Issues

• Hosted rollback and remove always refuse a pip lock pylock.toml ("no sibling registry package shows the registry and artifact fields"), because pip writes [[packages.wheels]] tables, not uv's inline wheels = [...]

  bugbughuntpm:pip
  SocketDev/socket-patch#804 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• After Bun 1.4 migrates a hosted workspace bun.lockb to bun.lock, bun install --frozen-lockfile fails and Bun's suggested bun install silently drops the hosted pins

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#803 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• Delete lock_inventory::wired_vendor_integrity and PnpmLock::wired_integrity, which have no production caller

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#801 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Replace the single-variant vendor PackageSource with &Path and delete the scaffolding it props up

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#800 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• npm VEX attests a patch that only npm-shrinkwrap.json wires when the package-lock.json beside it has no entry for the package, though npm 12 reads package-lock.json and installs the registry copy

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#798 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Gem crawler misses a Bundler 4 bundle install --standalone tree (./bundle), so agent apply patches the system copy and VEX attests not_affected while the app loads the unpatched standalone copy

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#796 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Mirror global flags into the environment once before dispatch, and read the lock timeout through one accessor

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#794 · Filter by author mikolalysenko opened on Oct 4, 2026

• Tracking: build one RunCtx in main and stop mirroring CLI flags into the process environment

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#793 · Filter by author mikolalysenko opened on Oct 4, 2026

• Decide: make --download-mode file the default and retire the diff download path

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#792 · Filter by author mikolalysenko opened on Oct 4, 2026

• An invalid --download-mode fails apply and repair with exit 1 but is accepted by every other command

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#791 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• Pipenv stale-install remedy always says pipenv sync, so for a [dev-packages] or named-category entry following it uninstalls the package instead of reinstalling it patched

  agent:claimedagent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#790 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Hosted uv rollback, remove and vendored takeover always refuse locks written by uv 0.6.15–0.6.17, which spell the artifact field upload_time instead of upload-time

  agent:claimedagent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#788 · Filter by author mikolalysenko opened on Oct 4, 2026
  4

• Vendored requirements.txt after the user removes or bumps a vendored pin: the rescan re-adds the removed package as a "(transitive)" line (exit 0), or exits 1 forever after a bump, and scan --prune never reverts the entry

  agent:claimedagent:triagedbugbughuntpm:pippriority:p1
  SocketDev/socket-patch#786 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• After Bun migrates a vendored bun.lockb to bun.lock (bun install --save-text-lockfile), vendor --revert and rollback fail, and a superseding re-vendor drops the pre-vendor original so revert exits 0 with the project still vendored

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#784 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Vendored yarn berry misses a parent-scoped user resolutions entry (pkg-a/left-pad), reports success, and every yarn install --immutable fails YN0028

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#783 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Delete the vendored and hosted-vlt helpers left without a production caller by the v5 consolidation

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#782 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Read the go.mod module directive through go_mod_edit and delete the crawler's unused parse_go_mod_module

  agent:triagedarch-auditpm:gopriority:p2refactor
  SocketDev/socket-patch#781 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Read Gemfile.lock sections and DEPENDENCIES entries through formats::gem in hosted and vendored modes

  agent:triagedarch-auditpm:bundlerpriority:p1refactor
  SocketDev/socket-patch#780 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Vendored gem refuses a gem whose spec is not in the lock's first GEM section

  agent:claimedagent:triagedarch-auditbugpm:bundlerpriority:p1
  SocketDev/socket-patch#779 · Filter by author mikolalysenko opened on Oct 4, 2026
  4

• Agent-mode scan packages/<member> finds nothing in a pnpm workspace (exit 0), while rollback packages/<member> selects the same packages

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#778 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Gem hosted → vendored takeover un-hosts a gem declared inside a group block and then refuses to vendor it (gemfile_declaration_not_editable), so the project silently goes back to unpatched

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#775 · Filter by author mikolalysenko opened on Oct 4, 2026
  2

• --ecosystems rejects NPM and npm, pypi, which socket.yml patches.ecosystems accepts: the ecosystem name parser is written three times

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#773 · Filter by author mikolalysenko opened on Oct 4, 2026
  1

• Share one pnpm/vlt store-copy fan-out between agent apply and rollback, folding each copy's per-file records

  agent:claimedagent:triagedarch-auditpm:pnpmpriority:p1refactor
  SocketDev/socket-patch#772 · Filter by author mikolalysenko opened on Oct 4, 2026
  3

• Tracking: one agent-mode patch engine for apply and rollback

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#771 · Filter by author mikolalysenko opened on Oct 4, 2026

• Send telemetry through one Telemetry handle with a shared HTTP client instead of 19 track wrappers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#770 · Filter by author mikolalysenko opened on Oct 4, 2026