing pipx venvs (#415) by Mikola Lysenko (@mikolalysenko) in #418
• Fix Pipenv matrix flake on 503/DNS transport blips by Mikola Lysenko (@mikolalysenko) in #419
• Fix hosted scan not reading the Pipfile (#333) by Mikola Lysenko (@mikolalysenko) in #425
• Fix -g touching the cwd project's state (#436, #445) by Mikola Lysenko (@mikolalysenko) in #446
• Fix vlt e2e legs failing when api.socket.dev blips by Mikola Lysenko (@mikolalysenko) in #448
• Fix Python crawler missing .egg-info installs (#447) by Mikola Lysenko (@mikolalysenko) in #452
• Fix agent scan/get skipping apply for recorded patches (#454) by Mikola Lysenko (@mikolalysenko) in #456
• Fix gem rollback pinning redirected transitive gems (#457) by Mikola Lysenko (@mikolalysenko) in #460
• Fix gem modes wiring a manifest Bundler ignores (#341, #390) by Mikola Lysenko (@mikolalysenko) in #431
• Fix npm crawler missing relocated dependency stores (#359, #362) by Mikola Lysenko (@mikolalysenko) in #365
• Fix vendored rescans failing on unwired ledger entries (#541) by Mikola Lysenko (@mikolalysenko) in #543
• Fix PyPI agent apply patching only one installed copy (#529, #501) by Mikola Lysenko (@mikolalysenko) in #538
• Fix Maven e2e flake when Central briefly serves a plugin as absent by Mikola Lysenko (@mikolalysenko) in #494
• Fix vendor -g rewiring the cwd project (#498) by Mikola Lysenko (@mikolalysenko) in #499
• Download vexctl instead of compiling it on Linux/Windows by Mikola Lysenko (@mikolalysenko) in #500
• Fix vendor prefetch breaker-test flake and outage over-requests by Mikola Lysenko (@mikolalysenko) in #510
• Fix uv pylock rollback shape (#407, #408) by Mikola Lysenko (@mikolalysenko) in #512
• Fix global Python scan missing uv and PDM installs (#449, #451) by Mikola Lysenko (@mikolalysenko) in #522
• Fix Poetry venv selection ignoring envs.toml (#476, #526) by Mikola Lysenko (@mikolalysenko) in #527
• Fix lock-only requirements.txt discovery (#412, #523) by Mikola Lysenko (@mikolalysenko) in #530
• Fix yarnrc compressionLevel comment refusal (#370) by Mikola Lysenko (@mikolalysenko) in #508
• Fix uv sources unwind on dotted/sub-table spellings (#544, #524) by Mikola Lysenko (@mikolalysenko) in #545
• Fix Bundler settings resolution order (#483, #507) by Mikola Lysenko (@mikolalysenko) in #532
• Fix Bun/vlt bundled copies left unpatched (#469, #471) by Mikola Lysenko (@mikolalysenko) in #472
• Fix Bun backtest flake: retry cells on vex-step transport errors by Mikola Lysenko (@mikolalysenko) in #565
• Fix npm crawler missing configured install roots (#493, #518) by Mikola Lysenko (@mikolalysenko) in #520
• Fix Python env discovery ignoring uv/PDM env (#502, #525, #528) by Mikola Lysenko (@mikolalysenko) in #540
• Fix npm overrides of git deps being refused (#490) by Mikola Lysenko (@mikolalysenko) in #491
• Fix vendored Python reverts refusing sibling edits (#385, #474) by Mikola Lysenko (@mikolalysenko) in #481
• Fix agent apply writing into shared package stores (#332, #361) by Mikola Lysenko (@mikolalysenko) in #486
• Fix requirements.txt pins not matched under PEP 440 (#475) by Mikola Lysenko (@mikolalysenko) in #478
• Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) by Mikola Lysenko (@mikolalysenko) in #442
• Add a scan benchmark suite and a CI performance gate by Mikola Lysenko (@mikolalysenko) in #485
• Fix npm crawler missing Bun, Deno and Yarn 4 stores (#366, #373, #405, #495) by Mikola Lysenko (@mikolalysenko) in #496
• Fix agent vex checking only one installed copy (#516) by Mikola Lysenko (@mikolalysenko) in #517
• Fix apply failing when patched deps are skipped (#403) by Mikola Lysenko (@mikolalysenko) in #555
• Fix berry mode takeover reverting before gates (#468, #369) by Mikola Lysenko (@mikolalysenko) in #470
• Fix yarn berry hosted pin leaking npm auth (#404) by Mikola Lysenko (@mikolalysenko) in #465
• Fix PyPI vendored to hosted takeover being refused (#328) by Mikola Lysenko (@mikolalysenko) in #503
• Recognize hosted Pipenv references through one shared grammar (#563) by Mikola Lysenko (@mikolalysenko) in #572
• Stream ZIP member hashes during vendored verification by Mikola Lysenko (@mikolalysenko) in #587
• Share pnpm vendoring and revert across lockfile dialects by Mikola Lysenko (@mikolalysenko) in #583
• Fix npm crawler oracle flake from symlink-cycle trees by Mikola Lysenko (@mikolalysenko) in #582
• Fix Gemfile rewrites duplicating gem declarations (#482, #548) by Mikola Lysenko (@mikolalysenko) in #552
• Bound patch API connects and stalled reads (#570) by Mikola Lysenko (@mikolalysenko) in #581
• Resolve vlt registry bases through one shared function (#562) by Mikola Lysenko (@mikolalysenko) in #574
• Fix npm/Bun VEX attesting a patch a same-lock copy skips (#588) by Mikola Lysenko (@mikolalysenko) in #589
• Fix Poetry matrix flakes on PyPI/patch API transport blips by Mikola Lysenko (@mikolalysenko) in #596
• Unify hosted NuGet routing and XML splice anchors by Mikola Lysenko (@mikolalysenko) in #597
• Fix PDM settings ignoring PDM's config layers (#609, #566) by Mikola Lysenko (@mikolalysenko) in #611
• Read NuGet and Cargo crawler project files through the FIFO-safe reader (#592) by Mikola Lysenko (@mikolalysenko) in #602
• Stream patch blob and diff downloads to disk (#571) by Mikola Lysenko (@mikolalysenko) in #607
• Retry patch API connections reset mid-handshake by Mikola Lysenko (@mikolalysenko) in #610
• Fix vendored Hatch running a planted hatch (#613) by Mikola Lysenko (@mikolalysenko) in #617
• Stop running the Linux test suite twice per CI run by Mikola Lysenko (@mikolalysenko) in #619
• Fix Bundler global config being ignored (#577) by Mikola Lysenko (@mikolalysenko) in #621
• Fix uv hosted unwind declaration matching (#606, #473) by Mikola Lysenko (@mikolalysenko) in #625
• Fix agent mode patching linked first-party source (#626) by Mikola Lysenko (@mikolalysenko) in #634
• Fix hosted gem redirect breaking multi-line and conditional gem lines (#340) by Mikola Lysenko (@mikolalysenko) in #637
• Release train PR 1: release.py core (offline stamp, rc versions, CHANGELOG sync/fold, blocker gate) by Mikola Lysenko (@mikolalysenko) in #643
