Skip to content

Commit eda5620

Browse files
claudeclaude
committed
Repin live minimist@1.2.2 suites to republished patch 642d7f02
Ports #1301 so this PR's CI is not blocked by #1293: production no longer serves the free minimist@1.2.2 patch 80630680, which breaks hosted-e2e and e2e_safety_pnpm on main as well. Same change as #1301; it becomes a no-op once #1301 lands on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YRcjmQwhWGod7X58Hbe5FW
1 parent ff9da68 commit eda5620

7 files changed

Lines changed: 13 additions & 13 deletions

File tree

‎crates/socket-patch-cli/tests/e2e_hosted_production.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
//!
3434
//! | Ecosystem | PURL | Patch UUID | Advisory |
3535
//! |-----------|------|------------|----------|
36-
//! | npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | GHSA-xvch-5gv4-984h (CVE-2021-44906) |
36+
//! | npm | `pkg:npm/minimist@1.2.2` | `642d7f02-ebc1-4ab0-99e2-07f5dd8463cb` | GHSA-xvch-5gv4-984h (CVE-2021-44906) |
3737
//! | PyPI | `pkg:pypi/urllib3@1.26.18` | *any of three* (see [`PYPI_UUIDS`]) | GHSA-gm62-xv2j-4w53 &co |
3838
//! | gem | `pkg:gem/activestorage@6.0.3` | *any of* [`GEM_UUIDS`] (six today; the sixth merges three advisories) | GHSA-m42x-37p3-fv5w (CVE-2020-8162), GHSA-w749-p3v6-hccq (CVE-2022-21831), GHSA-9xrj-h377-fr87 (CVE-2026-33195), GHSA-r4mg-4433-c7g3 (CVE-2025-24293), GHSA-xr9x-r78c-5hrm (CVE-2026-66066) |
3939
//!
@@ -123,7 +123,7 @@ const PATCH_HOST: &str = "patch.socket.dev";
123123
const NPM_PURL: &str = "pkg:npm/minimist@1.2.2";
124124
const NPM_NAME: &str = "minimist";
125125
const NPM_VERSION: &str = "1.2.2";
126-
const NPM_UUID: &str = "80630680-4da6-45f9-bba8-b888e0ffd58c";
126+
const NPM_UUID: &str = "642d7f02-ebc1-4ab0-99e2-07f5dd8463cb";
127127

128128
const PYPI_PURL: &str = "pkg:pypi/urllib3@1.26.18";
129129
const PYPI_NAME: &str = "urllib3";

‎crates/socket-patch-cli/tests/e2e_npm.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//! End-to-end tests for the npm patch lifecycle.
22
//!
33
//! These tests exercise the full CLI against the real Socket API, using the
4-
//! **minimist@1.2.2** patch (UUID `80630680-4da6-45f9-bba8-b888e0ffd58c`),
4+
//! **minimist@1.2.2** patch (UUID `642d7f02-ebc1-4ab0-99e2-07f5dd8463cb`),
55
//! which fixes CVE-2021-44906 (Prototype Pollution).
66
//!
77
//! # Prerequisites
@@ -26,14 +26,14 @@ use common::cache_env;
2626
// Constants
2727
// ---------------------------------------------------------------------------
2828

29-
const NPM_UUID: &str = "80630680-4da6-45f9-bba8-b888e0ffd58c";
29+
const NPM_UUID: &str = "642d7f02-ebc1-4ab0-99e2-07f5dd8463cb";
3030
const NPM_PURL: &str = "pkg:npm/minimist@1.2.2";
3131

3232
/// Git SHA-256 of the *unpatched* `index.js` shipped with minimist 1.2.2.
3333
const BEFORE_HASH: &str = "311f1e893e6eac502693fad8617dcf5353a043ccc0f7b4ba9fe385e838b67a10";
3434

3535
/// Git SHA-256 of the *patched* `index.js` after the security fix.
36-
const AFTER_HASH: &str = "043f04d19e884aa5f8371428718d2a3f27a0d231afe77a2620ac6312f80aaa28";
36+
const AFTER_HASH: &str = "ec956dcafb886f14315570bf3981d44aa12c561716abb46eed8b067aaa1f6bdf";
3737

3838
// ---------------------------------------------------------------------------
3939
// Helpers

‎crates/socket-patch-cli/tests/e2e_safety_pnpm.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
//! view and the store entry byte-identical.
1212
//!
1313
//! Fixture: minimist@1.2.2 + its Socket patch (UUID
14-
//! `80630680-4da6-45f9-bba8-b888e0ffd58c`, CVE-2021-44906) — same
14+
//! `642d7f02-ebc1-4ab0-99e2-07f5dd8463cb`, CVE-2021-44906) — same
1515
//! pair `e2e_npm.rs` uses, so the BEFORE/AFTER hashes are known.
1616
//!
1717
//! Network: yes (pnpm install + socket-patch get). Toolchain: pnpm.
@@ -24,12 +24,12 @@ mod common;
2424

