Issues

• Cargo apply on a cold or pruned registry cache now exits 0 as "lockfile-only", then the next cargo build downloads and compiles the unpatched crate (regression from #555)

  agent:triagedbugbughuntpm:cargopriority:p2
  SocketDev/socket-patch#616 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Decide: give SOCKET_FORCE per-command names so forcing a self-update doesn't also force apply and vendor

  agent:needs-humanarch-auditrefactor
  SocketDev/socket-patch#615 · Filter by author mikolalysenko opened on Oct 2, 2026

• The public-proxy per-package fallback runs 10 requests in flight, ignoring SOCKET_API_CONCURRENCY and the proxy cap of 4

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#614 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Vendored Hatch runs a hatch executable planted in the scanned project

  agent:claimedagent:triagedarch-auditbugpm:hatchpriority:p1
  SocketDev/socket-patch#613 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Vendored mode in a Pipenv project wires only Pipfile.lock and silently leaves a sibling requirements.txt unpatched, and the hosted → vendored takeover reverts that file's hosted pin to plain PyPI

  agent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#612 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• PDM PEP 582 detection misses python.use_venv = false as PDM 2.27+ writes it (a TOML string) and in the user config, so agent mode patches an activated or stray venv and leaves __pypackages__ unpatched

  agent:claimedagent:triagedbugbughuntpm:pdmpriority:p1
  SocketDev/socket-patch#609 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Poetry venv discovery expands a {project-dir} placeholder Poetry doesn't have, so agent mode misses the env, patches the global interpreter, and VEX attests not_affected

  agent:triagedbugbughuntpm:poetrypriority:p1
  SocketDev/socket-patch#608 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted uv rollback, remove and vendored takeover refuse when the patched package is declared with different specifiers in dependencies and an extra (or under different markers), although each lock entry keeps its marker

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#606 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Lock-only requirements.txt discovery sends PEP 440-equivalent pins verbatim (six==1.16 → pkg:pypi/six@1.16), so a fresh checkout reports "No patches available" while the same file with a venv is patched

  agent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#604 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Agent-mode vex still attests not_affected when a Deno .deno/<name>@<ver>_1 copy is unpatched: the #517 every-copy check never sees store peer-variant copies

  agent:claimedagent:triagedbugbughuntpm:denopriority:p1
  SocketDev/socket-patch#603 · Filter by author mikolalysenko opened on Oct 2, 2026
  2

• Agent-mode apply skips a bundled copy inside another vlt/pnpm store entry whenever the package is also installed normally, and VEX attests not_affected

  agent:claimedagent:triagedbugbughuntpm:vltpriority:p1
  SocketDev/socket-patch#601 · Filter by author mikolalysenko opened on Oct 2, 2026
  2

• With Bun's isolated linker, vex refuses every hosted patch as not_applied after the usual in-place bun install, because it checks orphaned node_modules/.bun registry entries that Bun never removes (regression from #496)

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#599 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Tracking: scope project-mode cache crawls to what the project resolves

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#595 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Read and splice nuget.config through formats::nuget in hosted, vendored and restore

  agent:triagedarch-auditpm:nugetpriority:p3refactor
  SocketDev/socket-patch#594 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted NuGet rewrites packages.lock.json entries at other versions of the patched id

  agent:triagedarch-auditbugpm:nugetpriority:p3
  SocketDev/socket-patch#593 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• NuGet and Cargo crawlers hang on a FIFO at obj/project.assets.json or vendor/<crate>/Cargo.toml

  agent:claimedagent:triagedarch-auditbugpriority:p2
  SocketDev/socket-patch#592 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Yarn classic: a patch that adds a dependency to the package's own package.json leaves vendored yarn.lock with a dangling dependency (offline frozen install fails, lock churns), and hosted silently installs without it

  agent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#591 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted scan/get run from a pnpm workspace member (or with lockfile-dir=..) ignores the parent pnpm-lock.yaml and reports success while pinning nothing

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#590 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• npm vendored vex and vendor --check pass while a second registry copy of the patched package@version in the same package-lock.json stays unwired and installs unpatched

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#588 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Composer global-home fallback checks ~/.composer before the XDG home, so scan -g finds no Composer 2 global packages when a stale ~/.composer exists and composer isn't on PATH

  agent:triagedbugbughuntpm:composerpriority:p2
  SocketDev/socket-patch#586 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted NuGet splices the Socket source (and mapping) into a commented-out &lt;packageSources&gt; / &lt;packageSourceMapping&gt; block, so every restore fails NU1100 while scan reports success and its in-run VEX attests not_affected

  agent:triagedbugbughuntpm:nugetpriority:p3
  SocketDev/socket-patch#585 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Vendored Maven reactor vex attests not_affected after a module added later declares the base version, although vendor --check flags the drift and that module builds Central's unpatched jar

  agent:triagedbugbughuntpm:mavenpriority:p3
  SocketDev/socket-patch#584 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Benchmark tracking: socket-patch scan

  agent:needs-humanagent:triagedbenchpriority:p3
  SocketDev/socket-patch#580 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Perf regression: vlt/hosted wall +127% (1169ae68, #472)

  agent:triagedbenchperf-regressionpm:vltpriority:p1
  SocketDev/socket-patch#579 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Perf regression: bun/hosted wall +110% (1169ae68, #472)

  agent:triagedbenchperf-regressionpm:bunpriority:p1
  SocketDev/socket-patch#578 · Filter by author mikolalysenko opened on Oct 2, 2026
  1