Issues

Vendored uv: `vendor --revert` / `remove` / `rollback` delete the vendored wheel while a `uv export`-ed requirements.txt or pylock.toml still points at it (exit 0), so installs from the exported file fail

SocketDev/socket-patch#996 · opened

on Oct 7, 2026

1

Lock-only requirements.txt discovery skips `-r` includes that are quoted, backslash-escaped or use `${VAR}` (`-r "dev reqs.txt"`, `--requirement="dev.txt"`, `-r ${DIR}/dev.txt`), so the scan exits 0 with "No patches" while pip installs the include's unpatched pins

SocketDev/socket-patch#994 · opened

on Oct 7, 2026

3

Perf regression: npm/hosted wall +15% (2463257a..9c43dfc9)

SocketDev/socket-patch#993 · opened

on Oct 7, 2026

1

Hosted Bun rollback/remove writes an empty registry slot that Bun < 1.3.7 resolves against npmjs, so custom-registry projects can't frozen-install after a revert

SocketDev/socket-patch#992 · opened

on Oct 7, 2026

1

Vendored yarn classic: after a git merge resolves .socket/vendor/state.json to one side, `vendor --check` and `rollback` exit 0 while the other side's package stays wired, and rollback deletes the ledger, stranding it

SocketDev/socket-patch#991 · opened

on Oct 7, 2026

1

Finish every vendored revert through one shared helper with an explicit keep policy instead of 12 copied finish blocks

SocketDev/socket-patch#990 · opened

on Oct 7, 2026

1

Tracking: revert every vendored backend through one record-revert engine instead of nine hand-written mechanisms

SocketDev/socket-patch#989 · opened

on Oct 7, 2026

1

Vendored gem revert restores Gemfile.lock but leaves the Gemfile path: line when that line carries a trailing comment, and no re-run can finish it

SocketDev/socket-patch#988 · opened

on Oct 7, 2026

1

Gem hosted and vendored lock pins ignore a gemspec development dependency on the same gem, so on Bundler 2.7+ the rewritten Gemfile.lock fails every frozen install (`(= v)!` vs Bundler's merged `(>= 0, = v)!`)

SocketDev/socket-patch#985 · opened

on Oct 7, 2026

1

Decide: keep the --update binary swap, or replace it with the installer and keep only the update notifier

SocketDev/socket-patch#983 · opened

on Oct 7, 2026

1

CLI_CONTRACT.md documents status paidRequired for get and scan, but get emits "paid_required" and scan never reports it

SocketDev/socket-patch#982 · opened

on Oct 7, 2026

1

Vendored Pipenv lock breaks `pipenv requirements --hash` | `pip install -r` on Pipenv 2023+: the vendored wheel is exported without a hash, so pip's hash-checking mode refuses the whole install

SocketDev/socket-patch#981 · opened

on Oct 7, 2026

1

Vendored `vendor --dry-run` previews success on a uv project with an inline `[tool.uv]` / `sources` table, but the real run refuses `pypi_uv_lock_parse_failed` (exit 1)

SocketDev/socket-patch#979 · opened

on Oct 7, 2026

3

Vendored requirements.txt can't be reverted once the user touches the `# socket-patch vendor:` comment: `vendor --revert` drift-keeps forever (exit 0), and the suggested "re-vendor" remedy is a no-op or adds a duplicate line

SocketDev/socket-patch#977 · opened

on Oct 7, 2026

2

Yarn 4 node-modules / pnpm-linker projects migrated from Yarn 2 PnP keep a stale `.pnp.js`, and socket-patch refuses them as Plug'n'Play: agent and vendored exit 1, hosted warns "npm dependencies were NOT scanned" (regression since 3.3.0)

SocketDev/socket-patch#975 · opened

on Oct 7, 2026

5

On Alpine/musl, `@socketsecurity/socket-patch` installed with yarn classic exits 1 with no output: yarn 1 ignores `libc`, installs both -gnu and -musl binaries, and the wrapper runs the glibc one

SocketDev/socket-patch#974 · opened

on Oct 7, 2026

4

Decide: vendor single-module Maven poms through the suffixed-version jvm planner and retire the same-GAV <repository> wiring

SocketDev/socket-patch#973 · opened

on Oct 7, 2026

1

Move the v5 JVM vendor orchestration and Maven acquisition out of maven_repo.rs into vendor/jvm

SocketDev/socket-patch#972 · opened

on Oct 7, 2026

1

Tracking: vendor every Maven shape through the jvm planner and retire the legacy single-pom backend

SocketDev/socket-patch#971 · opened

on Oct 7, 2026

1

Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning

SocketDev/socket-patch#969 · opened

on Oct 7, 2026

1

Gem crawler ignores Bundler's `.bundle` default install path (`default_install_uses_path` on 2.x, `simulate_version 5` on 4.x), so agent `apply` patches the system copy and `vex` attests `not_affected` while Bundler loads the unpatched `.bundle/ruby/<abi>` copy

