[John-David Dalton (jdalton)]

Summary

• Add a Node 27 Single Executable Application (SEA) build for the socket package, using Node's virtual file system for the bundled runtime and supported tools.
• Update the release build matrix for the Socket 1.x and 2.1.0 prerelease packages, plus the two legacy CLI package variants.
• Add serialized integration and native-binary test lanes. The native lane snapshots and verifies the host binary and isolates npm and pnpm caches/configuration.
• Include build staging, signing support, and bundled-tool/license metadata needed by the SEA build.

Verification

• Unit tests: 2,111 passed, 4 skipped.
• Integration tests: 94 passed.
• Native tests: 98 passed.
• Distribution build, scripts TypeScript check, and git diff --check passed.

The unit suite was run with Node 24 and NO_COLOR unset; the missing .env.local message during build is a warning.

---

Note

High Risk
Large build-pipeline and dependency-inlining changes affect every distribution path (npm dist vs SEA), bundled third-party legal compliance, and standalone tool resolution (Bazel/cdxgen/synp).

Overview
Node 27 SEA packaging lands as a 2.1.0 prerelease: new Rollup configs bundle cdxgen and Synp into the VFS, roll provenance via includedModulesInventoryPlugin / THIRD-PARTY-NOTICES.json, and stage curated license material under src/sea/licenses/. Dist builds honor SOCKET_SEA_BUILD (inventories for core, blessed-contrib, and copied blessed; skip package.json churn where appropriate).

Build/runtime decoupling from @socketsecurity/registry: helpers move to scripts/utils/registry-helpers.js, runtime imports shift to local src/utils/* (logger, spawn, prompts, fs, etc.), @socketsecurity/registry is no longer external/copied, and bin/cli.js spawns through dist/utils.js. Build constants in scripts/constants.js are local, with SOCKET_SEA_DIST_DIR / SOCKET_SEA_EXTERNAL_DIR overrides.

Standalone behavior: isStandaloneSea() tightens Bazel resolution (native binary only, no Bazelisk/Node launchers); README documents SOCKET_CLI_SOCKET_PATCH_PATH.

Repo hygiene and CI: .gitignore switches to deny-all with an explicit allowlist; integration (scripts/test/integration.mts) and native SEA (scripts/test/native.mts) test scripts join the matrix; Apple signing helper capture.mts is added; package bumps inquirer/cross-spawn, removes registry deps, and extends test scripts.

^{Reviewed by Cursor Bugbot for commit 1e5a252. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​@​inquirer/​password@​4.0.18
	npm/​@​inquirer/​select@​4.3.2
	npm/​@​inquirer/​input@​4.2.2
	npm/​@​inquirer/​confirm@​5.1.16

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​@​inquirer/​password@​4.0.18
	npm/​@​inquirer/​confirm@​5.1.16
	npm/​@​inquirer/​select@​4.3.2
	npm/​@​inquirer/​input@​4.2.2

View full report