chore(release): fold 22 more PRs into the 5.0.0 notes

[Mikola Lysenko (mikolalysenko)]

Follow-up to #1432. Editing CHANGELOG.md is allowed here: this is release work, not a feature PR.

Coverage

With this PR, [5.0.0] covers main up to 4cb3643ac (#1432's merge). These 22 PRs landed between 17793173f and #1432; I re-checked 4cb3643ac..origin/main right before pushing and it was empty. The date stays 2026-10-12.

Added to Fixed

• Cargo: source replacement (replace-with to a directory source) is followed through every config cargo reads, and hosted mode skips crates when crates.io is replaced by an on-disk source (Agent-mode cargo apply patches the wrong copy when cargo vendor uses a custom directory (or apply runs from a workspace member), yet reports success and VEX attests not_affected #338, Hosted cargo scan in a cargo vendor project reports success but breaks every fresh cargo build --frozen --offline, and VEX then omits the patch #455). registry = "crates-io" is now pinned (Hosted cargo redirect refuses a crates.io dependency declared with an explicit registry = "crates-io", treating crates.io as "another registry" #386).
• npm family: pnpm locks are left alone when pnpm's lockfile setting is off (redirect_pnpm_lockfile_disabled) (Hosted pnpm scan pins a pnpm-lock.yaml that pnpm is configured to ignore (lockfile=false / lockfile: false), reports success, and lock-only VEX attests not_affected while pnpm installs the upstream package #1074). Berry restore after a member's yarn remove (Hosted yarn berry rollback/remove put back a descriptor that yarn remove deleted from one workspace member, so every yarn install --immutable fails YN0028 #1435). .yarnrc.yml ${VAR}/YAML reads (Yarn berry PnP refusal misses a live Plug'n'Play project whose .yarnrc.yml sets nodeLinker through ${VAR} interpolation: agent apply exits 0 "not installed" and lock-only vendor passes the PnP gate (regression from #978) #1100). CRLF .npmrc append (Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses #1196).
• Composer: inherited vendor-dir (Composer crawler ignores a vendor-dir set in the global Composer config, so scan -g and agent scans report "No packages found" and leave installs unpatched #439, Hosted Composer vex attests not_affected for an unpatched package when config.vendor-dir is absolute or uses ~/ or $HOME/ #686) and the XDG global home (Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH #586).
• Go: vex of +incompatible modules (Agent-mode Go vex omits an applied patch for a +incompatible module (not_applied, exit 1) because it looks up the manifest with a literal "+" while the API key spells it %2B #484).
• RubyGems: a BUNDLE_GEMFILE in another directory (Gem agent crawl ignores that BUNDLE_GEMFILE=gemfiles/x.gemfile moves Bundler.root, so a relative bundle path resolves to the wrong dir, apply patches the system copy and vex attests not_affected while Bundler loads the unpatched gemfiles/vendor/bundle copy #952) and revert of a commented Gemfile line (Vendored gem revert restores Gemfile.lock but leaves the Gemfile path: line when that line carries a trailing comment, and no re-run can finish it #988).
• PyPI: Poetry source = "pypi" with 1.4–2.2 locks (Hosted and vendored Poetry rewrites break poetry install on Poetry 1.4–2.2 when the patched dependency is declared with source = "pypi" ("Repository \"pypi\" does not exist."), with no warning #1282) and Hatch paths containing %#;? (Vendored Hatch wiring makes every Hatch install fail when the checkout path contains %XX, # or ; (e.g. a Jenkins "feature%2Fx" workspace), because Hatch's {root:uri} only escapes spaces #547).

No entry, on purpose

• Fix macOS go.work member match through ./x/../app #1411 fixes macOS in code that Fix Go replaces that go.work ignores (#393, #458, #531) #1393 added within this release. The Fix Go replaces that go.work ignores (#393, #458, #531) #1393 entry already describes the intended behavior, so it's unchanged.
• Fix yarn classic hosted scan lock rescans (#1423) #1426 fixes a perf regression that was introduced and fixed within 5.0.0.
• CI, test and bench PRs: CI: run Windows pnpm e2e tests instead of skipping (#1054) #1407, CI: share test helpers in repair/scan tests (#824) #1410, CI perf: full tier (41 legs) runs on every push to main, not just nightly #1414/CI: run the full e2e tier nightly, not per push (#1414) #1415, Fix env race flake in cache_env scrub self-tests #1418, Bench: serve yarn classic tarballs; allow NuGet stale-cache warning #1422, Annotate failing tests in the coverage job #1438, CI: share test helpers in the last 4 modules (#824) #1439.

