@@ -23,6 +23,131 @@ a version without a non-empty section in this file.
2323
2424## [ Unreleased]
2525
26+ ## [ 5.1.0] — 2026-11-06
27+
28+ ### Added
29+
30+ - ** RubyGems.**
31+ - ** Agent mode patches gems with native (C) extensions for real.** When
32+ ` apply ` (or ` scan ` / ` get --mode agent ` ) patches a gem whose patch changes
33+ native-extension sources (such as ` ext/**/*.c ` or an ` extconf.rb ` ), it
34+ now rebuilds the gem's extensions with RubyGems' own builder, the step
35+ ` gem pristine --extensions ` runs, using the Ruby that owns the gem home.
36+ Both the copy under ` extensions/<platform>/<abi>/ ` and the copy under the
37+ gem's ` lib/ ` are rebuilt, so Ruby stops loading the stale install-time
38+ ` .so ` / ` .bundle ` . A build that fails puts the original sources and build
39+ back (` native_extension_build_failed ` ), and a copy that can't be rebuilt
40+ in place (a precompiled platform gem, a Bundler git checkout, no matching
41+ Ruby) is refused with ` native_extensions_unsupported ` before anything is
42+ written. Sources an earlier release patched without a rebuild are rebuilt
43+ on the next ` apply ` (` native_extension_rebuilt ` warning). ` vex ` and
44+ ` apply --check ` attest such a patch only once its rebuild is recorded,
45+ and otherwise report ` native_extension_not_rebuilt ` . ` rollback ` and
46+ ` remove ` restore the original build. Callers that compile the extension
47+ themselves can opt out with ` --no-gem-native-rebuild ` (env
48+ ` SOCKET_NO_GEM_NATIVE_REBUILD ` ): the sources are written without a
49+ rebuild, with a ` native_extension_not_rebuilt ` warning, and ` vex ` does
50+ not attest them. Hosted copies are unaffected, since RubyGems compiles
51+ the patched gem itself (#1996 , #1998 ).
52+
53+ ### Fixed
54+
55+ - ** RubyGems.**
56+ - With Bundler 4.1 ` override "other", with: "gem", in: "parent" ` , hosted
57+ ` rollback ` and ` remove ` treat the override target as transitive and give
58+ back the original lock and Gemfile byte for byte, instead of writing a
59+ new exact ` gem "gem", "x.y.z" ` pin that blocked later upgrades (#1989 ,
60+ #1991 ).
61+ - Gemspec directives and development dependencies are read as Ruby code:
62+ ` =begin ` /` =end ` blocks, heredoc bodies and ` __END__ ` data are skipped, so
63+ a commented-out dev dependency no longer adds a bogus requirement and a
64+ heredoc no longer refuses the Gemfile (#1932 , #1936 ).
65+ - ** npm family.**
66+ - pnpm workspace globs with brace sets and character classes
67+ (` packages/{a,b} ` , ` packages/[ab]* ` ) are read the way pnpm reads them in
68+ every mode instead of being refused or read as every directory; shapes
69+ pnpm reads its own way (extglobs, ` [!a] ` , a ` + ` after a class, stepped or
70+ punctuation-spanning brace ranges) are still refused, and commented
71+ importer lines in ` pnpm-lock.yaml ` are ignored (#1846 , #1863 ).
72+ - Quoted values, YAML escapes and duplicate keys in ` pnpm-workspace.yaml ` ,
73+ ` .yarnrc.yml ` and ` .modules.yaml ` decode one way, as pnpm reads them, so
74+ settings such as ` modulesDir ` or ` lockfileDir ` no longer resolve to
75+ different paths depending on the command (#1918 , #1973 ).
76+ - yarn classic's ` .yarnrc ` is read as yarn 1.22 reads the whole file:
77+ ` --modules-folder 'deps' ` no longer sends the crawler to a folder yarn
78+ never installs into, and a file yarn can't parse sets nothing (#1901 ,
79+ #1915 ).
80+ - A malformed ` package.json ` ` workspaces ` field (a non-string item, ` null ` ,
81+ the wrong type) is judged the same way everywhere; the Bun member walk
82+ falls back to ` bun.lock ` instead of reading no members (#1900 , #1971 ).
83+ - ` apply ` and ` rollback ` no longer touch package copies inside a store
84+ nested in another store's entry, which ` scan ` never reports, and keep
85+ the peer-variant copies of a project that lives under ` ~/.bun ` ,
86+ ` ~/.deno ` or ` ~/.vlt ` (#1899 , #1986 ).
