chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.21.0 + register .claude/hooks/* by jdalton · Pull Request #1237 · SocketDev/socket-cli

John-David Dalton (jdalton) · 2026-04-18T01:23:11Z

Cascade bump on top of 5.20.1 and the socket-registry action-ref sync.

What's in this cascade

socket-registry action refs bumped to @3362af95fadd1e325cb48e9ad6daff21c112bd72. Cascades the pnpm 11.0.0-rc.0 → 11.0.0-rc.2 bump.
.github/workflows/weekly-update.yml delegates to SocketDev/socket-registry/.github/workflows/weekly-update.yml.
@socketsecurity/lib bumped 5.19.1 → 5.21.0 (via 5.20.0, 5.20.1). Both the root catalog and the .claude/hooks/* workspace-registered packages (check-new-deps, setup-security-tools) are kept in lockstep.
packageManager + engines.pnpm bumped 11.0.0-rc.0 → 11.0.0-rc.2 to match the rest of the fleet.

5.21.0 API migrations needed in this repo

printFooter moved out of @socketsecurity/lib/stdio/header (latent wrong-path import that lib's loose subpath exports hid on 5.18.2). Now imported from @socketsecurity/lib/stdio/footer in scripts/check.mts and scripts/type.mts.
StdioOptions tightening via SpawnExtra = Record<string, unknown> — spawnExtra?.['stdio'] is unknown, not assignable to StdioOptions. Cast to StdioOptions | undefined at the 10 call sites across utils/dlx/spawn.mts and utils/coana/spawn.mts. Switched || → ?? at the same sites.
IpcHandshake / IpcMessage types removed from @socketsecurity/lib/ipc (they were @unused Reserved for future exports; cli was the only consumer and re-derives these shapes in its validators anyway). Define them locally in utils/validation/ipc.mts.
sendBootstrapHandshake's send parameter is non-optional but ChildProcess.send is optional. Added a typeof runtime guard with a clear TypeError at the call site (the IPC channel is always requested via ensureIpcInStdio, so the guard just narrows for the type system).

Caller-visible 5.21.0 changes that do NOT affect this repo

@socketsecurity/lib/validation/* → moved to schema/* / json/parse — no consumers here.
memoizeDebounced removed — no consumers here.
getRepoUrlDetails scp-style rejection — no consumers here.
escapeRegExp output shape change (\xHH encoding) — no string-comparing consumers here.

Test plan

pnpm install (on pnpm 11.0.0-rc.2)
pnpm run check — lint, typecheck, and validators pass
Targeted runtime tests for promise-queue, dlx/spawn, validation/ipc (see diff)
Pre-existing check-new-deps hook test failures on main are unrelated to this bump.

John-David Dalton (jdalton) · 2026-04-18T02:10:00Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

John-David Dalton (jdalton) · 2026-04-18T02:31:31Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

John-David Dalton (jdalton) · 2026-04-18T02:42:27Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

John-David Dalton (jdalton) · 2026-04-18T02:48:40Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

John-David Dalton (jdalton) · 2026-04-18T02:58:35Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

John-David Dalton (jdalton) · 2026-04-18T03:06:10Z

Cursor (@cursor) review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 0cb3a6c. Configure here.}

…date Update all SocketDev/socket-registry action/workflow SHA pins in .github/workflows/ to d54c36d0bed05ffffbe8b14e7663927eaa19d5df (the current propagation SHA per socket-registry's _local-not-for-reuse-*.yml pins). Also: .github/workflows/weekly-update.yml is now a thin delegator to SocketDev/socket-registry/.github/workflows/weekly-update.yml — the shared Layer 3 reusable that invokes the /updating skill umbrella via Claude Code. Drops ~340 lines of inline update logic; same behavior.

