chore: bump @socketregistry/packageurl-js to 1.4.1

.claude/skills/updating/reference.md

@@ -0,0 +1,76 @@
+# updating Reference Documentation
+
+## Table of Contents
+
+1. [How the Update Script Works](#how-the-update-script-works)
+2. [Files Changed After Update](#files-changed-after-update)
+3. [Validation Commands](#validation-commands)
+4. [Troubleshooting](#troubleshooting)
+
+---
+
+## How the Update Script Works
+
+`pnpm run update` runs `scripts/update.mjs` which performs:
+
+```bash
+# 1. Run taze recursively with write mode
+pnpm exec taze -r -w
+
+# 2. Force-update Socket scoped packages (bypasses taze maturity period)
+pnpm update @socketsecurity/* @socketregistry/* @socketbin/* --latest -r
+
+# 3. pnpm install runs automatically to reconcile lockfile
+```
+
+### Repo Structure
+
+- **Single package** (not a monorepo, no `packages/` directory)
+- Dependencies pinned to exact versions in `package.json`
+- Uses `pnpm.overrides` and `pnpm.patchedDependencies` for dependency control
+- Has a `@socketsecurity/lib-stable` self-referencing alias used by the update script itself
+
+---
+
+## Files Changed After Update
+
+- `package.json` - Dependency version pins
+- `pnpm-lock.yaml` - Lock file
+
+---
+
+## Validation Commands
+
+```bash
+# Fix lint issues
+pnpm run fix --all
+
+# Run all checks (lint + type check)
+pnpm run check --all
+
+# Run tests
+pnpm test
+```
+
+---
+
+## Troubleshooting
+
+### taze Fails to Detect Updates
+
+**Cause:** taze has a maturity period for new releases.
+**Solution:** Socket packages are force-updated separately via `pnpm update --latest`.
+
+### Lock File Conflicts
+
+**Solution:**
+```bash
+rm pnpm-lock.yaml
+pnpm install
+```
+
+### Self-Reference Alias
+
+The `@socketsecurity/lib-stable` devDependency points to a published version
+of this package itself. It must remain on a stable release (used by
+`scripts/update.mjs` to avoid circular issues).

package.json

@@ -732,7 +732,7 @@
     "@npmcli/package-json": "7.0.0",
     "@npmcli/promise-spawn": "8.0.3",
     "@socketregistry/is-unicode-supported": "1.0.5",
-    "@socketregistry/packageurl-js": "1.3.5",
+    "@socketregistry/packageurl-js": "1.4.1",
     "@socketregistry/yocto-spinner": "1.0.25",
     "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.11.4",
     "@types/node": "24.9.2",