87+ - Hosted npm warns ` redirect_npm_omit_lockfile_registry_resolved ` when any
88+ npm config layer sets ` omit-lockfile-registry-resolved ` , which makes the
89+ next ` npm install ` drop the hosted URL and fail with ` EINTEGRITY ` , and
90+ names where it is set and the remedies (#1871 , #1872 ).
91+ - ** PyPI.**
92+ - A requirements line pinned through an environment variable
93+ (` six==${SIXV} ` ) is refused by ` vendor ` with
94+ ` pypi_requirement_env_templated ` , and ` vendor --check ` and ` vex ` read it
95+ as possibly installing any release, so the patch is no longer attested
96+ while ` pip install -r ` can install the unpatched one (#1873 , #1874 ).
97+ - A hosted scan of a Python project with no lockfile the rewriters read now
98+ warns ` redirect_pypi_no_lockfile ` , naming the files looked for and the
99+ project's own lock command, instead of passing silently (#638 , #1885 ).
100+ - After a hosted rollback, a vendored rollback or ` vendor --revert ` of a
101+ requirements-file pin, the reinstall advisory covers pip and names the
102+ requirements files to reinstall from (#1953 , #1954 ).
103+ - The hosted Pipenv stale-install warning ends with the same runnable
104+ remedy as vendored mode and never prints an option-like package name
105+ into a shell command (#1878 , #1883 ).
106+ - A ` poetry.lock ` in an old format (0, 1.0, 1.1) keeps its "written by
107+ Poetry < 1.4" warnings and refusals even when a hand-merged header claims
108+ a newer Poetry (#1847 , #1865 ).
109+ - ** Go.** In a go 1.16 (unpruned) module where a dependency imports a fork
110+ that the root ` go.mod ` replaces with the patched module, ` apply ` ,
111+ ` apply --check ` , hosted mode and ` vex ` read the module graph to tell
112+ whether the patch is really built, instead of reporting it applied while
113+ ` go build ` linked the unpatched code (#1840 , #1843 ).
114+ - ** Maven.** A Maven 4 root that builds its subdirectories implicitly
115+ (model 4.1.0, ` pom ` packaging, no ` <subprojects> ` ) is treated as a reactor
116+ by hosted mode, ` vex ` and the Maven cache scope, not only by vendored mode,
117+ so a root-only pin is no longer attested while a module keeps its own
118+ version (#1809 , #1886 ).
119+ - ** Vendoring.**
120+ - Vendored dry runs leave already-vendored patches out of the "Would
121+ download and vendor" headline and list them as skipped, matching the wet
122+ run and the JSON (#1850 , #1856 ).
123+ - Run from a workspace member with no lockfile of its own, a vendored
124+ ` scan ` , ` get ` or ` vendor ` names the lock that installs the member and
125+ where to run from (#1904 , #1913 ).
126+ - npm package-lock packages installed from a URL or git spec, and workspace
127+ members, are refused before their patch is downloaded; dry runs preview
128+ them as refused and they no longer hold a ` --max-new-patches ` rollout
129+ slot (#1976 , #1977 ).
130+ - In a vlt project, ` vendor ` no longer requests service downloads for
131+ packages it then refuses (#1909 , #1947 ).
132+ - ** General.**
133+ - The nested-project remedy quotes its path for the shell it prints for,
134+ including Windows and ` % ` (#1859 , #1884 ).
135+ - Patch and vendor download errors read the same on every path (size
136+ limit, HTTP status with a bounded body excerpt), and artifact downloads
137+ log under ` --debug ` (#1869 , #1870 ).
138+
139+ ### Maintenance
140+
141+ - Code consolidation with no output change: one lock-rewrite driver for
142+ Poetry and PDM (#1898 ) and module sweeps across the CLI and core
143+ (#1855 , #1864 , #1875 , #1884 , #1892 , #1897 , #1903 , #1907 , #1914 , #1920 ,
144+ #1923 , #1929 , #1939 , #1948 , #1967 , #1975 , #1985 , #1990 ).
145+ - Test and CI infrastructure: shared test env guard, docker harness, PTY
146+ runner, ` copy_tree ` and apply fixtures; hermetic children scrub color
147+ variables; failing tests are annotated in CI; offline bun.lockb rollback
148+ mock and a Windows venv layout in the PyPI fixture (#1891 , #1890 , #1905 ,
149+ #1944 , #1955 , #1964 , #1972 , #1978 , #1988 , #1994 ).
150+
26151## [ 5.0.1] — 2026-10-13
27152
28153### Fixed
0 commit comments