• Fix Poetry data-dir and placeholder model (#608, #640) by Mikola Lysenko (@mikolalysenko) in #644
• Fix npm v1 lock losing a hosted patch on takeover (#659) by Mikola Lysenko (@mikolalysenko) in #660
• Fix vendored revert deleting through a symlinked vendor dir (#664) by Mikola Lysenko (@mikolalysenko) in #666
• Bench: cover Bun isolated .bun store; fix rescan restore by Mikola Lysenko (@mikolalysenko) in #667
• Fix vendored revert leaving created scaffold behind (#636, #670) by Mikola Lysenko (@mikolalysenko) in #672
• Fix pnpm modulesDir store being skipped (#661, #696) by Mikola Lysenko (@mikolalysenko) in #698
• Fix Hatch takeover leaving direct-ref permission (#674) by Mikola Lysenko (@mikolalysenko) in #680
• Fix vendored revert keeping artifact for removed lock entry (#665) by Mikola Lysenko (@mikolalysenko) in #689
• Fix Poetry/PDM lock splice drift (#694, #695) by Mikola Lysenko (@mikolalysenko) in #703
• Fix PyPI vendored→hosted takeover stranding unreachable pins (#699) by Mikola Lysenko (@mikolalysenko) in #708
• Fix yarn classic rewiring git-sourced lock blocks (#363) by Mikola Lysenko (@mikolalysenko) in #710
• Fix in-run hosted VEX attesting npm bundled copies (#325) by Mikola Lysenko (@mikolalysenko) in #669
• Share rollback artifact retention across remove and rollback by Mikola Lysenko (@mikolalysenko) in #600
• Fix yarn berry pin entry rendering (#697, #718) by Mikola Lysenko (@mikolalysenko) in #719
• Fix Bun lockfile inventory skipping hosted pins (#720) by Mikola Lysenko (@mikolalysenko) in #722
• Fix human scan skipping re-apply of recorded patches (#732) by Mikola Lysenko (@mikolalysenko) in #733
• Fix agent mode skipping npm-aliased copies (#356) by Mikola Lysenko (@mikolalysenko) in #738
• Fix bun.lockb prerelease order in hash check (#739) by Mikola Lysenko (@mikolalysenko) in #741
• Fix uv/Hatch hosted re-pin to a newer patch (#742, #650) by Mikola Lysenko (@mikolalysenko) in #743
• Fix pnpm 7/8 vendored specifier YAML quoting (#754) by Mikola Lysenko (@mikolalysenko) in #755
• Fix vendored pnpm shadowing workspace overrides (#360) by Mikola Lysenko (@mikolalysenko) in #785
• Fix vendored requirements.txt re-vendoring removed pins (#786) by Mikola Lysenko (@mikolalysenko) in #787
• Fix uv unwind of locks spelling upload_time (#788) by Mikola Lysenko (@mikolalysenko) in #789
• Fix Pipenv stale-install remedy ignoring lock categories (#790) by Mikola Lysenko (@mikolalysenko) in #795
• Fix vendored gem lookup beyond the first GEM section (#779) by Mikola Lysenko (@mikolalysenko) in #805
• Fix vendored pnpm package.json CRLF/BOM layout (#662) by Mikola Lysenko (@mikolalysenko) in #810
• Fix failed eject rewriting every root file (#687) by Mikola Lysenko (@mikolalysenko) in #752
• Fix Bun workspace literals left as paths in bun.lock (#803) by Mikola Lysenko (@mikolalysenko) in #811
• Fix hosted restore dropping registry tarball URLs (#557, #817) by Mikola Lysenko (@mikolalysenko) in #818
• Fix uv vendored revert half-reverting after a relock (#806, #821) by Mikola Lysenko (@mikolalysenko) in #822
• Fix vendored requirements.txt re-vendor to a superseding patch (#765) by Mikola Lysenko (@mikolalysenko) in #766
• Fix npm store copies missed by agent apply and vex (#601, #603) by Mikola Lysenko (@mikolalysenko) in #605
• Write CHANGELOG only when cutting a release by Mikola Lysenko (@mikolalysenko) in #848
• Fix rollback leaving directories apply created (#838) by Mikola Lysenko (@mikolalysenko) in #846
• Fix uv revert restoring a stale specifier (#840) by Mikola Lysenko (@mikolalysenko) in #841
• Fix vendored gem rewrite breaking positional args (#847) by Mikola Lysenko (@mikolalysenko) in #849
• Spawn CLI test children through one hermetic Command builder (#823) by Mikola Lysenko (@mikolalysenko) in #850
• Fix gem crawler missing Bundler 4 standalone bundle (#796) by Mikola Lysenko (@mikolalysenko) in #797
• Fix hosted scan from a workspace member pinning nothing or the wrong files (#590, #417) by Mikola Lysenko (@mikolalysenko) in #598
• Full Gradle support in agent, hosted and vendored modes by Mikola Lysenko (@mikolalysenko) in #646
• Fix Pipenv venv discovery settings view (#645, #546) by Mikola Lysenko (@mikolalysenko) in #654
• Fix vendor --check passing unwired vendored entries (#725) by Mikola Lysenko (@mikolalysenko) in #730
• Fix gem source-option guard missing git sources (#652) by Mikola Lysenko (@mikolalysenko) in #731
• Fix gem lock readers ignoring gems.locked (#736) by Mikola Lysenko (@mikolalysenko) in #750
• Fix yarn berry hosted pin of catalog deps (#632) by Mikola Lysenko (@mikolalysenko) in #763
• Fix store-copy fold dropping copy writes (#756, #772) by Mikola Lysenko (@mikolalysenko) in #774
• Fix npm VEX attesting a patch the twin lock lacks (#798) by Mikola Lysenko (@mikolalysenko) in #799
• Fix vendored mode replacing symlinked lockfiles (#627) by Mikola Lysenko (@mikolalysenko) in #802
• Fix rollback of pip-written pylock.toml (#804) by Mikola Lysenko (@mikolalysenko) in #807
• Fix vlt 1.3 brotli lock nodes being refused (#372) by Mikola Lysenko (@mikolalysenko) in #820
• Retry Composer/Maven/Gradle downloads on connect and TLS errors by Mikola Lysenko (@mikolalysenko) in #868
• Write every utils::fs atomic file through one stage-and-rename core (#728) by Mikola Lysenko (@mikolalysenko) in #858
• Compute sha256, sha1 and SRI digests through utils::digest (#706) by Mikola Lysenko (@mikolalysenko) in #865
• Fix npm 6 installing unpatched aliases (#432) by Mikola Lysenko (@mikolalysenko) in #813
• Fix PDM matrix flakes on PyPI/patch API transport blips by Mikola Lysenko (@mikolalysenko) in #860
• Read the go.mod module directive through go_mod_edit (#781) by Mikola Lysenko (@mikolalysenko) in #870
• Fix gem VEX ignoring out-of-tree bundle path (#709) by Mikola Lysenko (@mikolalysenko) in #712
• Fix pnpm global-store transitive deps passing silently (#362) by Mikola Lysenko (@mikolalysenko) in #829
• Cache the macOS vexctl build in the CI test job by Mikola Lysenko (@mikolalysenko) in #874
• sbt, Mill and scala-cli support in agent, hosted and vendored modes by Mikola Lysenko (@mikolalysenko) in #690
