Issues

• Hosted and vendored scans from a vlt workspace member with a stray vlt-lock.json still write to that lock and exit 0 when the root's workspaces glob uses an extglob (packages/+(a|b), packages/@(a|b)); vendored VEX then attests not_affected

  bugbughuntpm:vlt
  SocketDev/socket-patch#1542 · Filter by author mikolalysenko opened on Oct 14, 2026

• Vendored Bun tarballs go into Git LFS when .gitattributes tracks *.tgz with LFS, so a checkout without LFS fails bun install --frozen-lockfile

  agent:triagedbugbughuntpm:bunpriority:p1
  SocketDev/socket-patch#1541 · Filter by author mikolalysenko opened on Oct 14, 2026
  1

• Yarn berry renamed-copy detection ignores a portal: / link: copy with an absolute path, so hosted and vendored scans succeed and every VEX path attests not_affected while that copy installs unpatched

  agent:triagedbugbughuntpm:yarn-berrypriority:p1
  SocketDev/socket-patch#1540 · Filter by author mikolalysenko opened on Oct 14, 2026
  1

• Yarn classic VEX still attests a pre-v5 hosted pin that yarn installs without the patched package's dependencies: #1463 checks only that the dependency's name is installed, and lock-only vex doesn't check at all

  agent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#1538 · Filter by author mikolalysenko opened on Oct 14, 2026
  1

• Root scan --mode vendored exits 1 forever and drops its in-run VEX when a nested independent npm project installs a patched package the root lock doesn't have (hosted mode only warns)

  agent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1534 · Filter by author mikolalysenko opened on Oct 14, 2026
  1

• CI perf (settings): slow Depot 16-core hosts since 10-13 15:20 add ~1.5–2.5 min to the merge-queue critical path (~0.6k Linux job-min/day)

  agent:needs-humanagent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1512 · Filter by author mikolalysenko opened on Oct 14, 2026
  3

• Slow scan: poetry hosted 2.6x median ms/pkg (lock_fragments::rewrite_batch + VEX lock re-parse)

  agent:claimedagent:triagedbenchenhancementpm:poetrypriority:p1
  SocketDev/socket-patch#1473 · Filter by author mikolalysenko opened on Oct 13, 2026
  9

• Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

  agent:triagedbenchperf-regressionpm:mavenpriority:p3
  SocketDev/socket-patch#1472 · Filter by author mikolalysenko opened on Oct 13, 2026
  1

• Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

  agent:triagedbenchperf-regressionpm:nugetpriority:p3
  SocketDev/socket-patch#1425 · Filter by author mikolalysenko opened on Oct 12, 2026
  2

• Perf regression: golang/rescan wall +34% (1d523d30, #1403)

  agent:triagedbenchperf-regressionpm:gopriority:p2
  SocketDev/socket-patch#1424 · Filter by author mikolalysenko opened on Oct 12, 2026
  1

• Swarm health manager log

  swarm-health
  SocketDev/socket-patch#1382 · Filter by author mikolalysenko opened on Oct 11, 2026
  3

• Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

  agent:needs-humanagent:triagedarch-auditpriority:p3refactorux
  SocketDev/socket-patch#1352 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• Hosted pnpm rollback/remove in a sharedWorkspaceLockfile: false workspace leaves trustLockfile: true without the documented pnpm_trust_lockfile_left warning

  agent:triagedbugbughuntpm:pnpmpriority:p3ux
  SocketDev/socket-patch#1268 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

  agent:needs-humanagent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1248 · Filter by author mikolalysenko opened on Oct 9, 2026
  7

• Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

  agent:triagedbenchenhancementpm:pipenvpriority:p3
  SocketDev/socket-patch#1246 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

  agent:triagedarch-auditbugpriority:p2ux
  SocketDev/socket-patch#1235 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• NuGet version identity is normalized by vendor but not by PurlKey, so a freshly vendored 4-part version is judged unused and pruned

  agent:triagedarch-auditbugpm:nugetpriority:p3
  SocketDev/socket-patch#1202 · Filter by author mikolalysenko opened on Oct 9, 2026
  5

• Decide: keep the in-memory hosted engine and napi addon as a supported product, or delete them

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1200 · Filter by author mikolalysenko opened on Oct 9, 2026
  1

• CI performance dashboard

  agent:triagedci-perf-dashboardpriority:p3
  SocketDev/socket-patch#1182 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

  agent:triagedbugbughuntpm:cargopriority:p3
  SocketDev/socket-patch#1135 · Filter by author mikolalysenko opened on Oct 8, 2026
  3

• Decide: should hosted rollback keep an originals sidecar, or restore only formats whose original is a pure function of registry data?

  agent:needs-humanagent:triagedarch-auditpriority:p3refactorux
  SocketDev/socket-patch#1130 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• A directory at .socket/manifest.json exits 2 with no --json output when --manifest-path spells the path, but exits 1 with manifest_unreadable under the default path

  agent:triagedarch-auditbugpriority:p3ux
  SocketDev/socket-patch#1123 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• Hosted yarn classic offline-mirror refusal misses a mirror set in a workspace member's .yarnrc, so installs run from that member fail the integrity check while the scan reports success and VEX attests

  agent:triagedbugbughuntpm:yarn-classicpriority:p2
  SocketDev/socket-patch#1115 · Filter by author mikolalysenko opened on Oct 8, 2026
  5

• Lock inventory and the vendored PyPI router disagree on which lock governs when poetry.lock or pdm.lock has no packages

  agent:triagedarch-auditbugpm:poetrypriority:p3
  SocketDev/socket-patch#1114 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• Tracking: derive scan candidates, lock entries and hosted refs from one project inventory instead of four discovery systems

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1112 · Filter by author mikolalysenko opened on Oct 8, 2026