Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) by mikolalysenko · Pull Request #1301 · SocketDev/socket-patch

Mikola Lysenko (mikolalysenko) · 2026-10-09T16:39:08Z

Production withdrew the free minimist@1.2.2 patch 80630680-4da6-45f9-bba8-b888e0ffd58c and republished the CVE-2021-44906 fix as 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb. The live test pins must follow the new artifact to unblock the merge queue.

Changes

Repin the hosted/vendored production suites, npm and pnpm safety suites, Bun/vlt backtests, and Bun compatibility documentation to the replacement UUID.
Update the patched index.js Git SHA-256 to ec956dcafb886f14315570bf3981d44aa12c561716abb46eed8b067aaa1f6bdf. The pristine hash is unchanged.
Fix the vlt backtest's installed-file checks: the replacement record uses index.js and test/proto.js without a package/ prefix. Remove only that optional prefix, preserving nested paths and compatibility with older records. This fixes the nine failing native vlt jobs on the original revision.
Add a regression test covering both record formats, pristine and patched bytes, and corrupt or missing nested files.

Offline mock UUIDs remain fixture identifiers. No production CLI behavior or CHANGELOG.md changes.

Validation

On macOS with Node 24.21.0:

python3 -B -m unittest scripts.tests.test_backtest_harnesses -q: 85 tests, OK (one platform skip). The new regression reproduced the original IndexError before the fix.
backtest-vlt.py --versions 1.2.0 --modes hosted vendored agent --jobs 3: all 36/36 live-production scenarios matched expectations, with no server-encoding blocks.
cargo test --locked -p socket-patch-cli --test e2e_safety_pnpm --test e2e_hosted_production -- --include-ignored: 65 hosted + 23 pnpm tests passed. The hosted suite's Bun and pinned-vlt legs soft-skipped because their toolchains were not configured; the standalone vlt backtest above exercised vlt directly.
Recomputed both published files' Git SHA-256 hashes from their patch bytes and verified the pinned index.js assertions match.
Signed fix commit af6164ca7 is pushed. CI, Bun compatibility, and vlt compatibility all passed: 282 successful checks, 12 conditional skips, zero failures or pending checks. Both required gates (ci-ok and clippy) and all ten checks that failed on the original revision are green.

The original PR validation also recorded v5 expectation drift in the on-demand e2e_npm shortcut/global tests and the vendored Yarn Berry manifest check. Those suites are outside the CI gate and their expectations are unchanged here.

Note

Low Risk
Test and documentation constant updates only; no production CLI or runtime behavior changes.

Overview
Production republished the free minimist@1.2.2 patch (same CVE-2021-44906 fix) under a new UUID after withdrawing 80630680-…. This PR repins every live-production and backtest harness that depended on the old artifact.

NPM_UUID / UUID is now 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb in hosted/vendored production e2e (e2e_hosted_production, e2e_vendored_production), npm e2e (e2e_npm, e2e_safety_pnpm), scripts/backtest-bun.py, scripts/backtest-vlt.py, and docs/testing/bun-compatibility.md.

Content assertions for the patched index.js use the new after git-blob hash (ec956dca…); the unpatched before hash is unchanged. Offline mocks and fixtures that only used the old UUID as an opaque string were intentionally left alone.

^{Reviewed by Cursor Bugbot for commit d344040. Configure here.}

Production withdrew free patch 80630680-4da6-45f9-bba8-b888e0ffd58c for pkg:npm/minimist@1.2.2 between 15:29Z and 15:49Z on 2026-10-09 and republished the CVE-2021-44906 fix at 15:57:30Z as 642d7f02-ebc1-4ab0-99e2-07f5dd8463cb. The new patch also touches test/proto.js, and its patched index.js hashes to ec956dca... instead of 043f04d1... (the pristine beforeHash is unchanged). Repin every suite that resolves the patch against the live proxy: e2e_hosted_production, e2e_vendored_production, e2e_npm, e2e_safety_pnpm, backtest-bun.py, backtest-vlt.py (also drives vlt-serve-watchdog) and the bun-compatibility doc. Offline fixtures and mocked tests keep the old UUID as an opaque string. Fixes #1293 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Port of #1302 (fixes #1293). Production withdrew the free minimist@1.2.2 patch 80630680-… and republished the same fix as 642d7f02-…, with a new patched index.js (afterHash ec956dca…). That turned hosted-e2e and e2e_safety_pnpm red on main and here. No-ops once main carries #1302 or #1301. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mzbk9WDZkhatFrCWUAyaNs

Ports #1301 so this PR's CI is not blocked by #1293: production no longer serves the free minimist@1.2.2 patch 80630680, which breaks hosted-e2e and e2e_safety_pnpm on main as well. Same change as #1301; it becomes a no-op once #1301 lands on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YRcjmQwhWGod7X58Hbe5FW

Mikola Lysenko (mikolalysenko) · 2026-10-09T17:26:43Z

Ready for review (burn-down agent).

