Issues

Slow scan: pdm hosted 2.7x median ms/pkg (toml_edit parse of pdm.lock 14x: rewrite_batch + VEX extract)

SocketDev/socket-patch#1624 · opened

on Oct 17, 2026

1

Vendored `vendor --revert` / `remove` of a two-package `pip lock` pylock.toml writes an invalid lock: the first package's `[packages.wheels.hashes]` table moves under the next package, pip refuses the file, and the CLI exits 0

SocketDev/socket-patch#1623 · opened

on Oct 17, 2026

3

`socket-patch --update` on a Bun-installed copy says "managed by npm" and gives an npm command: `npm update -g` leaves a `bun add -g` install stale, and `npm install …@latest` in a Bun project breaks `bun install --frozen-lockfile`

SocketDev/socket-patch#1621 · opened

on Oct 17, 2026

3

Hosted pnpm 12.0–12.12 rollback drops the scoped-registry `tarball:` URL pnpm recorded, so the restored lock isn't byte-exact

SocketDev/socket-patch#1619 · opened

on Oct 17, 2026

1

Hosted and vendored npm scans refuse to patch the project's own bundleDependencies (`inBundle: true` on root deps) as "bundled inside its parent's tarball", although npm installs those entries from the lock

SocketDev/socket-patch#1618 · opened

on Oct 17, 2026

1

Hosted and vendored Pipenv refuse a patch whenever another Pipfile.lock category pins a different release of the package, so the category that pins the patched release stays unpatched

SocketDev/socket-patch#1616 · opened

on Oct 16, 2026

3

Vendored Poetry patches can't be reverted after a `poetry lock` from another Poetry major (1.8 ⇄ 2.x): `vendor --revert` drift-keeps every package with exit 0, and the "re-vendor" remedy is a no-op

SocketDev/socket-patch#1615 · opened

on Oct 16, 2026

3

Hosted rollback / remove of a `uv pip compile --no-build` / `--only-binary` / `--no-binary` pylock.toml re-adds the artifacts uv filtered out (uv 0.9.16+), so the restore isn't the original lock

SocketDev/socket-patch#1613 · opened

on Oct 16, 2026

5

Yarn berry reads the wrong `nodeLinker` when a `${VAR}` in `.yarnrc.yml` is set from `.env.yarn`: vendored falsely refuses a node-modules project, and agent misses a live PnP project

SocketDev/socket-patch#1611 · opened

on Oct 16, 2026

2

Vendored `rollback` and `remove` leave an unledgered `.socket/vendor/npm/<uuid>/` artifact dir behind (e.g. the losing side of a merge), while `vendor --revert` sweeps it, and nothing afterwards reports it

SocketDev/socket-patch#1610 · opened

on Oct 16, 2026

1

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

SocketDev/socket-patch#1608 · opened

on Oct 16, 2026

1

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

SocketDev/socket-patch#1607 · opened

on Oct 16, 2026

1

Perf regression: bun-isolated/rescan wall +21% (cc938aa6..17793173; #1279 candidate)

SocketDev/socket-patch#1606 · opened

on Oct 16, 2026

1

Hosted uv rollback / remove ignore `exclude-newer-package`: on uv 0.12+ the restored uv.lock gains an sdist the per-package cutoff had excluded, so the restore isn't the original lock

SocketDev/socket-patch#1604 · opened

on Oct 16, 2026

5

Hosted and vendored uv scans wire a patched wheel into a project that sets `no-binary` / `no-binary-package` for that package, so every later `uv sync` fails ("marked as `--no-binary` but is itself a binary distribution")

SocketDev/socket-patch#1603 · opened

on Oct 16, 2026

2

A requirements.txt pin spelled `===X`, `==X.0` or `==vX` doesn't contest another lock's Socket wiring of release X, so `vex` attests not_affected while `pip install -r` installs the upstream release (#1549 residual)

SocketDev/socket-patch#1602 · opened

on Oct 16, 2026

1

Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported

SocketDev/socket-patch#1601 · opened

on Oct 16, 2026

2

Bun `vendor --check` says "wiring missing … re-run `socket-patch vendor`" when a git, folder or URL/`file:` tarball copy of the vendored package stays unpatched, though bun.lock still references the artifact and the remedy loops

SocketDev/socket-patch#1600 · opened

on Oct 16, 2026

1

Yarn berry treats a `portal:`/`link:`/`file:` copy whose package.json has an empty or invalid `name` ("" or "../x") as a different package, so scans succeed and VEX attests not_affected while that copy installs unpatched (#1579 follow-up)

SocketDev/socket-patch#1598 · opened

on Oct 16, 2026

3

Vendored pnpm 10.34.2+ / 11 / 12 scan breaks build approvals (`allowBuilds` / `onlyBuiltDependencies`): the patched package's install script stops running, and on pnpm 11/12 every frozen install fails with ERR_PNPM_IGNORED_BUILDS

SocketDev/socket-patch#1597 · opened

on Oct 16, 2026

2

Hosted and vendored npm scans break npm 12 `allowScripts` pins (`pkg@x.y.z`), so approved install scripts are silently blocked (or every `npm ci` fails under strict-allow-scripts)

