chore: cascade — socket-registry refs + @socketsecurity/lib 5.21.0 + workspace hooks + lib-stub expansion (#596)

* chore: cascade — socket-registry refs + @socketsecurity/lib 5.21.0 + workspace hooks + lib-stub expansion

Squash of the full cascade sync branch:

1. socket-registry action refs bumped to @3362af95fadd1e325cb48e9ad6daff21c112bd72.
   Cascades the pnpm 11.0.0-rc.0 → 11.0.0-rc.2 bump from socket-registry.

2. .github/workflows/weekly-update.yml reduced to a thin 20-line delegator
   calling SocketDev/socket-registry/.github/workflows/weekly-update.yml.

3. @socketsecurity/lib bumped 5.18.2 → 5.21.0 (via 5.19.0, 5.19.1, 5.20.0,
   5.20.1). Hook manifest .claude/hooks/check-new-deps/package.json kept in
   lockstep. Brings:
   - `schema/` module (replaces retired `validation/validate-schema`)
   - `json/parse` absorbs `validation/json-parser`'s `safeJsonParse`
   - `withResolvers()` on `promises` (TC39 Promise.withResolvers)
   - spec-compliant `escapeRegExp` (bound to native RegExp.escape on Node 24+)
   - O(1) LRU in memoization; wildcard clear() compile-once in cacache
   - ENOENT normalized across extractZip/Tar/TarGz
   - dlx pin pipeline, pacote shim fix, DlxBinaryOptions.hash, stdio/prompts
     restoration

   Test update required by #3: `test/unit/promise-queue.test.mts` —
   5.21.0's bounded queue rejects the NEWEST submission when full
   (preserving committed-to in-flight work), not the oldest. Renamed the
   test and updated the scenario to match the new contract.

4. pnpm-workspace.yaml packages glob now includes .claude/hooks/* so taze
   bumps hook manifests automatically.

5. createLibStubPlugin in .config/esbuild.config.mts also stubs external/del.js
   + external/cacache.js (eagerly loaded by lib/fs + lib/cacache but unused
   by the SDK).

6. fix(publish): gate --provenance on GITHUB_ACTIONS so local publish runs
   don't break.

7. Fixes pre-existing printFooter imports in scripts/build.mts +
   scripts/check.mts that pulled from lib/stdio/header where printFooter
   never lived. 5.18.2's loose subpath exports hid the bug; 5.19.x surfaces it.

Folds PR #601 (socket-registry 3362af95 bump) into this cascade.

* chore(ci): bump socket-registry workflow refs to 594526f

* fix(ci): allow @pnpm/exe preinstall for pnpm rc.3 bootstrap

* chore(ci): bump socket-registry refs to main (6e347cee)

Picks up pinned sfw download fix (checksum vs version drift).

* chore(ci): bump socket-registry refs to main (46132ceb)

Picks up SFW_CUSTOM_REGISTRIES bypass list export.

* chore(ci): bump socket-registry refs to main (a5923566) and swap secret ref

* chore(provenance): drop publish-without-sfw + bump socket-registry to d638c11f

Upstream socket-registry removed the publish-without-sfw escape hatch
(the shim disable/restore dance is no longer needed post-bypass).

Author: jdalton

.claude/hooks/check-new-deps/package.json

@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@socketregistry/packageurl-js": "1.4.2",
-    "@socketsecurity/lib": "5.18.2",
+    "@socketsecurity/lib": "5.21.0",
     "@socketsecurity/sdk": "4.0.1"
   },
   "devDependencies": {

.config/esbuild.config.mts

@@ -241,8 +241,21 @@ function createNodeProtocolPlugin() {
  *     minimal lookup covering just those types.
  */
 function createLibStubPlugin() {
+  // Heavy lib modules that are eagerly required but never exercised
+  // by the SDK's actual code paths.
+  //
+  // Never-reached by SDK gateway modules:
+  //   - globs.js / sorts.js → only used by fs helpers the SDK skips
+  //   - external/npm-pack.js / pico-pack.js → Arborist/pacote/fast-glob,
+  //     SDK only needs validateFiles() from fs
+  //
+  // Never-reached transitive external shims:
+  //   - external/cacache.js → destructures from npm-pack (already stubbed),
+  //     SDK's cache-with-ttl path degrades gracefully
+  //   - external/del.js → pulled in by fs's lazy getDel() for safeDelete,
+  //     SDK never calls safeDelete/safeDeleteSync
   const libStubPattern =
-    /@socketsecurity\/lib\/dist\/(globs|sorts|external\/(npm-pack|pico-pack))\.js$/
+    /@socketsecurity\/lib\/dist\/(globs|sorts|external\/(npm-pack|pico-pack|cacache|del))\.js$/
 
   const mimeDbPattern = /mime-db\/db\.json$/
 

.github/workflows/ci.yml

@@ -21,6 +21,6 @@ concurrency:
 jobs:
   ci:
     name: Run CI Pipeline
-    uses: SocketDev/socket-registry/.github/workflows/ci.yml@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
+    uses: SocketDev/socket-registry/.github/workflows/ci.yml@d638c11f4bc7ac637e0f61f05729a54d68af40e0 # main
     with:
       test-script: 'pnpm run test --all --skip-build'

.github/workflows/generate.yml

@@ -46,14 +46,14 @@ jobs:
           echo "Sleeping for $delay seconds..."
           sleep $delay
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-and-install@d638c11f4bc7ac637e0f61f05729a54d68af40e0 # main
 
       - name: Configure push credentials
         env:
           GH_TOKEN: ${{ github.token }}
         run: git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
 
-      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
+      - uses: SocketDev/socket-registry/.github/actions/setup-git-signing@d638c11f4bc7ac637e0f61f05729a54d68af40e0 # main
         with:
           gpg-private-key: ${{ secrets.BOT_GPG_PRIVATE_KEY }}
 
@@ -145,5 +145,5 @@ jobs:
           > \`\`\`
           EOF
 
-      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
+      - uses: SocketDev/socket-registry/.github/actions/cleanup-git-signing@d638c11f4bc7ac637e0f61f05729a54d68af40e0 # main
         if: always()

.github/workflows/provenance.yml

@@ -16,11 +16,6 @@ on:
         options:
           - '0'
           - '1'
-      publish-without-sfw:
-        description: 'Publish directly to npm, bypassing Socket firewall shims'
-        required: false
-        default: false
-        type: boolean
 
 permissions: {}
 
@@ -30,14 +25,13 @@ jobs:
     permissions:
       contents: write # To create GitHub releases
       id-token: write # For npm trusted publishing via OIDC
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@bbe46386c0a2bc6baefd02916234956a38e622d5 # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@d638c11f4bc7ac637e0f61f05729a54d68af40e0 # main
     with:
       debug: ${{ inputs.debug }}
       dist-tag: ${{ inputs.dist-tag }}
       package-name: '@socketsecurity/sdk'
       publish-script: 'publish:ci'
-      publish-without-sfw: ${{ inputs.publish-without-sfw }}
       setup-script: 'ci:validate'
       use-trusted-publishing: true
     secrets:
-      SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }}
+      SOCKET_API_KEY: ${{ secrets.SOCKET_API_TOKEN }}