Issues

After a hosted rollback or vendored revert of a requirements.txt pin, plain `pip install -r` keeps the patched build, though rollback says the next install restores it (and `vendor --revert` says nothing)

SocketDev/socket-patch#1953 · opened

on Nov 1, 2026

3

"pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy

SocketDev/socket-patch#1952 · opened

on Nov 1, 2026

1

Resolve a yarn classic file:/url copy's identity through formats::yarn::copy only: source.rs keeps a drifted second reader that hosted uses

SocketDev/socket-patch#1951 · opened

on Nov 1, 2026

1

formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

SocketDev/socket-patch#1950 · opened

on Nov 1, 2026

1

PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it

SocketDev/socket-patch#1949 · opened

on Nov 1, 2026

1

hosted-e2e red on every PR: patch.socket.dev 403s bun; new transitive gem patches

SocketDev/socket-patch#1945 · opened

on Nov 1, 2026

2

Run PTY test children through one common::pty_io::run: the openpty-spawn-feed-collect runner is copied 7×, and only 2 copies pin TERM

SocketDev/socket-patch#1942 · opened

on Nov 1, 2026

2

Build every tests/apply fixture through apply_fixture: 9 suites in the apply binary re-write the manifest, blob, package and event-lookup helpers it already has

SocketDev/socket-patch#1941 · opened

on Nov 1, 2026

2

Gate toolchain e2e suites through one common::toolchain_gate: ten `*_E2E_REQUIRED` readers disagree on whether `=0` and `=true` mean required

SocketDev/socket-patch#1940 · opened

on Nov 1, 2026

1

Vendored npm rollback / remove / vendor --revert on a lockfileVersion 2 lock fail after any `npm install`, yet half-revert the lock: `packages` goes back to the registry while the legacy mirror keeps the patched integrity, and npm 6 then fails EINTEGRITY

SocketDev/socket-patch#1937 · opened

on Nov 1, 2026

3

Move Bundler settings parsing out of ruby_crawler into formats/gem/settings.rs, and read .bundle/config keys with one parser (two drifted today)

SocketDev/socket-patch#1935 · opened

on Nov 1, 2026

1

Hosted composer.lock rewrite splices the server's url and sha1 through expanding Regex::replace with no validation or JSON escaping

SocketDev/socket-patch#1934 · opened

on Nov 1, 2026

1

Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example

SocketDev/socket-patch#1933 · opened

on Nov 1, 2026

1

gemspec readers treat =begin blocks and heredocs as code: route gemspec_directives and dev_dependency_requirements through manifest::for_each_code_line

SocketDev/socket-patch#1932 · opened

on Nov 1, 2026

2

Bundler's path tier rule is written twice in ruby_crawler, and store discovery ignores BUNDLE_DISABLE_SHARED_GEMS: "false"

SocketDev/socket-patch#1931 · opened

on Nov 1, 2026

3

vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified"

SocketDev/socket-patch#1927 · opened

on Nov 1, 2026

1

The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it

SocketDev/socket-patch#1926 · opened

on Nov 1, 2026

1

Write every --json envelope through ui::print_json: 43 production sites print println!("{}", env.to_pretty_json()) instead

SocketDev/socket-patch#1925 · opened

on Nov 1, 2026

1

Emit --json error envelopes through one json_envelope::emit_error: the builder is written 5 times and the human branch drifted

SocketDev/socket-patch#1924 · opened

on Nov 1, 2026

1

`vendor` and `vendor --check` run from an npm workspace member directory exit 0 without looking at the root lock: the eject says "nothing to vendor" and the check passes over a tampered artifact

SocketDev/socket-patch#1921 · opened

on Nov 1, 2026

3

Crawler unit tests read the developer's real HOME, YARN_NODE_LINKER and VIRTUAL_ENV: 12 pkg_managers/pnpm_layout tests fail under a user nodeLinker setting

