[John-David Dalton (jdalton)]

Build Socket 2.1.0-rc.N as a signed, platform-specific Node 27 SEA. .config/release.json keeps this track on the prerelease-2.1.0 dist-tag; stable v1.x releases retain their three existing packages.

pnpm run approve:npm <id> checks the authenticated npm stage and approves it when ready. The workflow then verifies the signed tag is on the default branch and waits for npm to serve every package version before creating the GitHub release from the tag’s changelog. A timeout creates no GitHub release and can be retried with the same tag. Blocked or deleted stages burn the version; their changes carry into the next changelog.

The VFS embeds the bundled tools. cdxgen and synp are present for darwin-arm64 but remain unavailable until their provenance and notice requirements are resolved.

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​termless/​xtermjs@​0.11.0
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​@​actions/​cache@​6.3.0
	npm/​node-pty@​1.2.0-beta.18
	npm/​@​termless/​core@​0.11.0
	npm/​svgo@​4.1.0

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: package.json → npm/@termless/core@0.11.0 → npm/playwright-core@1.65.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/playwright-core@1.65.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[John-David Dalton (jdalton)]

Cursor (@cursor) review

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 549b957. Configure here.}

[cursor]

SEA version override never inlines

High Severity

The Rollup replace for INLINED_SOCKET_CLI_VERSION reads constants.ENV.INLINED_SOCKET_CLI_VERSION, but LAZY_ENV never copies that string from the environment. SEA builds set the env var to SEA_VERSION so v1.x feature binaries report 2.1.0-rc.0; the bundle still inlines root package.json instead. After a dual-track v1.x bump, signed natives would advertise the 1.x number.

Additional Locations (2)

• scripts/constants.js#L49-L68
• src/sea/build-sea.mts#L1012-L1017

 

^{Reviewed by Cursor Bugbot for commit 549b957. Configure here.}

[John-David Dalton (jdalton)]

Fixed in 34c56c5: scripts/constants.js now reads INLINED_SOCKET_CLI_VERSION through envAsString, with a regression test. The prototype SEA binary reports 2.1.0-rc.0.

[cursor]

SEA skips Maven jar fail-closed

Medium Severity

SEA dist builds set INLINED_SOCKET_CLI_PUBLISHED_BUILD but now skip the missing Maven extension jar check, and build-sea.mts never runs build:maven-extension (it only builds the .NET helper). A prototype native can ship without the jar, so socket manifest maven and Maven reachability still emit an empty SBOM.

Additional Locations (1)

• src/sea/build-sea.mts#L925-L930

 

^{Reviewed by Cursor Bugbot for commit 549b957. Configure here.}

[John-David Dalton (jdalton)]

Fixed in 34c56c5: SEA preparation now builds the Maven extension before Rollup, and published builds fail if its jar is missing. The skipped guard could leave the jar out, causing native manifest maven to fail at runtime; it did not silently emit an empty SBOM. The prototype build passes with the helper bundled.

[cursor]

Release policy file not allowlisted

Medium Severity

The deny-all .gitignore un-ignores every other .config file but omits .config/release.json. Prepare, npm policy validation, and SEA version loading all require that file. A re-add, copy, or tooling pass that honors gitignore can drop the prerelease policy and fail those paths closed.

Additional Locations (1)

• .config/release.json#L1-L6

 

^{Reviewed by Cursor Bugbot for commit 549b957. Configure here.}

[John-David Dalton (jdalton)]

Fixed in 34c56c5: .gitignore now re-includes .config/** as a directory rule and removes the per-file config exceptions. git check-ignore confirms .config/release.json is not ignored.