• Fix hosted gem redirect ignoring Bundler mirror.all (#681) by Mikola Lysenko (@mikolalysenko) in #684
• Fix report-only scan -g hint dropping -g (#464) by Mikola Lysenko (@mikolalysenko) in #777
• Fix vendored Pipenv re-vendor to a newer patch (#769) by Mikola Lysenko (@mikolalysenko) in #825
• Fix pip rollback refusing all-hosted requirements (#410) by Mikola Lysenko (@mikolalysenko) in #827
• Fix vendored npm-family tarballs dropped by .gitignore (#831) by Mikola Lysenko (@mikolalysenko) in #837
• Fix hosted yarn classic with an offline mirror (#364) by Mikola Lysenko (@mikolalysenko) in #839
• Fix Bun rewiring dropping the project's bun patch (#367) by Mikola Lysenko (@mikolalysenko) in #873
• Fix gem rewrite deleting a ;-joined declaration (#826) by Mikola Lysenko (@mikolalysenko) in #875
• Fix per-patch Poetry/PDM lock re-parse (#760, #762) by Mikola Lysenko (@mikolalysenko) in #877
• Fix Windows CI downloads failing on offline CA revocation by Mikola Lysenko (@mikolalysenko) in #885
• Bound crawler and tool probes through one spawn deadline (#845) by Mikola Lysenko (@mikolalysenko) in #886
• Fix pnpm member settings written to an ignored nested pnpm-workspace.yaml (#880, #881) by Mikola Lysenko (@mikolalysenko) in #888
• Cancel superseded npm/pnpm/Pipenv compatibility PR runs by Mikola Lysenko (@mikolalysenko) in #892
• Run pnpm install-proof as one job per Node runtime by Mikola Lysenko (@mikolalysenko) in #897
• Fix PyPI package specs ignoring PEP 503 spellings (#910) by Mikola Lysenko (@mikolalysenko) in #911
• Fix gem crawl ignoring Bundler path.system (#915) by Mikola Lysenko (@mikolalysenko) in #916
• Fix npm-family restore ignoring project registry (#908, #521) by Mikola Lysenko (@mikolalysenko) in #918
• Fix yarn classic unrewritable copies going unreported (#921, #857) by Mikola Lysenko (@mikolalysenko) in #924
• Bench: cover Gradle and Hatch hosted modes by Mikola Lysenko (@mikolalysenko) in #925
• Fix get <name> missing PyPI names spelled with _ or . (#926) by Mikola Lysenko (@mikolalysenko) in #927
• Fix vendored requirements refusing marker-split pins (#928) by Mikola Lysenko (@mikolalysenko) in #929
• Fix Pipenv project falling back to system Python (#504, #947) by Mikola Lysenko (@mikolalysenko) in #950
• Fix scan/get --json dropping apply failures (#424) by Mikola Lysenko (@mikolalysenko) in #955
• Fix unquoted scoped name in pnpm 7/8 vendored lock (#956) by Mikola Lysenko (@mikolalysenko) in #961
• Keep the hosted pin when a vendored takeover is refused (#853, #944) by Mikola Lysenko (@mikolalysenko) in #963
• Fix vendor --check unwired cause and remedy (#900) by Mikola Lysenko (@mikolalysenko) in #970
• Fix npm wrapper running the glibc binary on musl (#974) by Mikola Lysenko (@mikolalysenko) in #976
• Fix hosted runs from npm/yarn/bun workspace members pinning nothing (#884) by Mikola Lysenko (@mikolalysenko) in #901
• Fix hosted PyPI pinning platform-only wheels (#701, #932) by Mikola Lysenko (@mikolalysenko) in #984
• Fix pnpm vendored refusal missing quoted scoped aliases (#957) by Mikola Lysenko (@mikolalysenko) in #986
• Fix npm linked-store alias copies left unpatched (#852) by Mikola Lysenko (@mikolalysenko) in #987
• Fix quoted and ${VAR} requirements includes (#994) by Mikola Lysenko (@mikolalysenko) in #995
• Fix main CI red on stale digest pending-list entries by Mikola Lysenko (@mikolalysenko) in #1016
• Fix uv project with no env falling back to system Python (#964) by Mikola Lysenko (@mikolalysenko) in #965
• Fix uv dry run missing inline [tool.uv] refusal (#979) by Mikola Lysenko (@mikolalysenko) in #980
• Bound registry downloads by ApiTimeouts instead of a 60 s total deadline (#872) by Mikola Lysenko (@mikolalysenko) in #876
• Honor HTTP-date Retry-After on vendor-service retries through api::retry (#677) by Mikola Lysenko (@mikolalysenko) in #889
• Fix rollback/remove of an agent record superseded by a hosted pin (#933) by Mikola Lysenko (@mikolalysenko) in #934
• Fix pnpm lock/workspace readers missing a BOM (#903, #904, #905) by Mikola Lysenko (@mikolalysenko) in #909
• Fix gem crawler missing Bundler .bundle root (#967) by Mikola Lysenko (@mikolalysenko) in #968
• Fix hosted yarn classic pins missing berry warning (#907) by Mikola Lysenko (@mikolalysenko) in #917
• Fix gem takeover un-hosting a grouped gem (#775) by Mikola Lysenko (@mikolalysenko) in #776
• Fix VEX attesting beside an unpatched same-lock copy (#935, #938, #939) by Mikola Lysenko (@mikolalysenko) in #940
• Fix composer e2e flake on packagist connect timeouts by Mikola Lysenko (@mikolalysenko) in #1037
• Fix yarn berry project gates drifting between modes (#628, #629) by Mikola Lysenko (@mikolalysenko) in #657
• Fix Hatch environments being invisible to stale-install checks and VEX (#335) by Mikola Lysenko (@mikolalysenko) in #700
• Fix .bundle/config values keeping a trailing # comment (#951) by Mikola Lysenko (@mikolalysenko) in #953
• Scan every vendored-write file for vendored references (#832, #958) by Mikola Lysenko (@mikolalysenko) in #1015
• Fix remove/rollback missing PyPI name spellings (#1024) by Mikola Lysenko (@mikolalysenko) in #1025
• Fix stale docs and comments, and the npm wrapper's schema and exit code by Mikola Lysenko (@mikolalysenko) in #1022
• Run CI on the merge queue and stop cancelling main push runs by Mikola Lysenko (@mikolalysenko) in #1018
• Fix PyPI hosted takeover un-vendoring before refusal (#723, #945) by Mikola Lysenko (@mikolalysenko) in #946
• Fix yarn PnP detection ignoring nodeLinker (#975, #539) by Mikola Lysenko (@mikolalysenko) in #978
• Fix gem stale-install guard home selection (#1001, #729) by Mikola Lysenko (@mikolalysenko) in #1002
• Fix workspace-member refusal for vlt and brace/class globs (#1071, #942) by Mikola Lysenko (@mikolalysenko) in #1073
• Stop cancelling in-progress Composer runs on main by Mikola Lysenko (@mikolalysenko) in #1080
• Fix pnpm install-proof flake on registry connection resets by Mikola Lysenko (@mikolalysenko) in #1059
• Fix vendored uv/Hatch re-vendor to a newer patch (#742, #650) by Mikola Lysenko (@mikolalysenko) in #943
