chore(release): 5.0.0 (#1194)

* chore(release): 5.0.0

Cut the [5.0.0] CHANGELOG section from [Unreleased], adding notes for
the 150 PRs merged since the CHANGELOG freeze (#848), and stamp 5.0.0
into Cargo.toml, Cargo.lock and the npm main + platform packages.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Pin the sync-main test's packaging baseline to 4.0.0

The test copied the live packaging and tagged v4.0.0, so it failed once
the tree was stamped 5.0.0. copy_packaging's baseline= keeps it
independent of the checkout's version, like the other stamp tests.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Skip the vlt launcher leg where vlt ignores the configured registry

vlt <= 0.0.0-13 ignores vlt.json's registry (and --registry): installs
resolve from public npm. The launcher leg only passed there because
@socketsecurity/socket-patch@4.0.0 is published; at the unreleased 5.0.0
it cannot resolve. Verified against an unreachable registry: 0.0.0-1,
-11, -12, -13 still install, 0.0.0-14 fails ECONNREFUSED. Marks the era
non-hermetic in docs/testing/vlt-compatibility.md and adds the derived
skip rule for the launcher leg.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add #1152 to the 5.0.0 release notes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add #1008, #1183, #1190 and #1205 to the 5.0.0 release notes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add #1209 to the 5.0.0 release notes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add #1007, #1036, #1041, #1193, #1217, #1218 and #1230 to the 5.0.0 release notes

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

CHANGELOG.md

@@ -14,13 +14,13 @@ default-members = [
 resolver = "2"
 
 [workspace.package]
-version = "4.0.0"
+version = "5.0.0"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/SocketDev/socket-patch"
 
 [workspace.dependencies]
-socket-patch-core = { path = "crates/socket-patch-core", version = "=4.0.0" }
+socket-patch-core = { path = "crates/socket-patch-core", version = "=5.0.0" }
 clap = { version = "=4.5.60", features = ["derive", "env"] }
 serde = { version = "=1.0.228", features = ["derive"] }
 serde_json = { version = "=1.0.149", features = ["preserve_order", "raw_value"] }

Cargo.lock

@@ -241,7 +241,7 @@ async fn vlt_pinned_matrix_agent_launcher() {
     let Some(leg) = agent_leg("launcher") else {
         return;
     };
-    if !hermetic_registry(leg.version()) {
+    if !hermetic_registry(leg.version()) || registry_config_ignored(leg.version()) {
         return leg.skip("non-hermetic-registry");
     }
     let (pkgs, host) = launcher_packages();

Cargo.toml

@@ -880,6 +880,20 @@
       "conditions": [],
       "reason": "non-hermetic-registry"
     },
+    {
+      "boundary": "the configured registry is ignored: every install resolves from public npm",
+      "suite": "agent",
+      "legs": [
+        "launcher"
+      ],
+      "except": [],
+      "versions": {
+        "op": "<=",
+        "a": "0.0.0-13"
+      },
+      "conditions": [],
+      "reason": "non-hermetic-registry"
+    },
     {
       "boundary": "`npm:` alias specs resolve against public npm even with `registries.npm`",
       "suite": "agent",

crates/socket-patch-cli/tests/e2e_vlt.rs

@@ -295,6 +295,13 @@ pub fn scalar_registry_ignored(v: VltVersion) -> bool {
     (VltVersion::rc(7)..=VltVersion::rc(29)).contains(&v)
 }
 
+/// vlt.json's `registry` (and `--registry`) is ignored: every install
+/// resolves from public npm, so a package only the harness registry serves
+/// (the launcher at an unpublished version) cannot install.
+pub fn registry_config_ignored(v: VltVersion) -> bool {
+    v <= VltVersion::zero(13)
+}
+
 /// The harness can run every install against its own registry.
 pub fn hermetic_registry(v: VltVersion) -> bool {
     !scalar_registry_ignored(v)

crates/socket-patch-cli/tests/vlt-leg-manifest.json

@@ -128,7 +128,7 @@ The capstones serve npmjs bytes from a local wiremock registry `R` and write
 
 | Era window | vlt.json | Hermetic | Notes |
 |---|---|---|---|
-| ≤ 0.0.0-13 | flat `{"registry": R}` | yes | `vlt-workspaces.json` for workspaces ≤ 0.0.0-12 |
+| ≤ 0.0.0-13 | flat `{"registry": R}` | no: vlt ignores the configured registry (and `--registry`), so every install resolves from public npm | `vlt-workspaces.json` for workspaces ≤ 0.0.0-12; legs pass because R serves npmjs bytes, except the launcher leg (its package exists only in R), which logs `skip:non-hermetic-registry` |
 | 0.0.0-14 … rc.6 | `{"config":{"registry": R}}` (+ `"modifiers":{}` for 0.0.0-16 … 24, except the ignored-lock leg) | yes | URL-segment DepIDs carry R's port |
 | rc.7 … rc.29 | `{"config":{"registry": "https://registry.npmjs.org/"}}` | no: lock-driven installs reach public npm | the dead-registry assertions log `skip:non-hermetic-registry`; the patch service stays local |
 | rc.30 … rc.32 | `{"config":{"registry": R}}` | yes | URL-segment DepIDs |
@@ -285,6 +285,7 @@ store-linker knob, `unset` when not given), `cache_root` and `upgrade`
 | a cache on another filesystem falls back to copies | `all` | `cache_root=set` | safety | `private_copies` | `store-linker-hardlinks` |
 | as above | `all` | `cache_root=unset` | safety | `cross_device_cache` | `no-cache-root` |
 | a scalar `registry` makes lock-driven installs re-resolve from public npm | `1.0.0-rc.7 … 1.0.0-rc.29` | — | agent | `scan_apply_rollback_list`, `launcher` | `non-hermetic-registry` |
+| the configured registry is ignored: every install resolves from public npm | `<= 0.0.0-13` | — | agent | `launcher` | `non-hermetic-registry` |
 | `npm:` alias specs resolve against public npm even with `registries.npm` | `1.0.0-rc.30 … 1.0.0-rc.32` | — | agent | `scan_apply_rollback_list` | `non-hermetic-registry` |
 | `lockfileVersion` 0 with legacy (`·`/`§`) DepIDs | `0.0.0-19 … 1.0.0-rc.14` | — | — | — | — |
 | `lockfileVersion` 1, tilde DepIDs | `>= 1.0.0-rc.15` | — | — | — | — |

crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-android-arm64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for Android ARM64",
   "os": [
     "android"

docs/testing/vlt-compatibility.md

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-darwin-arm64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for macOS ARM64",
   "os": [
     "darwin"

npm/socket-patch-android-arm64/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/socket-patch-darwin-x64",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "socket-patch binary for macOS x64",
   "os": [
     "darwin"