@socketsecurity/lib 5.8.1 → 5.8.2

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.8.2](https://github.com/SocketDev/socket-lib/releases/tag/v5.8.2) - 2026-03-13
+
+### Fixed
+
+- **http-request**: Download to temp file then atomically rename to prevent corruption
+  - Downloads now write to `{destPath}.download` temp file first
+  - On success, atomically renames to the destination path
+  - On failure, cleans up temp file and preserves any existing file at destination
+  - Prevents partial/corrupted files from CI caching causing extraction failures
+
 ## [5.8.1](https://github.com/SocketDev/socket-lib/releases/tag/v5.8.1) - 2026-03-11
 
 ### Performance

package/dist/http-request.js

@@ -25,6 +25,7 @@ __export(http_request_exports, {
   httpText: () => httpText
 });
 module.exports = __toCommonJS(http_request_exports);
+var import_fs = require("./fs.js");
 let _fs;
 // @__NO_SIDE_EFFECTS__
 function getFs() {
@@ -308,18 +309,31 @@ async function httpDownload(url, destPath, options) {
       }
     };
   }
+  const fs = /* @__PURE__ */ getFs();
+  const tempPath = `${destPath}.download`;
+  if (fs.existsSync(tempPath)) {
+    await (0, import_fs.safeDelete)(tempPath);
+  }
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
-      return await httpDownloadAttempt(url, destPath, {
+      const result = await httpDownloadAttempt(url, tempPath, {
         followRedirects,
         headers,
         maxRedirects,
         onProgress: progressCallback,
         timeout
       });
+      await fs.promises.rename(tempPath, destPath);
+      return {
+        path: destPath,
+        size: result.size
+      };
     } catch (e) {
       lastError = e;
+      if (fs.existsSync(tempPath)) {
+        await (0, import_fs.safeDelete)(tempPath);
+      }
       if (attempt === retries) {
         break;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "5.8.1",
+  "version": "5.8.2",
   "packageManager": "pnpm@10.32.1",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
@@ -734,7 +734,7 @@
     "@socketregistry/is-unicode-supported": "1.0.5",
     "@socketregistry/packageurl-js": "1.3.5",
     "@socketregistry/yocto-spinner": "1.0.25",
-    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.8.0",
+    "@socketsecurity/lib-stable": "npm:@socketsecurity/lib@5.8.1",
     "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
     "@vitest/coverage-v8": "4.0.3",