[John-David Dalton (jdalton)]

Build Socket 2.1.0-rc.N as a signed, platform-specific Node 27 SEA. .config/release.json keeps this track on the prerelease-2.1.0 dist-tag; stable v1.x releases retain their three existing packages.

pnpm run approve:npm <id> checks the authenticated npm stage and approves it when ready. The workflow then verifies the signed tag is on the default branch and waits for npm to serve every package version before creating the GitHub release from the tag’s changelog. A timeout creates no GitHub release and can be retried with the same tag. Blocked or deleted stages burn the version; their changes carry into the next changelog.

The VFS embeds the bundled tools. cdxgen and synp are present for darwin-arm64 but remain unavailable until their provenance and notice requirements are resolved.

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​termless/​xtermjs@​0.11.0
	npm/​@​types/​cross-spawn@​6.0.6
	npm/​@​actions/​cache@​6.3.0
	npm/​node-pty@​1.2.0-beta.18
	npm/​@​termless/​core@​0.11.0
	npm/​svgo@​4.1.0

View full report

[socket-security-staging]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm playwright-core under MIT WITH Google-Patent-WebM License: MIT WITH Google-Patent-WebM - The applicable license policy does not permit this license (5) (package/lib/webp_codec.LICENSE) From: package.json → npm/@termless/core@0.11.0 → npm/playwright-core@1.65.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity-Staging ignore npm/playwright-core@1.65.0. You can also ignore all packages with @SocketSecurity-Staging ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[John-David Dalton (jdalton)]

Cursor (@cursor) review

[cursor]

Stale Bugbot comment from a previous run.

[Vasco Santos (vasco-santos)]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 34c56c5. Configure here.}