Issues

Poetry source-pin guard lets hosted and vendored rewrite a lock-version 1.1 poetry.lock that no Poetry 2.x can install, and the advisory says 2.3+ install it

SocketDev/socket-patch#1503 · opened

on Oct 13, 2026

uv PEP 723 script in a subdirectory: hosted and vendored wiring ignore `no-sources = true` from a parent `uv.toml` / `pyproject.toml`, so `uv run --locked` fails and a plain `uv run` imports the unpatched package

SocketDev/socket-patch#1501 · opened

on Oct 13, 2026

3

Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root

SocketDev/socket-patch#1494 · opened

on Oct 13, 2026

3

Bun 1.3+ bun.lockb root is read as pre-1.3, so a "!"-excluded member can't be patched in hosted or vendored mode (regression in 5.0.1)

SocketDev/socket-patch#1492 · opened

on Oct 13, 2026

3

Slow scan: poetry hosted 2.6x median ms/pkg (lock_fragments::rewrite_batch + VEX lock re-parse)

SocketDev/socket-patch#1473 · opened

on Oct 13, 2026

8

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

SocketDev/socket-patch#1472 · opened

on Oct 13, 2026

1

v5.0.0 not published: registry trusted publishers still name release.yml

SocketDev/socket-patch#1456 · opened

on Oct 12, 2026

3

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

SocketDev/socket-patch#1425 · opened

on Oct 12, 2026

2

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

SocketDev/socket-patch#1424 · opened

on Oct 12, 2026

1

Swarm health manager log

SocketDev/socket-patch#1382 · opened

on Oct 11, 2026

2

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

SocketDev/socket-patch#1352 · opened

on Oct 9, 2026

2

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

SocketDev/socket-patch#1268 · opened

on Oct 9, 2026

2

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

SocketDev/socket-patch#1248 · opened

on Oct 9, 2026

7

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

SocketDev/socket-patch#1246 · opened

on Oct 9, 2026

2

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

SocketDev/socket-patch#1236 · opened

on Oct 9, 2026

11

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

SocketDev/socket-patch#1235 · opened

on Oct 9, 2026

2

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

SocketDev/socket-patch#1232 · opened

on Oct 9, 2026

3

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

SocketDev/socket-patch#1202 · opened

on Oct 9, 2026

5

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

SocketDev/socket-patch#1200 · opened

on Oct 9, 2026

1

CI performance dashboard

SocketDev/socket-patch#1182 · opened

on Oct 8, 2026

1

Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

SocketDev/socket-patch#1135 · opened

on Oct 8, 2026

3

Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data?

SocketDev/socket-patch#1130 · opened

on Oct 8, 2026

1

A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path

SocketDev/socket-patch#1123 · opened

on Oct 8, 2026

2

Hosted yarn classic offline-mirror refusal misses a mirror set in a workspace member's .yarnrc, so installs run from that member fail the integrity check while the scan reports success and VEX attests

SocketDev/socket-patch#1115 · opened

on Oct 8, 2026

4

Lock inventory and the vendored PyPI router disagree on which lock governs when poetry.lock or pdm.lock has no packages

SocketDev/socket-patch#1114 · opened

on Oct 8, 2026

1

Navigation Menu

Repository navigation

Issues

Poetry source-pin guard lets hosted and vendored rewrite a lock-version 1.1 poetry.lock that no Poetry 2.x can install, and the advisory says 2.3+ install it

uv PEP 723 script in a subdirectory: hosted and vendored wiring ignore `no-sources = true` from a parent `uv.toml` / `pyproject.toml`, so `uv run --locked` fails and a plain `uv run` imports the unpatched package

Agent-mode scan run from a vlt (or pnpm) workspace member fails package_not_installed for the member's npm-alias dependency, while the same alias patches from the root

Bun 1.3+ bun.lockb root is read as pre-1.3, so a "!"-excluded member can't be patched in hosted or vendored mode (regression in 5.0.1)

Slow scan: poetry hosted 2.6x median ms/pkg (lock_fragments::rewrite_batch + VEX lock re-parse)

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

v5.0.0 not published: registry trusted publishers still name release.yml

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

Swarm health manager log

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

CI performance dashboard

Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data?

A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path

Hosted yarn classic offline-mirror refusal misses a mirror set in a workspace member's .yarnrc, so installs run from that member fail the integrity check while the scan reports success and VEX attests

Lock inventory and the vendored PyPI router disagree on which lock governs when poetry.lock or pdm.lock has no packages