• Guard .socket links and agent writes with one containment helper by Mikola Lysenko (@mikolalysenko) in #1042
• Only warn berry migration risk when the classic lock holds a pin by Mikola Lysenko (@mikolalysenko) in #1077
• Fix VEX credential leak and FIFO hang, plus a macOS clippy error by Mikola Lysenko (@mikolalysenko) in #1070
• Fix interpreter-bound wheels treated as portable (#1048) by Mikola Lysenko (@mikolalysenko) in #1053
• Skip draft PRs and run macOS legs off the PR path by Mikola Lysenko (@mikolalysenko) in #1093
• Fix requirements -r after other options (#1028) by Mikola Lysenko (@mikolalysenko) in #1040
• Bump rustls from 0.23.37 to 0.23.45 by Dependabot (@dependabot)[bot] in #1003
• Stop VEX attesting over yarn PnP, pnpm bundled and deno.lock copies by Mikola Lysenko (@mikolalysenko) in #1033
• Keep test children off production telemetry and fail e2e legs that run no tests by Mikola Lysenko (@mikolalysenko) in #1046
• Fix hosted gem pinning a version the lock doesn't resolve (#1055) by Mikola Lysenko (@mikolalysenko) in #1060
• Fix yarn classic offline-mirror config resolution (#1013, #1078) by Mikola Lysenko (@mikolalysenko) in #1083
• Replace a superseded patch generation's wiring on re-pin and remove by Mikola Lysenko (@mikolalysenko) in #1035
• Share one path normalizer, home resolver and repository-root walk by Mikola Lysenko (@mikolalysenko) in #1038
• Decide which lockfile governs installs in one table by Mikola Lysenko (@mikolalysenko) in #1044
• Fix UTF-16 requirements.txt silently skipped (#721) by Mikola Lysenko (@mikolalysenko) in #724
• Stop CI gates passing on missing paths, unverified agent patches and unreported hosted pins by Mikola Lysenko (@mikolalysenko) in #1029
• Move all yarn.lock parsing into formats/yarn and stop pinning non-registry copies by Mikola Lysenko (@mikolalysenko) in #1057
• Compare purls through one PurlKey type by Mikola Lysenko (@mikolalysenko) in #1045
• Decide vendored-entry liveness through one discovery verdict by Mikola Lysenko (@mikolalysenko) in #1050
• Fix gem pair model ignoring custom lockfile and Bundler 1 twins (#749, #751) by Mikola Lysenko (@mikolalysenko) in #768
• Route JVM layout through one module and fix three JVM scope bugs by Mikola Lysenko (@mikolalysenko) in #1032
• Fix main's red CI: macOS Composer on PHP 8.4 and the setup-php pin comment by Mikola Lysenko (@mikolalysenko) in #1102
• Fix nightly vlt canary: support vlt 1.3.0-1.3.7 by Mikola Lysenko (@mikolalysenko) in #1087
• Make the vendored-to-hosted takeover atomic by Mikola Lysenko (@mikolalysenko) in #1039
• Remove the SOCKET_FORCE env binding; --force is flag-only (#615) by Mikola Lysenko (@mikolalysenko) in #1021
• Read recovered uv/pdm wheel pins through the shared lock model (#1079) by Mikola Lysenko (@mikolalysenko) in #1121
• Use tests/common's binary() and git_sha256 in CLI tests (#824) by Mikola Lysenko (@mikolalysenko) in #1124
• Label the setup-php pin in ci.yml with its real tag by Mikola Lysenko (@mikolalysenko) in #1118
• Route inline BOM strips through formats::text (#905) by Mikola Lysenko (@mikolalysenko) in #1117
• Read Cargo.toml [package] identity through formats::cargo::manifest (#693) by Mikola Lysenko (@mikolalysenko) in #1110
• Bound the PDM site probe through utils::process (#1067) by Mikola Lysenko (@mikolalysenko) in #1106
• Fix requirements -r include tree counted as a competing lock (#1086) by Mikola Lysenko (@mikolalysenko) in #1091
• Fix PyPI revert deleting still-referenced wheel (#996, #867) by Mikola Lysenko (@mikolalysenko) in #997
• Break command-module cycles and share remedy and UI text by Mikola Lysenko (@mikolalysenko) in #1043
• Cut merge-group CI from ~46 to ~20 min: shard Gradle e2e and test legs, skip test-release in queue, cancel orphaned runs by Mikola Lysenko (@mikolalysenko) in #1133
• Cut Maven install from minutes to seconds by fetching from Central by Mikola Lysenko (@mikolalysenko) in #1139
• Remove apply.lock when a lock-holding run is interrupted (#808) by Mikola Lysenko (@mikolalysenko) in #1030
• Fix superseded rollback skipping still-patched copies (#1084) by Mikola Lysenko (@mikolalysenko) in #1085
• Fix npm workspace-member refusal skipped by a stray member lock (#1094) by Mikola Lysenko (@mikolalysenko) in #1095
• Fix Poetry/PDM vendored re-vendor to superseding patch (#1136) by Mikola Lysenko (@mikolalysenko) in #1137
• Delete the dead hosted-vlt redirect-ledger helpers (#782) by Mikola Lysenko (@mikolalysenko) in #1141
• Read Gradle verification metadata through one shared XML scanner (#715) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1145
• Fix sbt docker e2e flake on Maven Central blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1148
• Evict failing merge-queue entries ~35 min sooner by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1146
• Pick pure pypi lock wheels through one shared portability rule (#1150) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1151
• Guard single-segment name/version coordinates through one path_safety check (#748) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1153
• Fix vlt backtest flakes on artifact preflight fetch drops by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1154
• Stop re-parsing bun lock entries for every patch in scan (#580) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1051
• Make every --json top-level error a {code, message} object (#704) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1027
• Fix oracle selftest temp-path collision flake in coverage by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1162
• Decouple CI platform builds and share compatible Rust caches by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1143
• Stop Gradle e2e legs failing on services.gradle.org 500s by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1165
• Fix Windows flake in gem global-gemfile refusal e2e by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1169
• Move BOM handling in 11 more files onto formats::text (#905) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1160
