[Mikola Lysenko (mikolalysenko)]

Follow-up to #2032: notes for four PRs that landed while it was in review

#2032 covered v5.0.1..7bde3ba. Before it merged, four more PRs landed on main (c6a4fda6..502aa1fc). They ship in 5.1.0 because the Release workflow hasn't been dispatched yet, so they need entries in the [5.1.0] section first.

This PR changes only CHANGELOG.md (+12/−1, inside ## [5.1.0]). The version stays 5.1.0, and the new entries don't change the version bump.

PR	Where	Note
#2013	Fixed → npm family	Hosted vlt scans stop downloading every patch archive. redirect_vlt_artifact_unverifiable is no longer raised, and the in-memory engine (Node addon, hosted-bundle) pins vlt deps instead of withholding them as offline
#1999 (#1997)	Fixed → RubyGems	A gem inside nested source … do blocks is attributed to the innermost block, so hosted rollback/remove on Bundler ≤ 2.1 no longer refuses with hosted_wiring_contested
#2000	Maintenance	Test-only
#2027	Maintenance	Release workflow artifact steps move off Node 20 actions

Double-check: #2013 could arguably go under ### Changed, since it drops the encoding check rather than fixing a bug. The version is minor either way.

Local checks: release-lint.sh --stable-only --tag-check passed, and release.py changelog check --version 5.1.0 passed.

Maintainer checklist

• Approve and merge this PR before dispatching Release, so the GitHub release notes include these entries.
• After merge, confirm nothing else landed: git log --first-parent <this PR's merge SHA>..origin/main.
• Actions → Release → Run workflow on main (optionally a dry-run: true run first).
• Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

---

Note

Low Risk
Changelog-only; no runtime or release automation logic changed in this diff.

Overview
Documents four follow-up fixes in the [5.1.0] section so they ship with the next release cut.

Fixed → RubyGems. Records that gems inside nested source … do blocks are credited to the innermost block like Bundler, so hosted rollback / remove no longer hit hosted_wiring_contested on Bundler 2.1 and older (#1997, #1999).

Fixed → npm family. Records hosted vlt behavior: scans stop downloading every granted patch archive for encoding checks and no longer emit redirect_vlt_artifact_unverifiable; re-encoded mirrors fail vlt ci with EINTEGRITY; the in-memory hosted path (Node addon, hosted-bundle) pins vlt dependencies instead of treating them as offline-only (#2013).

Maintenance. Extends the test/CI bullet with #2000 and notes that release workflow artifact steps no longer use Node 20 actions (#2027).

^{Reviewed by Cursor Bugbot for commit 5d76313. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Labeled Ready for review by the burn-down agent.

• Head: 5d76313ab9447759ff248e15bbeeeb7621bdd6f2
• CI: 50/50 check runs green (31 success, 19 skipped); no main-wide failures.
• Bugbot: reviewed this head, no findings.
• Release PR (release/v5.1.0), so the CHANGELOG.md change is expected. Auto-merge is already armed; it needs an approval. Per the PR checklist, merge it before dispatching the Release workflow.
• Slack announcement not sent: the Slack send tool isn't available in this run, so the next run will retry.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Adds [5.1.0] changelog entries for four PRs that landed while #2032 was in review: #1999 (RubyGems nested source blocks), #2013 (hosted vlt scans stop downloading archives), and #2000/#2027 (maintenance). Only CHANGELOG.md changes; this is a release/v* branch, so editing it is allowed.

Risk: low. Docs only, +12/−1, nothing runtime.

Look here

• CHANGELOG.md:65: RubyGems entry (Nightly gem e2e red on bundler 1.17/2.1: CRLF source-block rollback unattributable #1997, Fix nightly gem e2e: attribute nested Gemfile source blocks #1999)
• CHANGELOG.md:95: vlt hosted-scan entry (Stop downloading vlt artifacts during hosted scans #2013)
• CHANGELOG.md:159: maintenance bullet (Run tests/common selftests once, not in 118 binaries #2000, Move release.yml artifact steps off Node 20 actions #2027)

Verified: the diff against merge-base 502aa1fc is the 12 lines above, and each entry matches the merged PR it cites. CI 31/31 passed (19 skipped). Bugbot reviewed this head and rated it low risk. No unresolved review threads.

Changes I made: none.

Open questions

• Refuse vendored patches the same way everywhere #2015 isn't covered. "Refuse vendored patches the same way everywhere" (26e39db) merged to main at 22:06 UTC, after this PR's range (c6a4fda6..502aa1fc). It changes user-facing behavior and has no [5.1.0] entry yet. Merging this PR is still fine, but someone needs to add Refuse vendored patches the same way everywhere #2015 before Release is dispatched (step 2 of the checklist).
• As the PR body says, Stop downloading vlt artifacts during hosted scans #2013 could go under ### Changed. Either way the version stays minor.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

#2015 is now covered as well. The latest main (26e39db5) is merged into this branch, and a Fixed → Vendoring entry describes the user-visible change: every vendored entry point applies the same refusals before any download, get <uuid> --mode vendored reports them and writes nothing, and vendor refuses before restoring a hosted pin. This PR now covers through 26e39db5. release-lint.sh --stable-only --tag-check and changelog check pass, and the diff against main is still only CHANGELOG.md.

Before you dispatch Release, re-check with git log --first-parent 26e39db5..origin/main.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief (update)

What it does: Since my last brief (5d76313a), this release-notes PR merged main and added one [5.1.0] entry for #2015 ("Refuse vendored patches the same way everywhere"). That closes the open question from the earlier brief. Only CHANGELOG.md changes, and this is a release/v* branch, so editing it is allowed.

Risk: low. Docs only, nothing runtime.

Look here

• CHANGELOG.md:142: the new Refuse vendored patches the same way everywhere #2015 entry under ### Fixed

Verified: the new entry matches #2015's "Behavior changes" section: the scan download phase refuses before fetching any patch view, get --mode vendored refuses before writing anything, vendor refuses before restoring a hosted pin, and codes and details are unchanged. The merge from main brings in only #2015's code, which is already on main. CI on 367b95d4: 30 passed, 19 skipped, none failed. No unresolved review threads.

Changes I made: none.

Open questions: none new. (#2013 under ### Changed vs ### Fixed is still the author's call; either way the version stays minor.)

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code