[Mikola Lysenko (mikolalysenko)]

Follow-up to #2032: notes for four PRs that landed while it was in review

#2032 covered v5.0.1..7bde3ba. Before it merged, four more PRs landed on main (c6a4fda6..502aa1fc). They ship in 5.1.0 because the Release workflow hasn't been dispatched yet, so they need entries in the [5.1.0] section first.

This PR changes only CHANGELOG.md (+12/−1, inside ## [5.1.0]). The version stays 5.1.0, and the new entries don't change the version bump.

PR	Where	Note
#2013	Fixed → npm family	Hosted vlt scans stop downloading every patch archive. redirect_vlt_artifact_unverifiable is no longer raised, and the in-memory engine (Node addon, hosted-bundle) pins vlt deps instead of withholding them as offline
#1999 (#1997)	Fixed → RubyGems	A gem inside nested source … do blocks is attributed to the innermost block, so hosted rollback/remove on Bundler ≤ 2.1 no longer refuses with hosted_wiring_contested
#2000	Maintenance	Test-only
#2027	Maintenance	Release workflow artifact steps move off Node 20 actions

Double-check: #2013 could arguably go under ### Changed, since it drops the encoding check rather than fixing a bug. The version is minor either way.

Local checks: release-lint.sh --stable-only --tag-check passed, and release.py changelog check --version 5.1.0 passed.

Maintainer checklist

• Approve and merge this PR before dispatching Release, so the GitHub release notes include these entries.
• After merge, confirm nothing else landed: git log --first-parent <this PR's merge SHA>..origin/main.
• Actions → Release → Run workflow on main (optionally a dry-run: true run first).
• Approve the npm stages with 2FA: the 14 platform packages first, @socketsecurity/socket-patch last.

Generated by a one-off release-staging routine.

---

Generated by Claude Code

---

Note

Low Risk
Changelog-only; no runtime or release automation logic changed in this diff.

Overview
Documents four follow-up fixes in the [5.1.0] section so they ship with the next release cut.

Fixed → RubyGems. Records that gems inside nested source … do blocks are credited to the innermost block like Bundler, so hosted rollback / remove no longer hit hosted_wiring_contested on Bundler 2.1 and older (#1997, #1999).

Fixed → npm family. Records hosted vlt behavior: scans stop downloading every granted patch archive for encoding checks and no longer emit redirect_vlt_artifact_unverifiable; re-encoded mirrors fail vlt ci with EINTEGRITY; the in-memory hosted path (Node addon, hosted-bundle) pins vlt dependencies instead of treating them as offline-only (#2013).

Maintenance. Extends the test/CI bullet with #2000 and notes that release workflow artifact steps no longer use Node 20 actions (#2027).

^{Reviewed by Cursor Bugbot for commit 5d76313. Configure here.}