• Load manifest hashes as lowercase so every verify site agrees (#707) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1163
• Fix api_timeout_e2e trickle-body flake on macOS stalls by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1159
• Pick inserted line terminators through line_endings::terminator (#815) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1108
• Fix vendored revert reading a removed dependency as drift (#1132, #1140, #1142) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1147
• Decide whether a hosted patch is pinned through lockfile discovery alone by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1058
• Fix PyPI revert deleting a wheel used by a subdir requirements file (#1167) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1168
• Edit go.sum through GoSumEditor only and delete the oracle copies (#631) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1103
• Remove scan --apply/--vendor, get --no-apply and the download/gc aliases (#966) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1031
• Wire every vendored Poetry lock through utils::poetry_lock (#936) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1185
• Cut E2E artifact size by 53% with shared compression by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1179
• Stop Maven e2e evictions on Central 429s by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1189
• Fix requirements files read as absent when not UTF-8 (#1120, #1119) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1152
• Move BOM handling in 4 more files onto formats::text (#905) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1191
• Fix stalled JSON body retry test flake on starved runners by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1192
• Fix macOS e2e unpack Broken pipe evicting queue entries by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1201
• Fix gem lock section order after a hosted re-scan (#1186) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1190
• Scope project-mode NuGet crawls to the restore's resolved packages (#427) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1183
• Fix open npm issues by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1008
• Scope the project-mode cargo crawl to the crates Cargo.lock resolves (#1204) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1205
• Scope the project-mode Go crawl to the modules go.sum records (#1207) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1209
• Fix 15 open pnpm issues across hosted, vendored and agent modes by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1007
• Fix Pipenv ignoring pylock patch wiring (#912, #1122) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1193
• Fix Maven reactor e2e eviction on Central blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1208
• Scope the project-mode Deno crawl to the JSR packages deno.lock records (#1216) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1217
• Fix requirements.txt with unmodelled coding line (#1212) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1218
• Vendor single-module Maven poms through the suffixed jvm planner and retire the legacy backend (#973) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1036
• Resolve the org once per run and route every API call through it (#648) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1041
• Fix macOS Composer legs red on main via setup-php 2.40.0 by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1215
• Retry sbt vendored e2e warm-up on Maven Central blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1226
• Key NuGet purls by the normalized version in PurlKey (#1202) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1230
• Fix capped gem re-scan counting Gemfile pins as new (#1224) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1228
• Retry sbt seed warm-up on Maven Central blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1229
• Cut release-test wait time and recover Maven downloads by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1166
• Converge hosted Gemfile.lock sources through the formats::gem reader (#780) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1221
• Fix vendored PyPI revert deleting a wheel a subdir pylock uses (#1213) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1223
• Retry Docker e2e maven/cargo fixture fetches past registry blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1222
• Run e2e suites that share a toolchain in one leg by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1234
• Pick inserted-line terminators through line_endings::terminator in vendored writers (#815) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1227
• Fix open bun issues (#992, #861, #784, #764, #735, #635, #599, #578, #497, #443, #371) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1009
• Fix Bun and vlt stray member locks skipping refusal (#1101, #1134) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1161
• Run compatibility matrices on PRs only for their own files by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1206
• Fix capped scan deferring contested npm pins (#1195) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1211
• Fix Windows flake in read-set replacement test by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1237
• Build coverage-docker's binary once per leg by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1261
• Retry CI pip installs of uv past PyPI download blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1251
• Fix Maven e2e failing on Central blips after warm-up by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1256
• Retry HTTP errors in sbt/composer Docker image downloads by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1238
• Finish vendored reverts through one shared step with a keep policy (#989) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1245
• Bench: benchmark NuGet as a restored project (#1183 scoped crawl) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1250
• Skip duplicate Gradle compat legs on PRs by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1255
• Fix requirements pin dropped at a dangling EOF \ (#1249) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1254