2525
use common::{assert_run_ok, git_sha256_file, has_command, pnpm_run, write_package_json};
2626

27-
const NPM_UUID: &str = "80630680-4da6-45f9-bba8-b888e0ffd58c";
27+
const NPM_UUID: &str = "642d7f02-ebc1-4ab0-99e2-07f5dd8463cb";
2828

2929
/// Git-SHA-256 of the *unpatched* `index.js` shipped with minimist 1.2.2.
3030
const BEFORE_HASH: &str = "311f1e893e6eac502693fad8617dcf5353a043ccc0f7b4ba9fe385e838b67a10";
3131
/// Git-SHA-256 of the *patched* `index.js` after the security fix.
32-
const AFTER_HASH: &str = "043f04d19e884aa5f8371428718d2a3f27a0d231afe77a2620ac6312f80aaa28";
32+
const AFTER_HASH: &str = "ec956dcafb886f14315570bf3981d44aa12c561716abb46eed8b067aaa1f6bdf";
3333

3434
// ── Setup helpers ─────────────────────────────────────────────────────
3535

‎crates/socket-patch-cli/tests/e2e_vendored_production.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
//!
5050
//! | Ecosystem | PURL | Patch UUID | Marker in the patched bytes |
5151
//! |-----------|------|------------|-----------------------------|
52-
//! | npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | `Socket Community Patch` header |
52+
//! | npm | `pkg:npm/minimist@1.2.2` | `642d7f02-ebc1-4ab0-99e2-07f5dd8463cb` | `Socket Community Patch` header |
5353
//! | PyPI | `pkg:pypi/urllib3@1.26.18` | *any of three* (see [`PYPI_UUIDS`]) | `Socket Community Patch` header |
5454
//! | gem | `pkg:gem/activestorage@6.0.3` | *any of* [`GEM_PATCHES`] | `Socket Community Patch` header |
5555
//!
@@ -137,7 +137,7 @@ const PROXY: &str = "https://patches-api.socket.dev";
137137
const NPM_PURL: &str = "pkg:npm/minimist@1.2.2";
138138
const NPM_NAME: &str = "minimist";
139139
const NPM_VERSION: &str = "1.2.2";
140-
const NPM_UUID: &str = "80630680-4da6-45f9-bba8-b888e0ffd58c";
140+
const NPM_UUID: &str = "642d7f02-ebc1-4ab0-99e2-07f5dd8463cb";
141141

142142
const PYPI_PURL: &str = "pkg:pypi/urllib3@1.26.18";
143143
const PYPI_NAME: &str = "urllib3";

‎docs/testing/bun-compatibility.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ projects using text `bun.lock` or native binary `bun.lockb`. Real-Bun evidence b
55

66
- **The native matrix** — `scripts/backtest-bun.py` runs real Bun releases
77
against the public free Socket patch for `minimist@1.2.2`
8-
(`80630680-4da6-45f9-bba8-b888e0ffd58c`) with the production CLI and patch
8+
(`642d7f02-ebc1-4ab0-99e2-07f5dd8463cb`) with the production CLI and patch
99
service, without a token or substitute service, and checks the INSTALLED
1010
bytes, lock stability, digest rejection and rollback on Linux, macOS and
1111
Windows ([workflow](../../.github/workflows/bun-compatibility.yml)).

‎scripts/backtest-bun.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@
117117
# former `vendored-detached` leg collapsed into `vendored`: same footprint.
118118
MODES = ['hosted', 'vendored']
119119
PURL = 'pkg:npm/minimist@1.2.2'
120-
UUID = '80630680-4da6-45f9-bba8-b888e0ffd58c'
120+
UUID = '642d7f02-ebc1-4ab0-99e2-07f5dd8463cb'
121121
# The registry slot bun writes for a non-default registry: the full tarball URL.
122122
REGISTRY_SLOT = 'https://registry.npmjs.org/minimist/-/minimist-1.2.2.tgz'
123123
LOCAL_TUPLE_SPEC = f'minimist@.socket/vendor/npm/{UUID}/minimist-1.2.2.tgz'

‎scripts/backtest-vlt.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@
8888
VERSIONS = ['0.0.0-16', '0.0.0-32', '1.0.0-rc.14', '1.0.0-rc.32', '1.0.4', '1.0.10', '1.2.0']
8989
MODES = ['hosted', 'vendored', 'agent']
9090
PURL = 'pkg:npm/minimist@1.2.2'
91-
UUID = '80630680-4da6-45f9-bba8-b888e0ffd58c'
91+
UUID = '642d7f02-ebc1-4ab0-99e2-07f5dd8463cb'
9292
NAME = 'minimist'
9393
VERSION = '1.2.2'
9494
TARGET = f'{NAME}@{VERSION}'

0 commit comments

Comments
 (0)