Checks

• scripts/release-lint.sh --stable-only --tag-check: all checks passed.
• release.py changelog check --version 5.0.0 passed.
• test_release.ChangelogTests: OK.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changelog update for an existing release; no runtime or build behavior changes.

Overview
Extends the [5.0.0] section in CHANGELOG.md so release notes cover main through 4cb3643ac, documenting 22 fixes that landed after the prior changelog fold (#1432). No application code changes—only release notes.

Fixed entries are added or reorganized by ecosystem: Cargo (honor [source.crates-io] replace-with directory sources; pin explicit registry = "crates-io"), Composer (dedicated subsection—inherited vendor-dir, XDG global home), Go (vex for +incompatible agent patches), npm family (pnpm with lockfile off, Berry restore after member yarn remove, .yarnrc.yml interpolation, CRLF .npmrc append), RubyGems (Appraisal-style BUNDLE_GEMFILE, vendored revert when the Gemfile line was commented), and PyPI (Poetry source = "pypi" on 1.4–2.2 locks, Hatch paths with URL-breaking characters).

^{Reviewed by Cursor Bugbot for commit 2242d85. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent)

• Head: 2242d8505d940e10cb6f025c6492655a2fd959e2
• CI: 35/35 green, 19 path-skipped; no main-wide failures.
• Bugbot: reviewed this head, no findings.
• Release PR, so the CHANGELOG.md edit is expected. Auto-merge is already armed; it enters the queue once approved.
• Reviewer: check the "No entry, on purpose" list matches your intent for Fix macOS go.work member match through ./x/../app #1411/Fix yarn classic hosted scan lock rescans (#1423) #1426.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Adds 22 more merged fixes to the [5.0.0] section of CHANGELOG.md, so the 5.0.0 notes cover main up to 4cb3643ac (#1432). The only file changed is CHANGELOG.md, and no code changes.

Risk: low. It only changes the release notes, on a release/v* branch where editing CHANGELOG.md is expected.

Look here:

• Composer, now split into a sub-list
• npm-family additions (#1074, #1435, #1100, #1196)
• Cargo source replacement and the registry = "crates-io" pin (#338, #455, #386)
• Poetry source = "pypi" and Hatch path refusals (#1282, #547)
• PR body, "No entry, on purpose": check that leaving out Fix macOS go.work member match through ./x/../app #1411 and Fix yarn classic hosted scan lock rescans (#1423) #1426 is what you want.

Verified:

• Each new entry maps to a merged commit on main: Fix hosted pnpm pin of a lock pnpm ignores (#1074) #1431, Fix berry restore keeping removed descriptors (#1435) #1436, Fix yarnrc ${VAR} and YAML setting reads (#1100) #1433, Fix CRLF .npmrc append with no final newline (#1196) #1417, Fix Composer vendor-dir config cascade (#439, #686) #1408, Fix Composer global home lookup order (#586) #1421, Fix Go vex of +incompatible module patches (#484) #1427, Fix gem agent crawl under a moved BUNDLE_GEMFILE (#952) #1430, Fix gem revert of a commented Gemfile line (#988) #1406, Fix Poetry rewrite of a source = "pypi" dep (#1282) #1413, Fix vendored Hatch refs in %/#/;/? checkouts (#547) #1428, Fix Cargo source replacement being ignored (#338, #455) #1420, Fix hosted cargo pin of registry = "crates-io" (#386) #1412.
• Every warning code the entries name exists in crates/ on main: redirect_pnpm_lockfile_disabled, redirect_poetry_lock_unsupported, pypi_poetry_source_constraint, pypi_hatch_unsupported, redirect_cargo_directory_source.
• CI: 35/35 green, 19 path-skipped. Bugbot reviewed this head and found nothing. There are no review threads.

Changes I made: none.

Open question (doesn't block this PR): main has moved past the stated coverage point. Five user-facing fixes landed after 4cb3643ac and aren't in these notes yet: #1442 (#1116), #1444 (#1220), #1419 (#409), #1440 (#1437) and #1434 (#564). (#1441 and #1443 are CI-only.) They need another fold before the tag is cut, either in this PR or in a follow-up.

Auto-merge is armed, so approving sends this straight to the merge queue.

---

Generated by Claude Code