Issues

• vendor --force documents a missing-file tolerance and a mismatch warning that no vendored backend implements

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#923 · Filter by author mikolalysenko opened on Oct 6, 2026

• Yarn classic VEX attests not_affected while a file: directory copy of the patched package@version installs unpatched, and hosted scan gives no warning for that copy

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#921 · Filter by author mikolalysenko opened on Oct 6, 2026
  2

• Build npm-family vendor ledger entries through one constructor instead of seven literal VendorEntry blocks

  agent:triagedarch-auditpm:npmpriority:p1refactor
  SocketDev/socket-patch#922 · Filter by author mikolalysenko opened on Oct 6, 2026

• Tracking: drive the seven npm-family vendor backends through one generic driver

  agent:triagedarch-auditpm:npmpriority:p1refactor
  SocketDev/socket-patch#920 · Filter by author mikolalysenko opened on Oct 6, 2026

• Hosted pnpm rollback/remove restores pnpm-lock.yaml from npmjs's version document instead of the project's .npmrc registry, so a mirror project loses its tarball: URL (cold frozen install 404s) or is moved to npmjs

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#919 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• Gem crawler ignores Bundler's path.system: true when a leftover vendor/bundle exists, so agent apply patches the unused copy and vex attests not_affected while Bundler loads the unpatched system gem

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#915 · Filter by author mikolalysenko opened on Oct 6, 2026
  3

• Hash agent-mode jar members through the shared streaming zip comparator instead of buffering each member

  agent:triagedarch-auditpm:mavenpriority:p3refactor
  SocketDev/socket-patch#914 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• Move API credential resolution out of api/client.rs into api/client/credentials.rs

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#913 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• Hosted and vendored scans rewrite a Pipenv project's pylock.toml to an archive entry that Pipenv 2026.4+ ignores, so pipenv sync silently installs the unpatched release from PyPI

  agent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#912 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• socket.yml ignorePackages / packages and scan --package don't PEP 503-normalise PyPI names, so ignorePackages: ["typing_extensions"] is silently ignored and the package is patched anyway

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#910 · Filter by author mikolalysenko opened on Oct 6, 2026
  3

• Hosted yarn berry rollback/remove still drops a custom registry's ::__archiveUrl= binding (#817 fix incomplete): the restore looks up dist.tarball on npmjs, not the project's npmRegistryServer, so cold installs 404

  agent:claimedagent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#908 · Filter by author mikolalysenko opened on Oct 6, 2026
  4

• Hosted yarn classic pins give no berry-migration warning, so a yarn 2+ install silently drops them (vendored warns about the same trap)

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#907 · Filter by author mikolalysenko opened on Oct 6, 2026
  2

• Stage prebuilt service archives through one shared helper instead of four per-backend service-copy pipelines

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#906 · Filter by author mikolalysenko opened on Oct 6, 2026

• pnpm lock and workspace readers don't skip a leading BOM, because BOM handling has no shared helper (4 named copies, ~50 inline strips)

  agent:claimedagent:triagedarch-auditbugpm:pnpmpriority:p1
  SocketDev/socket-patch#905 · Filter by author mikolalysenko opened on Oct 6, 2026
  3

• pnpm-workspace.yaml with a UTF-8 BOM: hosted and vendored miss the first top-level key and append a duplicate trustLockfile / overrides, so every pnpm install fails with "duplicate mapping key" after a successful scan

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#904 · Filter by author mikolalysenko opened on Oct 6, 2026
  4

• Hosted pnpm scan skips the trustLockfile: true auto-config when pnpm-lock.yaml starts with a UTF-8 BOM, so pnpm 11/12 frozen installs fail with ERR_PNPM_TARBALL_URL_MISMATCH after a successful scan

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#903 · Filter by author mikolalysenko opened on Oct 6, 2026
  5

• Hosted pnpm rollback/remove adds registry tarball: URLs the lock never had when lockfileIncludeTarballUrl sits in a settings file the installed pnpm ignores (workspace file on pnpm 9, .npmrc on pnpm 11/12)

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#902 · Filter by author mikolalysenko opened on Oct 6, 2026

• vendor --check fails a vendored package whose lock is contested by a sibling package-lock.json with "no lockfile or config references .socket/vendor/… any more", which is false, and its remedy ("re-run socket-patch vendor") is a no-op, so the check stays red forever

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#900 · Filter by author mikolalysenko opened on Oct 6, 2026

• npm 12 never reads npm-shrinkwrap.json, so on a shrinkwrap-only project hosted and vendored scans rewrite a lock npm 12 ignores: scan succeeds with no warning, lockfile-only VEX attests not_affected, and npm install installs the unpatched package

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#899 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• Vendored npm refusal for a symlinked package-lock.json says "nothing was written" but leaves the vendored tarball behind, then prints "Vendored 1 package" and tells you to commit .socket/vendor/

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#898 · Filter by author mikolalysenko opened on Oct 6, 2026
  1

• Gem BUNDLE_GEMFILE check compares paths lexically, so a symlinked spelling of the project's own Gemfile (e.g. macOS /tmp/app/Gemfile) is refused, and vex / rollback reject the hosted patch Bundler is loading

  agent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#896 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Move ecosystem_dispatch's purl locator out of the CLI into core as crawlers::locate

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#895 · Filter by author mikolalysenko opened on Oct 5, 2026

• Tracking: move the patch engines out of the CLI command modules into core

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#894 · Filter by author mikolalysenko opened on Oct 5, 2026

• repair and scan --prune delete the beforeHash blobs of active patches, so a later offline rollback fails and tells the user to run repair

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#893 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Vendored dry run gives no symlink warning for uv script locks or pylock files: a symlinked s.py, s.py.lock, pylock.toml or pylock.<name>.toml previews clean, and the real run then refuses (exit 1)

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#891 · Filter by author mikolalysenko opened on Oct 5, 2026
  3