SocketDev/socket-patch#1595 · opened

on Oct 16, 2026

2

Gem vendored `remove` / `rollback` / `vendor --revert` after a hosted→vendored takeover leave the patched `.gem` in `vendor/cache` with no warning, so fresh installs of the restored upstream lock keep installing patched bytes

SocketDev/socket-patch#1594 · opened

on Oct 15, 2026

VEX product purl from pyproject.toml keeps the raw version (pkg:pypi/my-service@1.0.0-RC1) instead of the PEP 440-normalized one that uv.lock, the wheel and SBOMs use (1.0.0rc1)

SocketDev/socket-patch#1589 · opened

on Oct 15, 2026

1

CI: pinned actions still target deprecated Node.js 20

SocketDev/socket-patch#1588 · opened

on Oct 15, 2026

2

A requirements.txt wheel path without a leading `./` (`wheels/six-1.16.0-…whl`) doesn't contest another lock's Socket wiring, so `vex` still attests not_affected while `pip install -r` installs the upstream wheel (#1549 residual)

SocketDev/socket-patch#1587 · opened

on Oct 15, 2026

2

Navigation Menu

Repository navigation

Issues

Slow scan: pdm hosted 2.7x median ms/pkg (toml_edit parse of pdm.lock 14x: rewrite_batch + VEX extract)

Vendored `vendor --revert` / `remove` of a two-package `pip lock` pylock.toml writes an invalid lock: the first package's `[packages.wheels.hashes]` table moves under the next package, pip refuses the file, and the CLI exits 0

`socket-patch --update` on a Bun-installed copy says "managed by npm" and gives an npm command: `npm update -g` leaves a `bun add -g` install stale, and `npm install …@latest` in a Bun project breaks `bun install --frozen-lockfile`

Hosted pnpm 12.0–12.12 rollback drops the scoped-registry `tarball:` URL pnpm recorded, so the restored lock isn't byte-exact

Hosted and vendored npm scans refuse to patch the project's own bundleDependencies (`inBundle: true` on root deps) as "bundled inside its parent's tarball", although npm installs those entries from the lock

Hosted and vendored Pipenv refuse a patch whenever another Pipfile.lock category pins a different release of the package, so the category that pins the patched release stays unpatched

Vendored Poetry patches can't be reverted after a `poetry lock` from another Poetry major (1.8 ⇄ 2.x): `vendor --revert` drift-keeps every package with exit 0, and the "re-vendor" remedy is a no-op

Hosted rollback / remove of a `uv pip compile --no-build` / `--only-binary` / `--no-binary` pylock.toml re-adds the artifacts uv filtered out (uv 0.9.16+), so the restore isn't the original lock

Yarn berry reads the wrong `nodeLinker` when a `${VAR}` in `.yarnrc.yml` is set from `.env.yarn`: vendored falsely refuses a node-modules project, and agent misses a live PnP project

Vendored `rollback` and `remove` leave an unledgered `.socket/vendor/npm/<uuid>/` artifact dir behind (e.g. the losing side of a merge), while `vendor --revert` sweeps it, and nothing afterwards reports it

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

Perf regression: bun-isolated/rescan wall +21% (cc938aa6..17793173; #1279 candidate)

Hosted uv rollback / remove ignore `exclude-newer-package`: on uv 0.12+ the restored uv.lock gains an sdist the per-package cutoff had excluded, so the restore isn't the original lock

Hosted and vendored uv scans wire a patched wheel into a project that sets `no-binary` / `no-binary-package` for that package, so every later `uv sync` fails ("marked as `--no-binary` but is itself a binary distribution")

A requirements.txt pin spelled `===X`, `==X.0` or `==vX` doesn't contest another lock's Socket wiring of release X, so `vex` attests not_affected while `pip install -r` installs the upstream release (#1549 residual)

Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported

Bun `vendor --check` says "wiring missing … re-run `socket-patch vendor`" when a git, folder or URL/`file:` tarball copy of the vendored package stays unpatched, though bun.lock still references the artifact and the remedy loops

Yarn berry treats a `portal:`/`link:`/`file:` copy whose package.json has an empty or invalid `name` ("" or "../x") as a different package, so scans succeed and VEX attests not_affected while that copy installs unpatched (#1579 follow-up)

Vendored pnpm 10.34.2+ / 11 / 12 scan breaks build approvals (`allowBuilds` / `onlyBuiltDependencies`): the patched package's install script stops running, and on pnpm 11/12 every frozen install fails with ERR_PNPM_IGNORED_BUILDS

Hosted and vendored npm scans break npm 12 `allowScripts` pins (`pkg@x.y.z`), so approved install scripts are silently blocked (or every `npm ci` fails under strict-allow-scripts)

Gem vendored `remove` / `rollback` / `vendor --revert` after a hosted→vendored takeover leave the patched `.gem` in `vendor/cache` with no warning, so fresh installs of the restored upstream lock keep installing patched bytes

VEX product purl from pyproject.toml keeps the raw version (pkg:pypi/my-service@1.0.0-RC1) instead of the PEP 440-normalized one that uv.lock, the wheel and SBOMs use (1.0.0rc1)

CI: pinned actions still target deprecated Node.js 20

A requirements.txt wheel path without a leading `./` (`wheels/six-1.16.0-…whl`) doesn't contest another lock's Socket wiring, so `vex` still attests not_affected while `pip install -r` installs the upstream wheel (#1549 residual)