Sandbox::https://github.com/SocketDev/socket-patch/issues

After a vendored-to-hosted takeover is interrupted once its commit journal is written, the next `rollback` replays the journal, then exits 0 having restored nothing, and the project stays hosted-patched (`remove` says "No patch found")

SocketDev/socket-patch#1241 · opened

on Oct 9, 2026

1

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

SocketDev/socket-patch#1236 · opened

on Oct 9, 2026

4

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

SocketDev/socket-patch#1235 · opened

on Oct 9, 2026

1

The #812 replace-registry-host warning misses a `${VAR}` value in .npmrc: npm expands it to `always`, so every npm ci fails E404, while the hosted scan reports success with no warning

SocketDev/socket-patch#1233 · opened

on Oct 9, 2026

1

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

SocketDev/socket-patch#1232 · opened

on Oct 9, 2026

1

CI perf: coverage-docker (sbt) — 5.6-min image rebuild warms 3 unused toolchains; merge-queue critical path (~2.5 min/merge-group run)

SocketDev/socket-patch#1225 · opened

on Oct 9, 2026

Capped hosted gem re-scan counts a Gemfile-only (no-CHECKSUMS) pin as NEW, so `--max-new-patches N` spends its budget on gems it already wired and starves the next one forever (regression from #1058)

SocketDev/socket-patch#1224 · opened

on Oct 9, 2026

3

Upstream restore sends every public-registry lookup at once; the registry_concurrency cap has no caller

SocketDev/socket-patch#1220 · opened

on Oct 9, 2026

1

`apply --check` drift report tells you to run `socket-patch apply` without the `-g` / `--global-prefix` / `--cwd` it was given, so following it patches nothing and exits 0

SocketDev/socket-patch#1219 · opened

on Oct 9, 2026

1

After `uv remove --script` drops a vendored package from a PEP 723 script lock, `scan --prune`, `vendor --revert`, `remove`, `rollback` and the hosted takeover still drift-keep it, so `vendor --check` stays red and its prune remedy loops

SocketDev/socket-patch#1214 · opened

on Oct 9, 2026

3

Vendored PyPI revert, remove, rollback and the hosted takeover still delete the vendored wheel while a `uv export --format pylock.toml` in a subdirectory installs from it (exit 0)

SocketDev/socket-patch#1213 · opened

on Oct 9, 2026

3

After `yarn remove` of a hosted-pinned yarn berry package, its leftover `resolutions` pin makes rollback, remove and list fail forever with hosted_wiring_contested, and the remedy they print (re-run the hosted scan) changes nothing

SocketDev/socket-patch#1203 · opened

on Oct 9, 2026

1

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

SocketDev/socket-patch#1202 · opened

on Oct 9, 2026

4

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

SocketDev/socket-patch#1200 · opened

on Oct 9, 2026

CI perf: coverage-docker — each of 10 legs compiles the dependency graph twice (target/ and llvm-cov-target/) (~10,000 Linux job-min/day)

SocketDev/socket-patch#1199 · opened

on Oct 9, 2026

1

CI perf: compatibility workflows (sbt, PDM, vlt, Bun, Composer, +5) — full matrices on ~80% of PR pushes, 0 failures (~80,000 Linux + 26,000 Windows job-min/day)

SocketDev/socket-patch#1198 · opened

on Oct 9, 2026

1

Vendored pnpm 7–11 scan exits 1 after `pnpm remove` (or an upgrade) because it tries to vendor the orphaned `node_modules/.pnpm/<name>@<ver>` that pnpm keeps for 7 days, and the suggested `pnpm install` doesn't clear it

SocketDev/socket-patch#1197 · opened

on Oct 9, 2026

1

Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses

SocketDev/socket-patch#1196 · opened

on Oct 9, 2026

Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058)

SocketDev/socket-patch#1195 · opened

on Oct 9, 2026

2

`remove` and `rollback` call a vendored PyPI residual-reference keep "lockfile wiring drifted", and their "re-run `scan --mode vendored` to normalize, then remove" remedy loops (Pipenv `pipenv requirements` export)

SocketDev/socket-patch#1184 · opened

on Oct 8, 2026

2

CI performance dashboard

SocketDev/socket-patch#1182 · opened

on Oct 8, 2026

1

CI perf: ci.yml test-release — single 29.5-min job is now the whole PR critical path (~12 min off PR push→ci-ok)

