Sourced from @​socketsecurity/lib's changelog.

5.5.3 - 2026-01-20

Fixed

• deps: Added patch for execa@2.1.0 to fix signal-exit v4 compatibility. The package was using default import syntax with signal-exit v4, which now exports onExit as a named export.

5.5.2 - 2026-01-20

Changed

• dlx/package: Use getSocketCacacheDir() instead of getPacoteCachePath() for Arborist cache configuration
  • Ensures consistent use of Socket's shared cacache directory (~/.socket/_cacache)
  • Removes dependency on pacote cache path extraction which could fail
  • Simplifies cache configuration by using reliable Socket path utility

5.5.1 - 2026-01-12

Fixed

• Fixed dotenvx compatibility with pre-commit hooks
• Fixed empty releases being returned when finding latest release

5.5.0 - 2026-01-12

Added

• dlx/detect: Executable type detection utilities for DLX cache and local file paths
  • detectDlxExecutableType(): Detects Node.js packages vs native binaries in DLX cache by checking for node_modules/ directory
  • detectExecutableType(): Generic entry point that routes to appropriate detection strategy
  • detectLocalExecutableType(): Detects executables on local filesystem by checking package.json bin field or file extension
  • isJsFilePath(): Validates if a file path has .js, .mjs, or .cjs extension
  • isNativeBinary(): Simplified helper that returns true for native binary executables
  • isNodePackage(): Simplified helper that returns true for Node.js packages

Fixed

• releases/github: Sort releases by published_at to reliably find latest release instead of relying on creation order

5.4.1 - 2026-01-10

Fixed

• build: Removed debug module stub to bundle real debug package. The stub was missing enable() and disable() methods, causing errors when downstream projects re-bundled the lib.

• 1f92aae chore: bump version to 5.5.3
• 793bb62 fix(deps): add patch for execa@2.1.0 to fix signal-exit v4 compatibility
• af6f826 chore: release v5.5.2
• c0b991a refactor(dlx): use getSocketCacacheDir instead of getPacoteCachePath
• 532b7a5 feat(spawn): enhance error messages with detailed context
• d315d05 feat(external): add TypeScript type definitions for external modules
• bb45736 fix(deps): update Socket packages regardless of taze result
• 92a32ba fix(tests): use mockResolvedValueOnce to prevent mock isolation issues
• 221e49c chore: release v5.5.1
• a174575 chore(deps): add -w flag to taze in update script
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)