• Fix uv script lock revert stuck as drift (#1214) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1231
• Stream agent-mode jar members through one zip-member hasher (#914) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1253
• Look up NuGet packages by normalized version in the crawler (#1202) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1239
• Fix Poetry env discovery falling past its env (#671, #866, #1023) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1259
• Fix yarn classic copies locked under another name (#1236) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1242
• Pick JVM line terminators through utils::line_endings (#815) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1264
• Fix revert deleting wheels a requirements.lock uses (#1252) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1265
• Use tests/common's binary() and git_sha256 in 40 more CLI tests (#824) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1258
• List vlt 1.3.8 as supported to clear nightly canary by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1269
• Read --json envelopes in CLI tests through one tests/common/envelope module (#1089) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1272
• Fix gem unwind leaving patched archive in vendor/cache (#1260) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1263
• chore(release): 5.0.0 by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1194
• Write the VEX document through the shared stage + rename writer (#1144) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1262
• Use one package target grammar for get, remove, rollback and the UUID shortcut by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1034
• Path-filter compat matrices on push to main by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1275
• Retry Bun backtest cells on hosted-fetch 5xx blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1244
• Fix yarn npm: alias copies treated as pinned (#1081, #1158) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1180
• Move BOM handling in 8 more files onto formats::text (#905) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1277
• Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1301
• Fix bun.lockb shared bundled pin being unmanageable (#1243) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1247
• Skip the vlt compat matrix on ci.yml-only changes by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1284
• Retry CI toolchain installs past rustup download blips by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1286
• Wire vendored nuget.config through formats::nuget (#594) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1288
• Fix yarn classic empty-range lock keys (#1271) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1274
• Fix gem checks judging unused system gem homes (#1098, #1109) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1290
• Fix scan human/JSON exit and prune forks (#1062) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1298
• Fix hosted requirements rewrite of user direct refs (#542) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1333
• Run Linux CI jobs on Depot runners by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1362
• Cut CI to a lean per-package-manager gate (+ #1353 Gradle Windows cells) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1375
• Redact credentials from logged URLs, VEX product ids and hosted Composer locks by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1026
• Remove --download-mode and the diff download path (#792) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1049
• Fix vendored npm/Bun revert treating an upgrade as drift (#1155) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1187
• Write Pipfile.lock through one entry splicer in formats::pipenv (#1128) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1188
• Fix Bun restore ignoring user registry config (#1276) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1283
• Make sbt Docker e2e jar fetch survive Central 403/404s by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1291
• Match package targets by PurlKey identity, not by lowercase (#1292) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1294
• Document get's real paid_required JSON (#982) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1299
• Fix cargo cold-cache apply exiting 0 (#616) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1310
• Test cargo takeover over unrewritable deps (#1020) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1314
• Freeze v5 support matrix and migration policy (#1156) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1318
• Trust the OS store and SSL_CERT_FILE for HTTPS (#1107) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1326
• Fix hosted uv unwind deleting user override pins (#411) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1331
• Fix human vendored --prune skipping GC (#1127) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1338
• Resolve pnpm modules dirs through one helper for crawler and layout detection (#1129) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1347
• Fix lockless Gemfile pinning shared-home gems (#1125) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1304
• Fix bare scan/get taking over vendored projects (#1088) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1317
• Fix hosted Maven reactor silently unpatched (#261) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1349
• Align ignored npm/vendored e2e tests with v5 behavior by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1354
• Fail closed on unreadable scala-cli Bloop evidence, as sbt does (#1270) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1358
• Fix berry pins carrying registry-only node-gyp dep (#737) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1319
• Fix hosted cargo contested lock in vex and restore (#679, #863) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1313
• Fix apply --check remedy dropping scope flags (#1219) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1325
