Issues

vendor --check reports a missing or corrupt vendored artifact as a raw Rust Debug value (`Corrupt { reason: "vendor_workspace_artifact_missing" }`) with no remedy, though `socket-patch repair` fixes it

SocketDev/socket-patch#1467 · opened

on Oct 13, 2026

2

Hosted yarn berry rollback/remove drop the `::__archiveUrl=` binding when the project's mirror serves npmjs tarball URLs, so cold installs fetch a mirror path that 404s

SocketDev/socket-patch#1465 · opened

on Oct 13, 2026

3

Hosted yarn classic rescan and VEX accept a pin written by v4.0.0 whose patched package.json adds a dependency the lock doesn't have, so yarn installs the patched package without it

SocketDev/socket-patch#1462 · opened

on Oct 13, 2026

3

Hosted pnpm scan refuses with redirect_pnpm_lockfile_disabled over env lockfile settings the project's pnpm major ignores (e.g. any pnpm 11/12 project run through `npm exec` with package-lock=false)

SocketDev/socket-patch#1460 · opened

on Oct 13, 2026

3

v5.0.0 not published: registry trusted publishers still name release.yml

SocketDev/socket-patch#1456 · opened

on Oct 12, 2026

1

Pipenv stale-install remedy can't replace a base-interpreter copy in a `--site-packages` venv: `pip uninstall` refuses it and `pipenv sync` keeps it, so following the warning leaves the package unpatched

SocketDev/socket-patch#1450 · opened

on Oct 12, 2026

3

The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a `source = "pypi"` dependency and `poetry install` 1.3 fails with a solver error

SocketDev/socket-patch#1447 · opened

on Oct 12, 2026

4

Hosted uv: after `uv remove <parent>` or `uv lock --upgrade-package <parent>` drops a hosted-pinned transitive package, its leftover override makes rollback, remove and list fail forever with hosted_wiring_contested

SocketDev/socket-patch#1445 · opened

on Oct 12, 2026

3

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

SocketDev/socket-patch#1425 · opened

on Oct 12, 2026

1

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

SocketDev/socket-patch#1424 · opened

on Oct 12, 2026

Swarm health manager log

SocketDev/socket-patch#1382 · opened

on Oct 11, 2026

2

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

SocketDev/socket-patch#1352 · opened

on Oct 9, 2026

2

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

SocketDev/socket-patch#1268 · opened

on Oct 9, 2026

2

Path-scoped agent `scan packages/a` and `rollback packages/a` skip a workspace member's npm alias (`lp@npm:left-pad`) under install-strategy=linked, while its plain links are in scope (exit 0, success)

SocketDev/socket-patch#1266 · opened

on Oct 9, 2026

3

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

SocketDev/socket-patch#1248 · opened

on Oct 9, 2026

7

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

SocketDev/socket-patch#1246 · opened

on Oct 9, 2026

2

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

SocketDev/socket-patch#1236 · opened

on Oct 9, 2026

9

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

SocketDev/socket-patch#1235 · opened

on Oct 9, 2026

2

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

SocketDev/socket-patch#1232 · opened

on Oct 9, 2026

3

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

SocketDev/socket-patch#1202 · opened

on Oct 9, 2026

5

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

SocketDev/socket-patch#1200 · opened

on Oct 9, 2026

1

CI performance dashboard

SocketDev/socket-patch#1182 · opened

on Oct 8, 2026

1

Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

SocketDev/socket-patch#1135 · opened

on Oct 8, 2026

3

Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data?

SocketDev/socket-patch#1130 · opened

on Oct 8, 2026

1

A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path

SocketDev/socket-patch#1123 · opened

on Oct 8, 2026

2

Navigation Menu

Repository navigation

Issues

vendor --check reports a missing or corrupt vendored artifact as a raw Rust Debug value (`Corrupt { reason: "vendor_workspace_artifact_missing" }`) with no remedy, though `socket-patch repair` fixes it

Hosted yarn berry rollback/remove drop the `::__archiveUrl=` binding when the project's mirror serves npmjs tarball URLs, so cold installs fetch a mirror path that 404s

Hosted yarn classic rescan and VEX accept a pin written by v4.0.0 whose patched package.json adds a dependency the lock doesn't have, so yarn installs the patched package without it

Hosted pnpm scan refuses with redirect_pnpm_lockfile_disabled over env lockfile settings the project's pnpm major ignores (e.g. any pnpm 11/12 project run through `npm exec` with package-lock=false)

v5.0.0 not published: registry trusted publishers still name release.yml

Pipenv stale-install remedy can't replace a base-interpreter copy in a `--site-packages` venv: `pip uninstall` refuses it and `pipenv sync` keeps it, so following the warning leaves the package unpatched

The #1282 source-pin guard misses Poetry 1.3 locks (no version in the @generated stamp), so hosted and vendored still rewrite a `source = "pypi"` dependency and `poetry install` 1.3 fails with a solver error

Hosted uv: after `uv remove <parent>` or `uv lock --upgrade-package <parent>` drops a hosted-pinned transitive package, its leftover override makes rollback, remove and list fail forever with hosted_wiring_contested

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

Swarm health manager log

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

Path-scoped agent `scan packages/a` and `rollback packages/a` skip a workspace member's npm alias (`lp@npm:left-pad`) under install-strategy=linked, while its plain links are in scope (exit 0, success)

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

CI performance dashboard

Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data?

A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path