SocketDev/socket-patch#967 · opened

on Oct 6, 2026

2

Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded

SocketDev/socket-patch#966 · opened

on Oct 6, 2026

Vendored scan of a fresh uv checkout (uv.lock, no .venv yet) exits 1 on packages that exist only in the system Python, because the crawler falls back to the global site-packages (the uv side of #947)

SocketDev/socket-patch#964 · opened

on Oct 6, 2026

4

Yarn berry hosted rollback/remove report success after a user `yarn patch` of the pinned package, but leave a lock that every `yarn install --immutable` rejects (YN0028); the next install re-pins the Socket tarball

SocketDev/socket-patch#962 · opened

on Oct 6, 2026

1

Route vendored revert and in-use dispatch through one core VendorBackend enum instead of CLI string matches

SocketDev/socket-patch#960 · opened

on Oct 6, 2026

1

Navigation Menu

Repository navigation

Issues

Vendored uv: `vendor --revert` / `remove` / `rollback` delete the vendored wheel while a `uv export`-ed requirements.txt or pylock.toml still points at it (exit 0), so installs from the exported file fail

Lock-only requirements.txt discovery skips `-r` includes that are quoted, backslash-escaped or use `${VAR}` (`-r "dev reqs.txt"`, `--requirement="dev.txt"`, `-r ${DIR}/dev.txt`), so the scan exits 0 with "No patches" while pip installs the include's unpatched pins

Perf regression: npm/hosted wall +15% (2463257a..9c43dfc9)

Hosted Bun rollback/remove writes an empty registry slot that Bun < 1.3.7 resolves against npmjs, so custom-registry projects can't frozen-install after a revert

Vendored yarn classic: after a git merge resolves .socket/vendor/state.json to one side, `vendor --check` and `rollback` exit 0 while the other side's package stays wired, and rollback deletes the ledger, stranding it

Finish every vendored revert through one shared helper with an explicit keep policy instead of 12 copied finish blocks

Tracking: revert every vendored backend through one record-revert engine instead of nine hand-written mechanisms

Vendored gem revert restores Gemfile.lock but leaves the Gemfile path: line when that line carries a trailing comment, and no re-run can finish it

Gem hosted and vendored lock pins ignore a gemspec development dependency on the same gem, so on Bundler 2.7+ the rewritten Gemfile.lock fails every frozen install (`(= v)!` vs Bundler's merged `(>= 0, = v)!`)

Decide: keep the --update binary swap, or replace it with the installer and keep only the update notifier

CLI_CONTRACT.md documents status paidRequired for get and scan, but get emits "paid_required" and scan never reports it

Vendored Pipenv lock breaks `pipenv requirements --hash` | `pip install -r` on Pipenv 2023+: the vendored wheel is exported without a hash, so pip's hash-checking mode refuses the whole install

Vendored `vendor --dry-run` previews success on a uv project with an inline `[tool.uv]` / `sources` table, but the real run refuses `pypi_uv_lock_parse_failed` (exit 1)

Vendored requirements.txt can't be reverted once the user touches the `# socket-patch vendor:` comment: `vendor --revert` drift-keeps forever (exit 0), and the suggested "re-vendor" remedy is a no-op or adds a duplicate line

Yarn 4 node-modules / pnpm-linker projects migrated from Yarn 2 PnP keep a stale `.pnp.js`, and socket-patch refuses them as Plug'n'Play: agent and vendored exit 1, hosted warns "npm dependencies were NOT scanned" (regression since 3.3.0)

On Alpine/musl, `@socketsecurity/socket-patch` installed with yarn classic exits 1 with no output: yarn 1 ignores `libc`, installs both -gnu and -musl binaries, and the wrapper runs the glibc one

Decide: vendor single-module Maven poms through the suffixed-version jvm planner and retire the same-GAV <repository> wiring

Move the v5 JVM vendor orchestration and Maven acquisition out of maven_repo.rs into vendor/jvm

Tracking: vendor every Maven shape through the jvm planner and retire the legacy single-pom backend

Vendored npm scan wires file: tarballs that npm ≥ 11.14 refuses under allow-file=root (transitive deps) or allow-file=none, so every npm ci fails EALLOWFILE while scan, vendor --check and vex report success with no warning

Gem crawler ignores Bundler's `.bundle` default install path (`default_install_uses_path` on 2.x, `simulate_version 5` on 4.x), so agent `apply` patches the system copy and `vex` attests `not_affected` while Bundler loads the unpatched `.bundle/ruby/<abi>` copy

Decide: warn on and then remove scan --apply/--vendor, and whether --vex stays embedded

Vendored scan of a fresh uv checkout (uv.lock, no .venv yet) exits 1 on packages that exist only in the system Python, because the crawler falls back to the global site-packages (the uv side of #947)

Yarn berry hosted rollback/remove report success after a user `yarn patch` of the pinned package, but leave a lock that every `yarn install --immutable` rejects (YN0028); the next install re-pins the Socket tarball

Route vendored revert and in-use dispatch through one core VendorBackend enum instead of CLI string matches