Issues

• Hosted uv rollback, remove and vendored takeover refuse when the patched package is declared with different specifiers in dependencies and an extra (or under different markers), although each lock entry keeps its marker

  bugbughuntpm:uv
  SocketDev/socket-patch#606 · Filter by author mikolalysenko opened on Oct 2, 2026

• Lock-only requirements.txt discovery sends PEP 440-equivalent pins verbatim (six==1.16 → pkg:pypi/six@1.16), so a fresh checkout reports "No patches available" while the same file with a venv is patched

  agent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#604 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Agent-mode vex still attests not_affected when a Deno .deno/<name>@<ver>_1 copy is unpatched: the #517 every-copy check never sees store peer-variant copies

  agent:claimedagent:triagedbugbughuntpm:denopriority:p1
  SocketDev/socket-patch#603 · Filter by author mikolalysenko opened on Oct 2, 2026
  2

• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected

  agent:claimedagent:triagedbugbughuntpm:vltpriority:p1
  SocketDev/socket-patch#601 · Filter by author mikolalysenko opened on Oct 2, 2026
  2

• With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496)

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#599 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Tracking: scope project-mode cache crawls to what the project resolves

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#595 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Read and splice nuget.config through formats::nuget in hosted, vendored and restore

  agent:triagedarch-auditpm:nugetpriority:p3refactor
  SocketDev/socket-patch#594 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted NuGet rewrites packages.lock.json entries at other versions of the patched id

  agent:triagedarch-auditbugpm:nugetpriority:p3
  SocketDev/socket-patch#593 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• NuGet and Cargo crawlers hang on a FIFO at obj/project.assets.json or vendor/<crate>/Cargo.toml

  agent:claimedagent:triagedarch-auditbugpriority:p2
  SocketDev/socket-patch#592 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Yarn classic: a patch that adds a dependency to the package's own package.json leaves vendored yarn.lock with a dangling dependency (offline frozen install fails, lock churns), and hosted silently installs without it

  agent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#591 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#590 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#588 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH

  agent:triagedbugbughuntpm:composerpriority:p2
  SocketDev/socket-patch#586 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted NuGet splices the Socket source (and mapping) into a commented-out &lt;packageSources&gt; / &lt;packageSourceMapping&gt; block, so every restore fails NU1100 while scan reports success and its in-run VEX attests not_affected

  agent:triagedbugbughuntpm:nugetpriority:p3
  SocketDev/socket-patch#585 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Vendored Maven reactor vex attests not_affected after a module added later declares the base version, although vendor --check flags the drift and that module builds Central's unpatched jar

  agent:triagedbugbughuntpm:mavenpriority:p3
  SocketDev/socket-patch#584 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Benchmark tracking: socket-patch scan

  agent:needs-humanagent:triagedbenchpriority:p3
  SocketDev/socket-patch#580 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Perf regression: vlt/hosted wall +127% (1169ae68, #472)

  agent:triagedbenchperf-regressionpm:vltpriority:p1
  SocketDev/socket-patch#579 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Perf regression: bun/hosted wall +110% (1169ae68, #472)

  agent:triagedbenchperf-regressionpm:bunpriority:p1
  SocketDev/socket-patch#578 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Gem settings resolution skips Bundler's global config (~/.bundle/config / BUNDLE_USER_CONFIG), so a global cache_path or gemfile gets no warning or refusal and VEX attests an unpatched install

  agent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#577 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Vendored cargo scan exits 1 permanently after a vendored crate is removed or bumped, even with --prune, because the shared registry cache still holds the old version

  agent:triagedbugbughuntpm:cargopriority:p2
  SocketDev/socket-patch#573 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Patch blob and diff downloads buffer the whole response body with no size cap

  agent:claimedagent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#571 · Filter by author mikolalysenko opened on Oct 2, 2026
  5

• Vendored→hosted takeover drops the vendored ledger entry when the revert drift-keeps the artifact

  agent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#568 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted scan in a Pipenv project whose requirements.txt pins the package through an -r include rewires only Pipfile.lock, then reports success while vex and rollback refuse the contested lock it just created

  agent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#567 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Global scan (-g) ignores PDM's site-wide config, so a global project relocated in /etc/xdg/pdm/config.toml is never crawled and get -g reports "applied" while the copy PDM runs stays unpatched

  agent:triagedbugbughuntpm:pdmpriority:p1
  SocketDev/socket-patch#566 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted and vendored uv wiring ignore no-sources = true: scan and vendor report success, uv sync --locked then fails, and a plain uv sync reinstalls the unpatched wheel

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#564 · Filter by author mikolalysenko opened on Oct 2, 2026
  1