…urity-tools hooks

Catalog bump from 5.20.1 to 5.21.0 plus the caller-side migrations needed for the new API surface: - pnpm-workspace.yaml catalog: 5.20.1 → 5.21.0 - packageManager + engines.pnpm: 11.0.0-rc.0 → 11.0.0-rc.2 to match the rest of the fleet Migrations for 5.21.0 changes: 1. `printFooter` moved out of `@socketsecurity/lib/stdio/header` — it was a latent wrong-path import that lib's loose subpath exports hid on 5.18.2. Now imported from `@socketsecurity/lib/stdio/footer` in scripts/check.mts and scripts/type.mts. 2. `StdioOptions` strictening via `SpawnExtra = Record<string, unknown>` — `spawnExtra?.['stdio']` is `unknown`, not assignable to `StdioOptions`. Cast to `StdioOptions | undefined` at the 9 call sites in utils/dlx/spawn.mts and utils/coana/spawn.mts. Also switched `||` → `??` so an empty-string stdio (not a real value, but TypeScript-possible) doesn't silently fall through. 3. `IpcHandshake` / `IpcMessage` types removed from `@socketsecurity/lib/ipc`. The cli validator re-derives these shapes structurally anyway — define them locally in utils/validation/ipc.mts alongside the validators. 4. `sendBootstrapHandshake`'s parameter requires a non-optional `send` method, but `ChildProcess.send` is optional. Add a runtime typeof-guard with a clear TypeError before the call (we always spawn with an IPC channel; the guard just narrows for the type system). Lint + typecheck clean. Pre-existing check-new-deps hook test failures on main are unrelated to this bump.

TypeScript can't narrow a parent object from a typeof-check on one of its properties, which forced `spawnResult.process as { send: ... }` downstream of the existing runtime guard. Extract the guard into a small `assertHasSend` assertion function so the call site narrows cleanly and the structural cast is gone.

Cascades the pnpm 11.0.0-rc.0 → 11.0.0-rc.2 bump from socket-registry. Absorbs #1242 — all SocketDev/socket-registry action/workflow pins now match the current propagation SHA per socket-registry's _local-not-for-reuse-*.yml files.

cursor bot reviewed Apr 18, 2026

View reviewed changes

John-David Dalton (jdalton) force-pushed the chore/ci-cascade-main-34fef52b branch from 0cb3a6c to 781478b Compare April 19, 2026 03:46

John-David Dalton (jdalton) changed the title ~~chore(ci): bump socket-registry action refs to main (34fef52b)~~ chore(ci): bump socket-registry refs to d54c36d0 + delegate weekly-update Apr 19, 2026

John-David Dalton (jdalton) added 3 commits April 19, 2026 16:33

chore: bump @socketsecurity/lib to 5.19.1

edbfbc6

chore: bump @socketsecurity/lib to 5.19.1 in check-new-deps+setup-sec…

2474071

…urity-tools hooks

chore: register .claude/hooks/* as workspace packages

2822ff2

John-David Dalton (jdalton) changed the title ~~chore(ci): bump socket-registry refs to d54c36d0 + delegate weekly-update~~ chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.19.1 + register .claude/hooks/* Apr 19, 2026

John-David Dalton (jdalton) added 3 commits April 19, 2026 21:04

chore(deps): bump @socketsecurity/lib to 5.20.1 in catalog

996a9c6

chore(hooks): sync .claude/hooks packages to lib 5.20.1

a0418f7

John-David Dalton (jdalton) force-pushed the chore/ci-cascade-main-34fef52b branch from c0b52a4 to 3387322 Compare April 20, 2026 17:19

John-David Dalton (jdalton) changed the title chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.19.1 + register .claude/hooks/* chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.21.0 + register .claude/hooks/* Apr 20, 2026

John-David Dalton (jdalton) added 3 commits April 20, 2026 15:16

chore(ipc): sort locally-defined Ipc interface properties alphabetically

65f0c72

chore(ci): bump socket-registry refs to 3362af95

aac40c4

Cascades the pnpm 11.0.0-rc.0 → 11.0.0-rc.2 bump from socket-registry. Absorbs #1242 — all SocketDev/socket-registry action/workflow pins now match the current propagation SHA per socket-registry's _local-not-for-reuse-*.yml files.

John-David Dalton (jdalton) mentioned this pull request Apr 20, 2026

chore(ci): bump socket-registry action refs to main (3362af95) #1242

Closed

2 tasks

Bill Li (billxinli) approved these changes Apr 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.21.0 + register .claude/hooks/*#1237

chore: cascade bump — socket-registry refs + @socketsecurity/lib 5.21.0 + register .claude/hooks/*#1237
John-David Dalton (jdalton) wants to merge 10 commits intomainfrom
chore/ci-cascade-main-34fef52b

John-David Dalton (jdalton) commented Apr 18, 2026 •

edited

Loading

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

John-David Dalton (jdalton) commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What's in this cascade

5.21.0 API migrations needed in this repo

Caller-visible 5.21.0 changes that do NOT affect this repo

Test plan

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

John-David Dalton (jdalton) commented Apr 18, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

John-David Dalton (jdalton) commented Apr 18, 2026 •

edited

Loading