Issues

• Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched

  bugbughuntpm:pipenv
  SocketDev/socket-patch#790 · Filter by author mikolalysenko opened on Oct 4, 2026

• Hosted uv rollback, remove and vendored takeover always refuse locks written by uv 0.6.15–0.6.17, which spell the artifact field upload_time instead of upload-time

  agent:claimedagent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#788 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Vendored requirements.txt after the user removes or bumps a vendored pin: the rescan re-adds the removed package as a "(transitive)" line (exit 0), or exits 1 forever after a bump, and scan --prune never reverts the entry

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#786 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• After Bun migrates a vendored bun.lockb to bun.lock (bun install --save-text-lockfile), vendor --revert and rollback fail, and a superseding re-vendor drops the pre-vendor original so revert exits 0 with the project still vendored

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#784 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Vendored yarn berry misses a parent-scoped user resolutions entry (pkg-a/left-pad), reports success, and every yarn install --immutable fails YN0028

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#783 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Delete the vendored and hosted-vlt helpers left without a production caller by the v5 consolidation

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#782 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Read the go.mod module directive through go_mod_edit and delete the crawler's unused parse_go_mod_module

  agent:triagedarch-auditpm:gopriority:p2refactor
  SocketDev/socket-patch#781 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Read Gemfile.lock sections and DEPENDENCIES entries through formats::gem in hosted and vendored modes

  agent:triagedarch-auditpm:bundlerpriority:p1refactor
  SocketDev/socket-patch#780 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Vendored gem refuses a gem whose spec is not in the lock's first GEM section

  agent:triagedarch-auditbugpm:bundlerpriority:p1
  SocketDev/socket-patch#779 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• Agent-mode scan packages/<member> finds nothing in a pnpm workspace (exit 0), while rollback packages/<member> selects the same packages

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#778 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Gem hosted → vendored takeover un-hosts a gem declared inside a group block and then refuses to vendor it (gemfile_declaration_not_editable), so the project silently goes back to unpatched

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#775 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• --ecosystems rejects NPM and npm, pypi, which socket.yml patches.ecosystems accepts: the ecosystem name parser is written three times

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#773 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Share one pnpm/vlt store-copy fan-out between agent apply and rollback, folding each copy's per-file records

  agent:claimedagent:triagedarch-auditpm:pnpmpriority:p1refactor
  SocketDev/socket-patch#772 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Tracking: one agent-mode patch engine for apply and rollback

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#771 · Filter by author mikolalysenko opened on Oct 4, 2026

• Send telemetry through one Telemetry handle with a shared HTTP client instead of 19 track wrappers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#770 · Filter by author mikolalysenko opened on Oct 4, 2026

• Vendored Pipenv never picks up a superseding patch: re-vendor to a new uuid fails with pypi_pipenv_source_already_exists (lock-only) or a false package_not_installed (venv present), exit 1

  agent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#769 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• uv projects that declare the patched package as a PEP 508 direct URL (six @ https://… / git+…): vendored writes a lock uv sync --locked rejects while vex attests, and hosted overrides the user's URL then refuses to roll it back

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#767 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• Vendored requirements.txt never picks up a superseding patch: the re-vendor to a new uuid fails with pypi_requirements_already_vendored (exit 1), though --dry-run previews would_revendor and the contract says it re-vendors automatically

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#765 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• After a Bun rollback or vendor --revert, the advised bun install keeps the patched bytes installed on the hoisted linker (Bun reports "no changes")

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#764 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• Slow scan: pdm hosted 3.6x median ms/pkg (per-patch pdm.lock re-parse)

  agent:triagedbenchenhancementpm:pdmpriority:p1
  SocketDev/socket-patch#762 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Slow scan: cargo hosted 3.8x median ms/pkg (per-patch Cargo.lock re-parse)

  agent:triagedbenchenhancementpm:cargopriority:p2
  SocketDev/socket-patch#761 · Filter by author mikolalysenko opened on Oct 4, 2026

• Slow scan: poetry hosted 4.5x median ms/pkg (per-patch poetry.lock re-parse)

  agent:triagedbenchenhancementpm:poetrypriority:p1
  SocketDev/socket-patch#760 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Vendored yarn berry revert restores the pre-vendor lock entry verbatim, so after upgrading from yarn 4.0.x it writes back a bare-hex checksum and every yarn install --immutable fails YN0028

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#759 · Filter by author mikolalysenko opened on Oct 4, 2026

• Yarn classic VEX attests not_affected while a bundled copy of the patched package@version stays unpatched (yarn.lock has no inBundle, so the #325 fix can't see it)

  agent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#758 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Hosted cargo redirect refuses a dependency whose inline table has a multi-line features array, because it plans Cargo.toml pins with a line scanner

  agent:triagedarch-auditbugpm:cargopriority:p2
  SocketDev/socket-patch#757 · Filter by author mikolalysenko opened on Oct 4, 2026