• Give pnpm installs pnpm upgrade commands (#1111) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1350
• Honor Go settings written with go env -w (#344) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1356
• Fix hosted NuGet lock walk: BOM and other versions (#593, #623) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1339
• Fix repair/prune deleting active patches' restore blobs (#893) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1316
• Fix Composer reinstall hints ignoring vendor-dir (#658) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1348
• Use tests/common's binary() and git_sha256 in 5 more CLI test files (#824) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1366
• Delete the dead lock_inventory::wired_vendor_integrity reader (#782) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1370
• Document vendor --force as variant-probe bypass (#923) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1346
• refactor: remove obsolete vendoring machinery and duplicate crate code by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1279
• docs(cli): align v5 help with lockfile-first patching by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1297
• Make pnpm CoW e2e independent of the live patch catalog by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1364
• Fix stale Bundler plugin registration after v5 (#1295) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1367
• Fix vendored uv drift-keep after uv remove (#1287) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1337
• Fix vendored Maven pin overriding BOM/parent management (#488) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1359
• Fix scan from a uv workspace member dir (#1138) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1335
• Restore registry bin paths on berry rollback (#1131) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1322
• Fix Go apply/vendor on Windows read-only module cache (#346) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1351
• docs: complete v5 package targeting migration guidance by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1296
• Fix fragmentless yarn classic hosted pins (#558) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1328
• Fix lock-only PEP 440 pin spellings missing patches (#604) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1334
• Fix uv writers clobbering PEP 508 direct refs (#767) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1332
• Fix Hatch-derived pylock.toml lock-only rewrite (#479) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1336
• Fix ETXTBSY flake in process command_for spawn test by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1377
• ci: reuse the merge-queue verdict on main and trim coverage/sbt work by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1355
• Compile tests on Windows in the merge queue by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1378
• Read berry restore registry like yarn does (#1017) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1323
• ci: don't let a dead Depot runner cancel a merge-queue run by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1376
• Retire berry resolutions left by yarn remove (#1203) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1321
• Scaffold packages in keyless pnpm-workspace.yaml (#1096) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1315
• Skip orphaned pnpm store entries in vendored scan (#1197) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1320
• Fix hosted cargo redirect over [patch] overrides (#480) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1312
• Fix PyPI rollback reinstall advice (#477) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1308
• Fix residual-reference keep reported as drift (#1184) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1311
• Warn on yarn classic member-dir vendored installs (#691) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1324
• Fix gem unwind dropping source-block ! (#1056) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1303
• Rebuild cargo crates after in-place apply/rollback (#387) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1307
• Fix NuGet lock discovery for member and named locks (#353, #514) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1340
• Fix cargo shared-cache patch orphaned on takeover/prune (#336, #1278) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1305
• Fix PDM restore replacing a private index (#413) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1306
• Fix vendored JVM/NuGet artifacts dropped by .gitignore (#1061) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1330
• Fix vendored NuGet revert on CRLF checkouts (#537) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1342
• Report artifact GC in one JSON shape and count every rollback leg by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1273
• Warn and fail --check when Go vendor/ or go.mod need a resync (#343, #618) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1357
• Fix project-mode Maven crawl listing all of ~/.m2 (#265) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1361
• Fix vendored Pipenv sibling requirements.txt (#612) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1309
• Fix vendored-ledger root under --manifest-path (#745) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1345
• Add CI watch script, API budget rules and /code-review note for agents by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1164
• Fix NuGet mapping exclusivity and inherited sources (#354, #462) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1341
• Fix hosted Maven pom edits outside live markup (#259, #262, #342) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1327
• Stop warm NuGet cache shadowing patches (#352) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1344
• Print one JSON envelope from every command (v5.0) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1369
• Restore NuGet contentHash, not catalog packageHash (#624) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1343
• Report hosted-mode adoption and self-update in telemetry by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1360
