Issues

Depot runners lost mid-job evicted 2 merge-queue entries in 27h

SocketDev/socket-patch#1660 · opened

on Oct 21, 2026

1

Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry)

SocketDev/socket-patch#1650 · opened

on Oct 21, 2026

1

CI perf: floating toolchain versions in ci.yml e2e — upstream uv 0.13.2 red-mained the merge queue for 2.7 h (~4.3k job-min wasted on 10-20; ~0.45k min/day amortized)

SocketDev/socket-patch#1645 · opened

on Oct 20, 2026

2

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

SocketDev/socket-patch#1638 · opened

on Oct 18, 2026

4

Hosted and vendored scans refuse an independent Bun project in a dot-directory (packages/.tools) as a workspace member, though Bun's `packages/*` never lists dot-directories, so that project can't be patched at all

SocketDev/socket-patch#1631 · opened

on Oct 17, 2026

3

Yarn berry ignores an `exec:` copy of the patched package under another dependency name, so hosted and vendored scans succeed and VEX attests not_affected while that copy installs unpatched

SocketDev/socket-patch#1630 · opened

on Oct 17, 2026

3

`socket-patch --update` on a yarn-classic-installed copy says "managed by npm": `npm update -g` leaves a `yarn global add` install stale, and a yarn project is told to run `npm install`

SocketDev/socket-patch#1629 · opened

on Oct 17, 2026

1

Hosted gem `rollback` / `remove` after an unconverged superseding re-scan restore Gemfile.lock but leave the new patch's `source … do` block in the Gemfile, report success, and the next `bundle install` re-patches

SocketDev/socket-patch#1626 · opened

on Oct 17, 2026

1

Slow scan: pdm hosted 2.7x median ms/pkg (toml_edit parse of pdm.lock 14x: rewrite_batch + VEX extract)

SocketDev/socket-patch#1624 · opened

on Oct 17, 2026

1

Hosted pnpm 12.0–12.12 rollback drops the scoped-registry `tarball:` URL pnpm recorded, so the restored lock isn't byte-exact

SocketDev/socket-patch#1619 · opened

on Oct 17, 2026

2

Hosted and vendored npm scans refuse to patch the project's own bundleDependencies (`inBundle: true` on root deps) as "bundled inside its parent's tarball", although npm installs those entries from the lock

SocketDev/socket-patch#1618 · opened

on Oct 17, 2026

2

Vendored Poetry patches can't be reverted after a `poetry lock` from another Poetry major (1.8 ⇄ 2.x): `vendor --revert` drift-keeps every package with exit 0, and the "re-vendor" remedy is a no-op

SocketDev/socket-patch#1615 · opened

on Oct 16, 2026

4

Yarn berry reads the wrong `nodeLinker` when a `${VAR}` in `.yarnrc.yml` is set from `.env.yarn`: vendored falsely refuses a node-modules project, and agent misses a live PnP project

SocketDev/socket-patch#1611 · opened

on Oct 16, 2026

2

Vendored `rollback` and `remove` leave an unledgered `.socket/vendor/npm/<uuid>/` artifact dir behind (e.g. the losing side of a merge), while `vendor --revert` sweeps it, and nothing afterwards reports it

SocketDev/socket-patch#1610 · opened

on Oct 16, 2026

1

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

SocketDev/socket-patch#1608 · opened

on Oct 16, 2026

1

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

SocketDev/socket-patch#1607 · opened

on Oct 16, 2026

1

Perf regression: bun-isolated/rescan wall +21% (cc938aa6..17793173; #1279 candidate)

SocketDev/socket-patch#1606 · opened

on Oct 16, 2026

1

Hosted and vendored uv scans wire a patched wheel into a project that sets `no-binary` / `no-binary-package` for that package, so every later `uv sync` fails ("marked as `--no-binary` but is itself a binary distribution")

SocketDev/socket-patch#1603 · opened

on Oct 16, 2026

5

Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported

SocketDev/socket-patch#1601 · opened

on Oct 16, 2026

2

Bun `vendor --check` says "wiring missing … re-run `socket-patch vendor`" when a git, folder or URL/`file:` tarball copy of the vendored package stays unpatched, though bun.lock still references the artifact and the remedy loops

SocketDev/socket-patch#1600 · opened

on Oct 16, 2026

1

Vendored pnpm 10.34.2+ / 11 / 12 scan breaks build approvals (`allowBuilds` / `onlyBuiltDependencies`): the patched package's install script stops running, and on pnpm 11/12 every frozen install fails with ERR_PNPM_IGNORED_BUILDS

SocketDev/socket-patch#1597 · opened

on Oct 16, 2026

3

Hosted and vendored npm scans break npm 12 `allowScripts` pins (`pkg@x.y.z`), so approved install scripts are silently blocked (or every `npm ci` fails under strict-allow-scripts)

