Issues

• Hatch never picks up a superseding patch: re-scan refuses its own earlier wiring ("existing direct source must be reverted"), so hosted exits 0 still pinned to the old patch uuid

  bugbughuntpm:hatch
  SocketDev/socket-patch#650 · Filter by author mikolalysenko opened on Oct 3, 2026

• Delete the stray actions/cache launch.json and replace the 39 dangling "DESIGN §" citations

  arch-auditrefactor
  SocketDev/socket-patch#649 · Filter by author mikolalysenko opened on Oct 3, 2026

• Decide: where patch API calls go when a token is set but the org slug can't be resolved

  agent:needs-humanarch-auditrefactor
  SocketDev/socket-patch#648 · Filter by author mikolalysenko opened on Oct 3, 2026

• Only scan, get <uuid> and vex fall back to the public proxy on 401/403; get search, apply, rollback, repair and vendor eject fail

  arch-auditbug
  SocketDev/socket-patch#647 · Filter by author mikolalysenko opened on Oct 3, 2026

• Agent mode skips ./.venv when PIPENV_VENV_IN_PROJECT=0 or PIPENV_NO_VENV_IN_PROJECT=1 is set, but Pipenv 2018 through 2023.10.24 still use that .venv, so it stays unpatched and VEX attests not_affected (regression from #388)

  bugbughuntpm:pipenv
  SocketDev/socket-patch#645 · Filter by author mikolalysenko opened on Oct 3, 2026

• VEX product detection ignores PDM 0.x's [tool.pdm] name/version, so vex and scan --vex fail with product_undetected on PDM 0.12 projects (after scan has already rewritten pdm.lock)

  agent:triagedbugbughuntpm:pdmpriority:p1
  SocketDev/socket-patch#642 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Vendored PDM < 2.11 gives no stale-install warning, so after pdm sync the unpatched release stays installed while vex attests not_affected

  agent:triagedbugbughuntpm:pdmpriority:p1
  SocketDev/socket-patch#641 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Global scan (-g) never crawls the venv that Poetry's official installer creates ($POETRY_HOME/venv), so patches for Poetry's own dependencies are never found, applied or rolled back

  agent:claimedagent:triagedbugbughuntpm:poetrypriority:p1
  SocketDev/socket-patch#640 · Filter by author mikolalysenko opened on Oct 3, 2026
  3

• Hosted uv scan wires a dynamic = ["dependencies"] project, but rollback, remove and the vendored takeover then always refuse ("pyproject.toml no longer declares six")

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#639 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted scan --json on a PyPI project with no root requirements.txt (e.g. only requirements-dev.txt or requirements/base.txt) reports success with empty skipped and warnings, though the patched package is never pinned

  agent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#638 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Vendored pnpm with two or more packages: vendor --revert and rollback leave an empty pnpm.overrides in package.json and (lockfile 9.0) a scaffolded pnpm-workspace.yaml behind

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#636 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• With Bun's globalStore (Bun ≥ 1.3.14), agent mode patches and rolls back every other project sharing the store, and vex attests unpatched transitive copies as not_affected

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#635 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Agent-mode apply in a pnpm workspace reports each member-linked package twice, inflating the --json skipped count with duplicate already_patched events

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#633 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted yarn berry pin of a catalog: dependency keys resolutions by the resolved npm: range, so every yarn install --immutable fails YN0028 (regression from #465)

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#632 · Filter by author mikolalysenko opened on Oct 3, 2026
  2

• Delete go_sum_edit's oracle-only free functions and move the go.sum codec to formats

  agent:triagedarch-auditpm:gopriority:p2refactor
  SocketDev/socket-patch#631 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Move the crawler coordinate guards and composer's leading-v rule into utils and delete the copies

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#630 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Share the yarn berry project gates between hosted and vendored modes

  agent:triagedarch-auditpm:yarn-berrypriority:p1refactor
  SocketDev/socket-patch#629 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted yarn berry rewrites a mixed-line-ending package.json that vendored mode refuses

  agent:triagedarch-auditbugpm:yarn-berrypriority:p1
  SocketDev/socket-patch#628 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Vendored yarn classic replaces a symlinked yarn.lock with a regular file (hosted refuses the same lock), leaving the link's target unpatched; rollback never restores the link

  agent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#627 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Agent-mode apply writes through node_modules links into first-party source (npm workspace members, file: deps, npm link targets), overwriting the user's code, and rollback restores upstream bytes instead

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#626 · Filter by author mikolalysenko opened on Oct 3, 2026
  2

• Hosted NuGet remove / rollback / takeover restore packages.lock.json to the nuget.org catalog packageHash, which isn't NuGet's contentHash for signed packages, so every later dotnet restore fails NU1403

  agent:triagedbugbughuntpm:nugetpriority:p3
  SocketDev/socket-patch#624 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Hosted and vendored NuGet reject a packages.lock.json with a UTF-8 BOM that dotnet restores fine: hosted skips the redirect and exits 0 success, vendored fails apply_failed

  agent:triagedbugbughuntpm:nugetpriority:p3
  SocketDev/socket-patch#623 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Vendored Maven 4 reactor with implicit subprojects (model 4.1.0, no <subprojects>) is wired as a single POM, so a warm ~/.m2 builds the unpatched jar while vex attests not_affected

  agent:triagedbugbughuntpm:mavenpriority:p3
  SocketDev/socket-patch#622 · Filter by author mikolalysenko opened on Oct 2, 2026
  1

• Vendored Gradle exits 0 when the project's .gitignore excludes *.jar, so the commit silently drops the patched jar and every fresh checkout fails to build

  agent:triagedbugbughuntpm:gradlepriority:p3
  SocketDev/socket-patch#620 · Filter by author mikolalysenko opened on Oct 2, 2026
  3

• Go apply and vendor wire in a patched module whose go.mod raises or adds a requirement without syncing the consumer go.mod/go.sum, so every default go build fails while apply, --check and VEX report success

  agent:triagedbugbughuntpm:gopriority:p2
  SocketDev/socket-patch#618 · Filter by author mikolalysenko opened on Oct 2, 2026
  1