• Classify purls through Ecosystem::from_purl in free files (#747) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1126
• Hide API tokens in help and simplify v5 CLI docs by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1380
• CI: skip PR re-test after a clean main merge (#1373) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1383
• Re-download truncated e2e-bin archives once in CI by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1387
• CI: type-check Windows in the queue, in parallel (#1385) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1386
• CI: route yarn suites through hermetic spawner (#823) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1389
• Fix uv revert after a vendored dep goes direct (#1374) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1384
• Fix requirements.txt pin grammar split (#1365) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1381
• Fix vendored uv export requirements.txt (#1368) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1390
• Fix Windows flake in notifier dead-endpoint e2e test by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1392
• Fix cargo apply skipping other registry copies (#339) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1394
• Fix Go replaces that go.work ignores (#393, #458, #531) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1393
• Fix uv script-lock revert per pair (#1285, #890) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1391
• Fix gem apply/vex skipping platform gem copies (#1092) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1395
• CI: hermetic spawns in scan/repair tests (#823) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1398
• Fix berry hosted pin beside a later registry entry (#1082) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1397
• CI: fail pnpm e2e legs that skip every test (#1054) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1400
• CI: share test helpers in 17 more test files (#824) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1402
• Fix vendored Pipenv pylock.toml co-wiring (#1368) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1399
• Fix gem BUNDLE_GEMFILE via symlinked dir (#896) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1401
• Fix yarn classic check of dangling descriptors (#1379) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1388
• Fix Go replace for unselected versions (#391, #392, #509) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1403
• Fix replace-registry-host ${VAR} warning (#1233) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1404
• CI: hermetic spawns in apply/rollback tests (#823) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1405
• Fix gem revert of a commented Gemfile line (#988) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1406
• Fix Composer vendor-dir config cascade (#439, #686) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1408
• CI: share test helpers in repair/scan tests (#824) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1410
• Fix hosted cargo pin of registry = "crates-io" (#386) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1412
• Fix CRLF .npmrc append with no final newline (#1196) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1417
• Fix env race flake in cache_env scrub self-tests by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1418
• CI: run the full e2e tier nightly, not per push (#1414) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1415
• Bench: serve yarn classic tarballs; allow NuGet stale-cache warning by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1422
• Fix yarn classic hosted scan lock rescans (#1423) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1426
• Fix Go vex of +incompatible module patches (#484) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1427
• Fix macOS go.work member match through ./x/../app by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1411
• Fix Poetry rewrite of a source = "pypi" dep (#1282) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1413
• Fix gem agent crawl under a moved BUNDLE_GEMFILE (#952) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1430
• CI: run Windows pnpm e2e tests instead of skipping (#1054) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1407
• Fix Composer global home lookup order (#586) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1421
• Fix vendored Hatch refs in %/#/;/? checkouts (#547) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1428
• Fix yarnrc ${VAR} and YAML setting reads (#1100) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1433
• Fix Cargo source replacement being ignored (#338, #455) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1420
• Fix hosted pnpm pin of a lock pnpm ignores (#1074) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1431
• Fix berry restore keeping removed descriptors (#1435) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1436
• Annotate failing tests in the coverage job by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1438
• CI: share test helpers in the last 4 modules (#824) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1439
• chore(release): 5.0.0 release notes for PRs merged since the bump by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1432
• CI: test Maven 4 on 4.0.0-rc-7 (#267) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1443
• Fix uv wiring under no-sources = true (#564) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1434
• Fix bare scan/get converting hosted pins (#1437) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1440
• Fix crawl of --system-site-packages venvs (#409) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1419
• CI: hermetic spawns in cli/covgap tests (#823) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1441
• Fix git-ignored bun.lockb workspace mirrors (#1116) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1442
• Fix unbounded registry lookups in upstream restore (#1220) by Mikola Lysenko (@mikolalysenko) in https://github.com/SocketDev/socket-patch/pull/1444

Full Changelog: v4.0.0...v5.0.0