SocketDev/socket-patch#1919 · opened

on Nov 1, 2026

2

Read pnpm YAML settings through one formats::pnpm scalar reader: three top-level-value readers drifted on quotes and empty values, and .modules.yaml is parsed twice

SocketDev/socket-patch#1918 · opened

on Nov 1, 2026

2

Walk a NuGet project tree through one helper: the crawler's restore scope and vendor::nuget_config each walk it, and they drifted on project-file case and non-UTF-8 names

SocketDev/socket-patch#1917 · opened

on Nov 1, 2026

1

A lockless uv project with a Poetry plugin table loses its UV_PROJECT_ENVIRONMENT packages: "is this Poetry" is read three ways

SocketDev/socket-patch#1916 · opened

on Nov 1, 2026

3

Type the vendor reference status: four copies interpret PackageVendorResult.status strings and disagree on which answers are settled

SocketDev/socket-patch#1912 · opened

on Nov 1, 2026

1

Navigation Menu

Repository navigation

Issues

After a hosted rollback or vendored revert of a requirements.txt pin, plain `pip install -r` keeps the patched build, though rollback says the next install restores it (and `vendor --revert` says nothing)

"pnpm lock importers list a non-root member" is written twice and drifted on comment lines: keep formats::pnpm::workspace, delete the utils::pnpm_workspace copy

Resolve a yarn classic file:/url copy's identity through formats::yarn::copy only: source.rs keeps a drifted second reader that hosted uses

formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

PnpmLock::parse inventories a pnpm 11 env-lockfile document's configDependencies as project packages, while InstalledPackages and the upstream evidence reader drop it

hosted-e2e red on every PR: patch.socket.dev 403s bun; new transitive gem patches

Run PTY test children through one common::pty_io::run: the openpty-spawn-feed-collect runner is copied 7×, and only 2 copies pin TERM

Build every tests/apply fixture through apply_fixture: 9 suites in the apply binary re-write the manifest, blob, package and event-lookup helpers it already has

Gate toolchain e2e suites through one common::toolchain_gate: ten `*_E2E_REQUIRED` readers disagree on whether `=0` and `=true` mean required

Vendored npm rollback / remove / vendor --revert on a lockfileVersion 2 lock fail after any `npm install`, yet half-revert the lock: `packages` goes back to the registry while the legacy mirror keeps the patched integrity, and npm 6 then fails EINTEGRITY

Move Bundler settings parsing out of ruby_crawler into formats/gem/settings.rs, and read .bundle/config keys with one parser (two drifted today)

Hosted composer.lock rewrite splices the server's url and sha1 through expanding Regex::replace with no validation or JSON escaping

Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example

gemspec readers treat =begin blocks and heredocs as code: route gemspec_directives and dev_dependency_requirements through manifest::for_each_code_line

Bundler's path tier rule is written twice in ruby_crawler, and store discovery ignores BUNDLE_DISABLE_SHARED_GEMS: "false"

vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified"

The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it

Write every --json envelope through ui::print_json: 43 production sites print println!("{}", env.to_pretty_json()) instead

Emit --json error envelopes through one json_envelope::emit_error: the builder is written 5 times and the human branch drifted

`vendor` and `vendor --check` run from an npm workspace member directory exit 0 without looking at the root lock: the eject says "nothing to vendor" and the check passes over a tampered artifact

Crawler unit tests read the developer's real HOME, YARN_NODE_LINKER and VIRTUAL_ENV: 12 pkg_managers/pnpm_layout tests fail under a user nodeLinker setting

Read pnpm YAML settings through one formats::pnpm scalar reader: three top-level-value readers drifted on quotes and empty values, and .modules.yaml is parsed twice

Walk a NuGet project tree through one helper: the crawler's restore scope and vendor::nuget_config each walk it, and they drifted on project-file case and non-UTF-8 names

A lockless uv project with a Poetry plugin table loses its UV_PROJECT_ENVIRONMENT packages: "is this Poetry" is read three ways

Type the vendor reference status: four copies interpret PackageVendorResult.status strings and disagree on which answers are settled