SocketDev/socket-patch#1181 · opened

on Oct 8, 2026

2

CI perf: ci.yml e2e — ~120 sub-2.5-min Linux/Windows legs per run, 64% setup overhead (~12,000 job-min/day)

SocketDev/socket-patch#1178 · opened

on Oct 8, 2026

2

CI perf: Gradle patch compatibility — PR runs repeat ci.yml's Gradle e2e tier and run nightly-only extras (~17,000 Linux job-min/day)

SocketDev/socket-patch#1177 · opened

on Oct 8, 2026

2

CI perf: ci.yml e2e-macos — 23 one-minute macOS jobs per merge_group/push run (~2,300 macOS job starts/day)

SocketDev/socket-patch#1176 · opened

on Oct 8, 2026

1

Navigation Menu

Repository navigation

Issues

Issues

After a vendored-to-hosted takeover is interrupted once its commit journal is written, the next `rollback` replays the journal, then exits 0 having restored nothing, and the project stays hosted-patched (`remove` says "No patch found")

Yarn classic hosted and vendored scans miss a `file:` directory copy of the patched package declared under another dependency name, so `scan --vex` and lock-only `vex` attest not_affected while that copy installs unpatched

Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

The #812 replace-registry-host warning misses a `${VAR}` value in .npmrc: npm expands it to `always`, so every npm ci fails E404, while the hosted scan reports success with no warning

vendor --check fails a vendored npm package that has a bundled duplicate with "wiring missing: no lockfile or config references …", although the lock does reference it, and its `socket-patch vendor` remedy is a no-op

CI perf: coverage-docker (sbt) — 5.6-min image rebuild warms 3 unused toolchains; merge-queue critical path (~2.5 min/merge-group run)

Capped hosted gem re-scan counts a Gemfile-only (no-CHECKSUMS) pin as NEW, so `--max-new-patches N` spends its budget on gems it already wired and starves the next one forever (regression from #1058)

Upstream restore sends every public-registry lookup at once; the registry_concurrency cap has no caller

`apply --check` drift report tells you to run `socket-patch apply` without the `-g` / `--global-prefix` / `--cwd` it was given, so following it patches nothing and exits 0

After `uv remove --script` drops a vendored package from a PEP 723 script lock, `scan --prune`, `vendor --revert`, `remove`, `rollback` and the hosted takeover still drift-keep it, so `vendor --check` stays red and its prune remedy loops

Vendored PyPI revert, remove, rollback and the hosted takeover still delete the vendored wheel while a `uv export --format pylock.toml` in a subdirectory installs from it (exit 0)

After `yarn remove` of a hosted-pinned yarn berry package, its leftover `resolutions` pin makes rollback, remove and list fail forever with hosted_wiring_contested, and the remedy they print (re-run the hosted scan) changes nothing

NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

CI perf: coverage-docker — each of 10 legs compiles the dependency graph twice (target/ and llvm-cov-target/) (~10,000 Linux job-min/day)

CI perf: compatibility workflows (sbt, PDM, vlt, Bun, Composer, +5) — full matrices on ~80% of PR pushes, 0 failures (~80,000 Linux + 26,000 Windows job-min/day)

Vendored pnpm 7–11 scan exits 1 after `pnpm remove` (or an upgrade) because it tries to vendor the orphaned `node_modules/.pnpm/<name>@<ver>` that pnpm keeps for 7 days, and the suggested `pnpm install` doesn't clear it

Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses

Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058)

`remove` and `rollback` call a vendored PyPI residual-reference keep "lockfile wiring drifted", and their "re-run `scan --mode vendored` to normalize, then remove" remedy loops (Pipenv `pipenv requirements` export)

CI performance dashboard

CI perf: ci.yml test-release — single 29.5-min job is now the whole PR critical path (~12 min off PR push→ci-ok)

CI perf: ci.yml e2e — ~120 sub-2.5-min Linux/Windows legs per run, 64% setup overhead (~12,000 job-min/day)

CI perf: Gradle patch compatibility — PR runs repeat ci.yml's Gradle e2e tier and run nightly-only extras (~17,000 Linux job-min/day)

CI perf: ci.yml e2e-macos — 23 one-minute macOS jobs per merge_group/push run (~2,300 macOS job starts/day)