SocketDev/socket-patch#1595 · opened

on Oct 16, 2026

4

Gem vendored `remove` / `rollback` / `vendor --revert` after a hosted→vendored takeover leave the patched `.gem` in `vendor/cache` with no warning, so fresh installs of the restored upstream lock keep installing patched bytes

SocketDev/socket-patch#1594 · opened

on Oct 15, 2026

VEX product purl from pyproject.toml keeps the raw version (pkg:pypi/my-service@1.0.0-RC1) instead of the PEP 440-normalized one that uv.lock, the wheel and SBOMs use (1.0.0rc1)

SocketDev/socket-patch#1589 · opened

on Oct 15, 2026

3

CI: pinned actions still target deprecated Node.js 20

SocketDev/socket-patch#1588 · opened

on Oct 15, 2026

3

Navigation Menu

Repository navigation

Issues

Depot runners lost mid-job evicted 2 merge-queue entries in 27h

Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry)

CI perf: floating toolchain versions in ci.yml e2e — upstream uv 0.13.2 red-mained the merge queue for 2.7 h (~4.3k job-min wasted on 10-20; ~0.45k min/day amortized)

Vendored scan exits 0 when .gitignore covers `.socket/vendor/state.json`, so the commit silently drops the ledger and every other checkout's `rollback` fails with vendor_ledger_missing

Hosted and vendored scans refuse an independent Bun project in a dot-directory (packages/.tools) as a workspace member, though Bun's `packages/*` never lists dot-directories, so that project can't be patched at all

Yarn berry ignores an `exec:` copy of the patched package under another dependency name, so hosted and vendored scans succeed and VEX attests not_affected while that copy installs unpatched

`socket-patch --update` on a yarn-classic-installed copy says "managed by npm": `npm update -g` leaves a `yarn global add` install stale, and a yarn project is told to run `npm install`

Hosted gem `rollback` / `remove` after an unconverged superseding re-scan restore Gemfile.lock but leave the new patch's `source … do` block in the Gemfile, report success, and the next `bundle install` re-patches

Slow scan: pdm hosted 2.7x median ms/pkg (toml_edit parse of pdm.lock 14x: rewrite_batch + VEX extract)

Hosted pnpm 12.0–12.12 rollback drops the scoped-registry `tarball:` URL pnpm recorded, so the restored lock isn't byte-exact

Hosted and vendored npm scans refuse to patch the project's own bundleDependencies (`inBundle: true` on root deps) as "bundled inside its parent's tarball", although npm installs those entries from the lock

Vendored Poetry patches can't be reverted after a `poetry lock` from another Poetry major (1.8 ⇄ 2.x): `vendor --revert` drift-keeps every package with exit 0, and the "re-vendor" remedy is a no-op

Yarn berry reads the wrong `nodeLinker` when a `${VAR}` in `.yarnrc.yml` is set from `.env.yarn`: vendored falsely refuses a node-modules project, and agent misses a live PnP project

Vendored `rollback` and `remove` leave an unledgered `.socket/vendor/npm/<uuid>/` artifact dir behind (e.g. the losing side of a merge), while `vendor --revert` sweeps it, and nothing afterwards reports it

Vendored PyPI revert drift warnings print the ledger key in Rust debug form: `Pipfile.lock entry for Some("default:six") changed since vendoring`

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

Perf regression: bun-isolated/rescan wall +21% (cc938aa6..17793173; #1279 candidate)

Hosted and vendored uv scans wire a patched wheel into a project that sets `no-binary` / `no-binary-package` for that package, so every later `uv sync` fails ("marked as `--no-binary` but is itself a binary distribution")

Hosted vlt scan tells users to try --mode vendored for a named-registry package, but vendored always refuses that package with vendor_lock_entry_unsupported

Bun `vendor --check` says "wiring missing … re-run `socket-patch vendor`" when a git, folder or URL/`file:` tarball copy of the vendored package stays unpatched, though bun.lock still references the artifact and the remedy loops

Vendored pnpm 10.34.2+ / 11 / 12 scan breaks build approvals (`allowBuilds` / `onlyBuiltDependencies`): the patched package's install script stops running, and on pnpm 11/12 every frozen install fails with ERR_PNPM_IGNORED_BUILDS

Hosted and vendored npm scans break npm 12 `allowScripts` pins (`pkg@x.y.z`), so approved install scripts are silently blocked (or every `npm ci` fails under strict-allow-scripts)

Gem vendored `remove` / `rollback` / `vendor --revert` after a hosted→vendored takeover leave the patched `.gem` in `vendor/cache` with no warning, so fresh installs of the restored upstream lock keep installing patched bytes

VEX product purl from pyproject.toml keeps the raw version (pkg:pypi/my-service@1.0.0-RC1) instead of the PEP 440-normalized one that uv.lock, the wheel and SBOMs use (1.0.0rc1)

CI: pinned actions still target deprecated Node.js 20