chore(ci+deps): cascade socket-registry to 51f34ffb + drift updates

[John-David Dalton (jdalton)]

Summary

• Cascade pin — bumps the three workflow files to
  socket-registry@51f34ffb (was @ea1986b8 from chore(ci): cascade socket-registry pin to ea1986b8 #1278). Includes:
  • 4c4b12cc — pnpm 11.0.6 GA + Rust toolchain pin for Node 26
    Temporal + SRI integrity migration
  • e5f83c31 — wire updating-xport into the umbrella drift flow
  • 51f34ffb — release-workflow-guard quote-mask false-positive fix
• Drift updates — package.json/pnpm-lock.yaml/
  pnpm-workspace.yaml catalog alignment, cli lib refreshes, scripts
  drift, scripts/power-state.mts sync from socket-repo-template.

Scope

This is the deps + SHA cascade slice split out of #1286, combined
with closing the stale #1285 cascade branch (which had gone stale at
@0fc1abfd while @ea1986b8 merged via #1278).

Companion splits:

• chore(hooks): sync .claude/hooks fleet — mts conversion + new guards #1300 — hooks + harness-config slice
• docs(claude+skills): CLAUDE.md restructure + path-guard + new skills #1301 — skills + CLAUDE.md slice
• (this PR) — deps + cascade slice
• chore(ci): cascade socket-registry pin to 85a2fc0d #1285 — closes as superseded by this PR

After all three splits + #1285 closure land, #1286 closes.

Test plan

• CI green (workflows resolve setup-and-install@51f34ffb)
• pnpm install from a fresh clone resolves the catalog
• Power-state helper smoke runs (node scripts/power-state.mts)
• scripts/check.mts runs via pnpm check

---

Note

Medium Risk
Medium risk because it updates CI/action pins and upgrades @socketsecurity/lib, and scripts/check.mts now invokes a check-paths.mts gate that must exist in the repo to avoid breaking pnpm check.

Overview
CI and supply-chain/tooling drift updates. Workflows (ci.yml, provenance.yml, weekly-update.yml) are re-pinned to SocketDev/socket-registry actions at 51f34ffb….

Dependency + workspace policy refresh. Bumps @socketsecurity/lib to 5.26.1, adds @sinclair/typebox to root dev deps, removes the root preinstall bootstrap step, and enables pnpm blockExoticSubdeps: true in pnpm-workspace.yaml.

CLI/build behavior adjustments. Switches CLI theme initialization to @socketsecurity/lib/themes/context, rewires the ASCII header shimmer rendering to the new shimmer APIs (preserving the dual-wave look), updates a unit test for the dist/index.js entry rename, expands dev fallback resolution for the @socketaddon/iocraft native addon, adds a new scripts/power-state.mts helper, and extends scripts/check.mts to run a path-hygiene gate via check-paths.mts.

^{Reviewed by Cursor Bugbot for commit b82fc09. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​socketsecurity/​lib@​5.24.0 ⏵ 5.26.1

View full report

[socket-security-staging]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​socketsecurity/​lib@​5.24.0 ⏵ 5.26.1	+13

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Path check script is missing
  • Added an existsSync guard around the check-paths.mts spawn so the check runner skips the path-hygiene step gracefully when the script is not present in the repository.

Or push these changes by commenting:

@cursor push 18c979b883

Preview (18c979b883)

diff --git a/scripts/check.mts b/scripts/check.mts
--- a/scripts/check.mts
+++ b/scripts/check.mts
@@ -3,6 +3,7 @@
  * Runs code quality checks: Oxlint and TypeScript type checking across packages.
  */
 
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 import process from 'node:process'
 
@@ -382,14 +383,12 @@
 
     // Run path-hygiene check (1 path, 1 reference). See
     // .claude/skills/path-guard/ + .claude/hooks/path-guard/.
-    if (runAll) {
+    const gatePath = path.join(scriptsDir, 'check-paths.mts')
+    if (runAll && existsSync(gatePath)) {
       if (!quiet) {
         logger.log('')
         logger.progress('Running path-hygiene check (1 path, 1 reference)')
       }
-      // Resolve the gate path against scripts/ so this runner works
-      // when invoked from any cwd (root or a workspace package dir).
-      const gatePath = path.join(scriptsDir, 'check-paths.mts')
       const repoRoot = path.dirname(scriptsDir)
       const pathHygieneResult = await spawn('node', [gatePath, '--quiet'], {
         cwd: repoRoot,

_{You can send follow-ups to the cloud agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b82fc09. Configure here.}