Issues

• Move ecosystem_dispatch's purl locator out of the CLI into core as crawlers::locate

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#895 · Filter by author mikolalysenko opened on Oct 5, 2026

• Tracking: move the patch engines out of the CLI command modules into core

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#894 · Filter by author mikolalysenko opened on Oct 5, 2026

• repair and scan --prune delete the beforeHash blobs of active patches, so a later offline rollback fails and tells the user to run repair

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#893 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Vendored dry run gives no symlink warning for uv script locks or pylock files: a symlinked s.py, s.py.lock, pylock.toml or pylock.<name>.toml previews clean, and the real run then refuses (exit 1)

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#891 · Filter by author mikolalysenko opened on Oct 5, 2026
  3

• Vendored uv script locks: once the user deletes one wired script (or its .py.lock), vendor --revert, remove, rollback and the hosted takeover can never unwind the other scripts, and the takeover's suggested fix is the command that fails

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#890 · Filter by author mikolalysenko opened on Oct 5, 2026
  4

• Vendored mode still writes and deletes through a symlinked .socket dir: the #664 guard checks .socket/vendor and below only, so rollback in one yarn berry project wipes another project's vendored tarball and ledger

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#887 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Hosted scan/get run from a yarn classic workspace member still reports success while pinning nothing: the #598 governing-root refusal covers pnpm and cargo only

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#884 · Filter by author mikolalysenko opened on Oct 5, 2026
  6

• Move canonicalize_pypi_name and the PEP 508 name scanner out of crawlers and vendor into one PyPI name module

  agent:triagedarch-auditpm:pippriority:p1refactor
  SocketDev/socket-patch#883 · Filter by author mikolalysenko opened on Oct 5, 2026

• Hosted Maven splices the API's suffixed version into pom.xml unchecked, while hosted Gradle refuses the same grant

  agent:triagedarch-auditbugpm:mavenpriority:p3
  SocketDev/socket-patch#882 · Filter by author mikolalysenko opened on Oct 5, 2026

• Vendored scan from a pnpm 11/12 workspace member with its own lock writes the override into a nested member pnpm-workspace.yaml that pnpm ignores, so the root frozen install fails and a plain pnpm install silently reinstalls the unpatched package

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#881 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• Hosted scan from a pnpm 11/12 workspace member with its own lock writes trustLockfile into a nested member pnpm-workspace.yaml that pnpm ignores, so the root install fails with ERR_PNPM_TARBALL_URL_MISMATCH

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#880 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• Vendored npm vex and vendor --check fail after any npm 7–10 npm install on a lockfileVersion 2 lock, because npm drops resolved from the legacy mirror and #813 treats that as an unpatched npm 6 install (regression)

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#879 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Registry downloads give up after 60 s even while the body is still arriving

  agent:claimedagent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#872 · Filter by author mikolalysenko opened on Oct 5, 2026
  3

• Move the vendoring-service client out of api/client.rs into its own submodule

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#871 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Vendored uv script lock: after the user changes the vendored package's specifier in the PEP 723 block, vendor --revert / remove / rollback write the stale ==1.16.0 back into <script>.py.lock, so uv run --locked fails (exit 0)

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#869 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• Vendored requirements.txt: vendor --revert / remove delete the vendored wheel while a -r include still points at it (exit 0), so every later pip install -r requirements.txt fails

  agent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#867 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• With {data-dir} in Poetry's virtualenvs.path, agent mode also patches an unrelated activated VIRTUAL_ENV / conda env, even though poetry env use pins the project's env, and hosted VEX then refuses a correctly installed patch

  agent:triagedbugbughuntpm:poetrypriority:p1
  SocketDev/socket-patch#866 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Hosted cargo re-pin to a superseding patch leaves the old uuid's [registries.socket-patch-*] block in .cargo/config, and remove never deletes it

  agent:triagedbugbughuntpm:cargopriority:p2
  SocketDev/socket-patch#864 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Hosted cargo remove writes a duplicate cfg-if block into Cargo.lock when crates.io also locks the same crate@version, so cargo can no longer parse the lock while remove reports success

  agent:triagedbugbughuntpm:cargopriority:p2
  SocketDev/socket-patch#863 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Agent-mode rollback and remove delete empty directories the package shipped when a patch added a file under them (regression from #846)

  agent:triagedbugbughuntpm:vltpriority:p1
  SocketDev/socket-patch#862 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Vendored re-run on an isolated-linker bun.lockb writes two package records with the same local tarball, so frozen installs on Bun 1.3.9/1.4.2 fail intermittently with EEXIST

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#861 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• Agent mode misses transitive packages in Yarn's pnpm-linker store when pnpmStoreFolder moves it out of node_modules: skipped as package_not_installed, or refused as "first-party source"

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#859 · Filter by author mikolalysenko opened on Oct 5, 2026
  2

• Vendored yarn classic drops the git-skip warning when the git block is the only copy, and refuses with vendor_lock_entry_not_found telling the user to run yarn install

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#857 · Filter by author mikolalysenko opened on Oct 5, 2026
  3

• Resolve VEX npm alias copies through the core resolver and delete vex_consumed's second alias walk

  agent:triagedarch-auditpm:npmpriority:p1refactor
  SocketDev/socket-patch#856 · Filter by author mikolalysenko opened on Oct 5, 2026
  1

• Tracking: move vex_consumed's per-ecosystem consumed-copy rules from the CLI into core

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#855 · Filter by author mikolalysenko opened on Oct 5, 2026
  1