Issues

• Human-output scan --mode agent / --sync still never re-applies an already-recorded patch after a reinstall (#454 fixed only the --json path)

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#732 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Hosted gem stale-install warning calls the project's own vendor/bundle a "shared gem home" when --cwd is left at its default (or relative), so it gives the wrong remedy and drops the committed cache archive from the delete list

  agent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#729 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Give utils::fs one stage-and-rename core instead of six writers and a blocking copy

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#728 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Read env toggles, non-empty env vars and the home directory through one utils::env module

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#727 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• get writes a patch view's blobs under their claimed hash without checking the content, overwriting already-verified blobs in place

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#726 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• vendor --check says "committed artifact and wiring verified" (exit 0) after pipenv lock drops the vendored reference, so a fresh pipenv install --deploy installs the unpatched wheel while vex says vendor_unwired

  agent:claimedagent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#725 · Filter by author mikolalysenko opened on Oct 3, 2026
  3

• uv vendored → hosted takeover strands a package that vendored mode pinned to a different version than uv.lock: the wet run reverts to the unpatched release (exit 1), while --dry-run previews a clean takeover

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#723 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted and lock-only scans treat a UTF-16 requirements.txt (what Windows PowerShell's pip freeze > writes) as absent: exit 0, no warning, and pip keeps installing the unpatched pin

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#721 · Filter by author mikolalysenko opened on Oct 3, 2026
  3

• Bun lockfile-only checkouts can't see hosted pins: hosted re-runs never pick up a superseding patch and scan --mode vendored skips the takeover, both reporting success with 0 packages

  agent:claimedagent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#720 · Filter by author mikolalysenko opened on Oct 3, 2026
  3

• Yarn berry vendored and hosted pins copy the registry entry's bin: paths, but yarn re-reads them from the tarball (./dist/bin/uuid), so vendored installs and hardened hosted installs fail YN0028 for packages like uuid and acorn

  agent:claimedagent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#718 · Filter by author mikolalysenko opened on Oct 3, 2026
  4

• Locate hosted Maven pom edits and their upstream restore through the formats::maven element scanner

  agent:triagedarch-auditpm:mavenpriority:p3refactor
  SocketDev/socket-patch#717 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Vendored Maven refuses a single-module EAR pom as a multi-module aggregator because two declares_modules disagree

  agent:triagedarch-auditbugpm:mavenpriority:p3
  SocketDev/socket-patch#716 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Tracking: read and edit pom.xml through one element scanner in formats::maven

  agent:triagedarch-auditpm:mavenpriority:p3refactor
  SocketDev/socket-patch#715 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted scan on a Rush repo with subspaces never emits redirect_rush_repo_state_stale, so rush install fails on the shrinkwrap hash check with no warning

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#714 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted scan on a Rush repo with pnpm 11/12 reports success, but rush install then fails with ERR_PNPM_TARBALL_URL_MISMATCH, or (pnpm 11.0.0) silently installs the upstream package

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#713 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted npm scan pins a package that npm 12's native patchedDependencies also patches, so every later npm ci / npm install fails EPATCHFAILED (and vendored refuses the lockfileVersion 4 lock with wrong advice)

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#711 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted gem VEX attests not_affected for an unpatched install when .bundle/config sets an out-of-tree path (absolute or ~/…), because the skipped bundle root counts as "nothing installed"

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#709 · Filter by author mikolalysenko opened on Oct 3, 2026
  4

• Agent-mode apply and rollback reject a manifest hash in uppercase hex that blob download accepts as valid

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#707 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Compute sha256, sha1 and sha512-SRI digests through utils::digest instead of inline copies

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#706 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Validate patch UUIDs through one utils::uuid grammar instead of five

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#705 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Decide: one shape for the --json top-level error (scan and get emit both a string and a {code, message} object)

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#704 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Hosted uv scan silently wires a platform-specific patched wheel (cp311 manylinux) into a universal uv.lock, so uv sync --locked fails on every other Python version, macOS and Windows, and rollback then refuses

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#701 · Filter by author mikolalysenko opened on Oct 3, 2026
  1

• Vendored → hosted takeover strands a requirements.txt pin that lives in a -r include or a vendored "(transitive)" line: the wet run reverts it to the unpatched release, while --dry-run previews a clean takeover

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#699 · Filter by author mikolalysenko opened on Oct 3, 2026
  3

• Yarn berry vendored and hosted pins put checksum: out of yarn's field order on platform-conditional lock entries (conditions: os=…), so every yarn install --immutable fails YN0028

  agent:claimedagent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#697 · Filter by author mikolalysenko opened on Oct 3, 2026
  5

• Hosted pnpm vex attests not_affected over an unpatched install when pnpm's modulesDir is set (pnpm 10.12+), because the missed install is treated as "nothing installed"

  agent:claimedagent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#696 · Filter by author mikolalysenko opened on Oct 3, 2026
  4