Head: d3440400
CI: all checks green incl. ci-ok, hosted-e2e and e2e_safety_pnpm, except the vlt native (*) compat legs, which fail the same way on main at a8e9397.
Bugbot: reviewed this head, no findings; no open review threads.
No CHANGELOG.md changes.
Unblocks the merge queue for every PR (Merge queue blocked: production no longer publishes free minimist@1.2.2 patch #1293). Overlaps Follow the republished minimist canary patch #1302 (canary repin); reviewer should pick one or land both.

Generated by Claude Code

Mikola Lysenko (mikolalysenko) · 2026-10-09T17:30:27Z

[agent] Heads-up from #1290, which ports this change: once scripts/backtest-vlt.py changes, the native vlt legs run, and with the new patch 642d7f02 they fail with IndexError at backtest-vlt.py:1072. The new patch keys its files without the package/ prefix, so key.split('/', 1)[1] breaks. #1302 already fixes it with key.removeprefix('package/'), so this PR needs that line too.

Generated by Claude Code

The republished minimist patch uses package-relative file keys. Strip only an optional package/ prefix so root files do not crash the native matrix and nested files retain their directories. Exercise prefixed and unprefixed records before and after patching, including corrupt and missing nested files. The regression reproduces the original IndexError and the 85-test harness suite passes with this fix.

hosted-e2e (and the other live minimist suites) fail on every head: production now serves minimist@1.2.2 patch 642d7f02 while the tests pin 80630680 (#1293). This is #1301's change, applied verbatim; it becomes a no-op once #1301 lands. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VrgiQoDwt3vjxG2zNfZBAA

The production patch server withdrew the minimist@1.2.2 patch these suites pinned (#1293), so hosted-e2e, e2e_safety_pnpm and the Bun and vlt backtests are red on main and on every PR. This carries #1301's repin to the republished patch 642d7f02 unchanged; it becomes a no-op once #1301 lands on main. Assisted-by: Claude Code:claude-opus-5-5

Port of #1301 (fixes #1293). Production withdrew the free minimist@1.2.2 patch 80630680 and republished the fix as 642d7f02, which turned hosted-e2e, e2e_safety_pnpm and every Bun native leg red here as on main. The vlt harness also now reads the republished patch's unprefixed file keys. Test-only; a no-op once main carries #1301. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mo7HM9gyRkUAMxWqi62Dxz

Brings in #1301, which repins the live minimist@1.2.2 suites to the republished patch. That clears the hosted-e2e and e2e_safety_pnpm failures this PR inherited from main, so its CI can go green. Assisted-by: Claude Code:claude-opus-5-5

Co-Authored-By: Claude <noreply@anthropic.com>

This was referenced Oct 9, 2026

Match package targets by PurlKey identity, not by lowercase (#1292) #1294

Merged

Fix yarn classic empty-range lock keys (#1271) #1274

Merged

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Fix Bun restore ignoring user registry config (#1276) #1283

Merged

Mikola Lysenko (mikolalysenko) added the Ready for review Agent-verified: mergeable, CI green, Bugbot clean — awaiting human review label Oct 9, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Make sbt Docker e2e jar fetch survive Central 403/404s #1291

Merged

This was referenced Oct 9, 2026

Test cargo takeover over unrewritable deps (#1020) #1314

Merged

refactor: remove obsolete vendoring machinery and duplicate crate code #1279

Merged

Wenxin Jiang (Wenxin-Jiang) approved these changes Oct 9, 2026

View reviewed changes

Mikola Lysenko (mikolalysenko) added this pull request to the merge queue Oct 9, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Align ignored npm/vendored e2e tests with v5 behavior #1354

Merged

Mikola Lysenko (mikolalysenko) removed this pull request from the merge queue due to a manual request Oct 9, 2026

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Resolve pnpm modules dirs through one helper for crawler and layout detection (#1129) #1347

Merged

This was referenced Oct 9, 2026

Run 2 of 4 Gradle hosted Windows cells on PRs #1353

Closed

Remove --download-mode and the diff download path (#792) #1049

Merged

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Fix hosted Maven reactor silently unpatched (#261) #1349

Merged

2 tasks done

Mikola Lysenko (mikolalysenko) merged commit 9ab72d4 into main Oct 9, 2026
293 checks passed

Mikola Lysenko (mikolalysenko) deleted the fix/1293-repin-minimist branch October 9, 2026 18:02

This was referenced Oct 9, 2026

Fix vendored npm/Bun revert treating an upgrade as drift (#1155) #1187

Merged

ci: reuse the merge-queue verdict on main and trim coverage/sbt work #1355

Merged

Mikola Lysenko (mikolalysenko) mentioned this pull request Oct 9, 2026

Follow the republished minimist canary patch #1302

Closed

Mikola Lysenko (mikolalysenko) pushed a commit that referenced this pull request Oct 9, 2026

Merge origin/main to pick up the #1301 minimist repin

8a76154

Co-Authored-By: Claude <noreply@anthropic.com>

Navigation Menu

Repository navigation

Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293) - #1301

Repin live minimist@1.2.2 suites to republished patch 642d7f02 (#1293)#1301
Mikola Lysenko (mikolalysenko) merged 2 commits into
mainfrom
fix/1293-repin-minimist

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 •

edited

Loading

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Validation

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Mikola Lysenko (mikolalysenko) commented Oct 9, 2026 •

edited

Loading