Issues

Hosted and vendored scans from a nested directory under a vlt.json root that is not a workspace member write its stray vlt-lock.json and exit 0, though vlt installs from the root there; VEX then attests not_affected (also vlt 1.3.8 pnpm-workspace.yaml dirs, contrary to #1574's premise)

SocketDev/socket-patch#1584 · opened

on Oct 15, 2026

repair leaves a pre-#1541 root `<uuid>/.gitattributes` as `* -text`, so the repaired Bun tarball goes back into Git LFS on the next commit

SocketDev/socket-patch#1581 · opened

on Oct 15, 2026

Yarn berry still drops a `portal:` copy whose target has no package.json (e.g. a `.gitkeep` placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched

SocketDev/socket-patch#1579 · opened

on Oct 15, 2026

1

Hosted yarn classic refuses a patch that doesn't change dependencies when the registry metadata's ranges differ from the tarball's package.json (redirect_yarn_classic_dep_manifest_unlocked)

SocketDev/socket-patch#1578 · opened

on Oct 15, 2026

1

Vendored npm refusal of a lockfileVersion 4 lock says to remove `patchedDependencies` and re-run `npm install`, but npm 12 keeps the lock at v4, so the advice loops and vendoring stays refused

SocketDev/socket-patch#1576 · opened

on Oct 15, 2026

1

VEX gemspec product detection reads commented-out `# spec.name =` / `# spec.version =` lines, so the document names the wrong product or version

SocketDev/socket-patch#1573 · opened

on Oct 15, 2026

3

Vendored PyPI wheels aren't checked against .gitignore or Git LFS rules (`*.whl`, `.socket/`), so a vendored Pipenv scan exits 0 and every fresh clone's `pipenv sync` fails

SocketDev/socket-patch#1572 · opened

on Oct 15, 2026

1

Slow scan: vlt hosted 2.6x median ms/pkg (vlt::partition_instances / split_dep_id per patch)

SocketDev/socket-patch#1570 · opened

on Oct 15, 2026

1

Hosted uv scan gives no uv < 0.5.6 advisory for transitive overrides or repointed constraints, so on uv ≤ 0.5.4 a plain `uv sync` silently reinstalls the unpatched wheel after a clean exit 0

SocketDev/socket-patch#1569 · opened

on Oct 15, 2026

1

Vendored requirements.txt rewrite re-joins every line of a mixed CRLF/LF file with one terminator, so untouched lines change and `vendor --revert` / `remove` can't restore the file

SocketDev/socket-patch#1567 · opened

on Oct 15, 2026

1

Lock-only yarn classic VEX wrongly omits a correctly pinned patch with dependency_not_installed when the patched package.json has a "" range or a dependency yarn de-duplicates (regression from #1548)

SocketDev/socket-patch#1558 · opened

on Oct 15, 2026

1

Root `scan --mode vendored` still exits 1 forever and drops its in-run VEX when a nested npm project has no lockfile (`package-lock=false`); the #1534 fix only covers nested projects with their own lock

SocketDev/socket-patch#1554 · opened

on Oct 15, 2026

1

CI perf (settings): slow Depot 16-core hosts since 10-13 15:20 add ~1.5–2.5 min to the merge-queue critical path (~0.6k Linux job-min/day)

SocketDev/socket-patch#1512 · opened

on Oct 14, 2026

4

Slow scan: poetry hosted 2.6x median ms/pkg (lock_fragments::rewrite_batch + VEX lock re-parse)

SocketDev/socket-patch#1473 · opened

on Oct 13, 2026

9

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

SocketDev/socket-patch#1472 · opened

on Oct 13, 2026

1

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

SocketDev/socket-patch#1425 · opened

on Oct 12, 2026

2

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

SocketDev/socket-patch#1424 · opened

on Oct 12, 2026

1

Swarm health manager log

SocketDev/socket-patch#1382 · opened

on Oct 11, 2026

3

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

SocketDev/socket-patch#1352 · opened

on Oct 9, 2026

2

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

SocketDev/socket-patch#1268 · opened

on Oct 9, 2026

2

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

SocketDev/socket-patch#1248 · opened

on Oct 9, 2026

8

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

SocketDev/socket-patch#1246 · opened

on Oct 9, 2026

2

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

SocketDev/socket-patch#1235 · opened

on Oct 9, 2026

2

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

SocketDev/socket-patch#1200 · opened

on Oct 9, 2026

1

CI performance dashboard

SocketDev/socket-patch#1182 · opened

on Oct 8, 2026

1

Navigation Menu

Repository navigation

Issues

Hosted and vendored scans from a nested directory under a vlt.json root that is not a workspace member write its stray vlt-lock.json and exit 0, though vlt installs from the root there; VEX then attests not_affected (also vlt 1.3.8 pnpm-workspace.yaml dirs, contrary to #1574's premise)

repair leaves a pre-#1541 root `<uuid>/.gitattributes` as `* -text`, so the repaired Bun tarball goes back into Git LFS on the next commit

Yarn berry still drops a `portal:` copy whose target has no package.json (e.g. a `.gitkeep` placeholder) or whose package.json lacks name/version, so scans succeed and VEX attests not_affected while that copy installs unpatched

Hosted yarn classic refuses a patch that doesn't change dependencies when the registry metadata's ranges differ from the tarball's package.json (redirect_yarn_classic_dep_manifest_unlocked)

Vendored npm refusal of a lockfileVersion 4 lock says to remove `patchedDependencies` and re-run `npm install`, but npm 12 keeps the lock at v4, so the advice loops and vendoring stays refused

VEX gemspec product detection reads commented-out `# spec.name =` / `# spec.version =` lines, so the document names the wrong product or version

Vendored PyPI wheels aren't checked against .gitignore or Git LFS rules (`*.whl`, `.socket/`), so a vendored Pipenv scan exits 0 and every fresh clone's `pipenv sync` fails

Slow scan: vlt hosted 2.6x median ms/pkg (vlt::partition_instances / split_dep_id per patch)

Hosted uv scan gives no uv < 0.5.6 advisory for transitive overrides or repointed constraints, so on uv ≤ 0.5.4 a plain `uv sync` silently reinstalls the unpatched wheel after a clean exit 0

Vendored requirements.txt rewrite re-joins every line of a mixed CRLF/LF file with one terminator, so untouched lines change and `vendor --revert` / `remove` can't restore the file

Lock-only yarn classic VEX wrongly omits a correctly pinned patch with dependency_not_installed when the patched package.json has a "" range or a dependency yarn de-duplicates (regression from #1548)

Root `scan --mode vendored` still exits 1 forever and drops its in-run VEX when a nested npm project has no lockfile (`package-lock=false`); the #1534 fix only covers nested projects with their own lock

CI perf (settings): slow Depot 16-core hosts since 10-13 15:20 add ~1.5–2.5 min to the merge-queue critical path (~0.6k Linux job-min/day)

Slow scan: poetry hosted 2.6x median ms/pkg (lock_fragments::rewrite_batch + VEX lock re-parse)

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

Swarm health manager log

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

CI performance dashboard