Issues

• Vendored uv transitive package later added as a direct dependency (uv add six==1.16.0): vendor --revert / remove / rollback half-revert the pair, so uv sync --locked fails and vendor --check claims nothing references the wheel

  bugbughuntpm:uv
  SocketDev/socket-patch#1374 · Filter by author mikolalysenko opened on Oct 9, 2026

• CI perf: PR CI — 23% of full PR runs re-test unchanged diffs after a merge-main push (~20–30k Linux job-min/day, feeds the ubuntu-latest backlog)

  ci-perf
  SocketDev/socket-patch#1373 · Filter by author mikolalysenko opened on Oct 9, 2026

• CI perf: ci-ok — waits 9–18 min for an ubuntu-latest runner while ubuntu-22.04 starts in <1 min (merge-queue critical path, backlog hours)

  ci-perf
  SocketDev/socket-patch#1372 · Filter by author mikolalysenko opened on Oct 9, 2026

• Vendored mode leaves a Pipenv-written pylock.toml or a uv-export requirements.txt unpatched beside the wired lock

  bugpm:pipenv
  SocketDev/socket-patch#1368 · Filter by author mikolalysenko opened on Oct 9, 2026

• Vendored requirements.txt refuses a six (==1.16.0) pin that the inventory and hosted mode accept, because exact pins are read by three grammars

  agent:triagedarch-auditbugpm:pippriority:p1
  SocketDev/socket-patch#1365 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

  agent:needs-humanagent:triagedarch-auditpriority:p3refactorux
  SocketDev/socket-patch#1352 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• CI perf: Gradle compatibility — 4 Windows hosted cells (36–42 min each) on every matching PR are 70% of the run (~5,000 Windows job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1300 · Filter by author mikolalysenko opened on Oct 9, 2026
  1

• v5 Bundler plugin cleanup leaves .bundle/plugin registered in every other checkout, so bundle install crashes with LoadError on Bundler 2.3–2.5

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#1295 · Filter by author mikolalysenko opened on Oct 9, 2026
  3

• remove, rollback and get treat case-distinct packages as one: remove pkg:npm/jsonstream also removes JSONStream's patch

  agent:claimedagent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#1292 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• v5: align help and migration docs with lockfile-first scans and service-only vendoring

  agent:triagedcompatibilitydocumentationpriority:p1uxv5-blocker
  SocketDev/socket-patch#1289 · Filter by author mikolalysenko opened on Oct 9, 2026

• Vendored uv transitive package: after uv remove of its parent, scan --prune, vendor --revert, remove and rollback drift-keep it, so vendor --check stays red and its prune remedy loops (project and script lanes)

  agent:claimedagent:triagedbugbughuntcompatibilitypm:uvpriority:p1uxv5-blocker
  SocketDev/socket-patch#1287 · Filter by author mikolalysenko opened on Oct 9, 2026
  3

• Vendored uv script locks: after uv remove --script drops the package from one of two vendored scripts, every unwind keeps the other script wired (revert exits 0, remove/rollback exit 1, hosted takeover refuses)

  agent:triagedbugbughuntpm:uvpriority:p2ux
  SocketDev/socket-patch#1285 · Filter by author mikolalysenko opened on Oct 9, 2026
  1

• Hosted and vendored Poetry rewrites break poetry install on Poetry 1.4–2.2 when the patched dependency is declared with source = "pypi" ("Repository \"pypi\" does not exist."), with no warning

  agent:triagedbugbughuntcompatibilitypm:poetrypriority:p2
  SocketDev/socket-patch#1282 · Filter by author mikolalysenko opened on Oct 9, 2026
  1

• v5: make get package targeting exact and consistent before freezing the CLI

  agent:triagedbugcompatibilitypriority:p1uxv5-blocker
  SocketDev/socket-patch#1280 · Filter by author mikolalysenko opened on Oct 9, 2026

• Agent-mode cargo scan --sync / --prune drops the manifest entry of a crate the lock no longer resolves but leaves its shared registry-cache copy patched, so rollback can't restore it (regression from #1205)

  agent:claimedagent:triagedbugbughuntcompatibilitypm:cargopriority:p1v5-blocker
  SocketDev/socket-patch#1278 · Filter by author mikolalysenko opened on Oct 9, 2026
  3

• Hosted Bun rollback/remove ignores a private scope set in ~/.npmrc or ~/.bunfig.toml: it looks the package up on the public registry, then fails or writes a "" slot with the public package's integrity (#992 fix reads only the project's files)

  agent:claimedagent:triagedbugbughuntcompatibilitypm:bunpriority:p1v5-blocker
  SocketDev/socket-patch#1276 · Filter by author mikolalysenko opened on Oct 9, 2026
  3

• Vendored scala-cli gate passes a version conflict when a Bloop project file is truncated or oversized

  agent:claimedagent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1270 · Filter by author mikolalysenko opened on Oct 9, 2026
  4

• Hosted pnpm rollback/remove in a sharedWorkspaceLockfile: false workspace leaves trustLockfile: true without the documented pnpm_trust_lockfile_left warning

  agent:triagedbugbughuntpm:pnpmpriority:p3ux
  SocketDev/socket-patch#1268 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• CI perf: ci.yml e2e Gradle PR tier — all 4 Gradle lines on every PR push, 39% of a CI run (~9,800 Linux job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1267 · Filter by author mikolalysenko opened on Oct 9, 2026
  1

• Path-scoped agent scan packages/a and rollback packages/a skip a workspace member's npm alias (lp@npm:left-pad) under install-strategy=linked, while its plain links are in scope (exit 0, success)

  agent:triagedbugbughuntpm:npmpriority:p2
  SocketDev/socket-patch#1266 · Filter by author mikolalysenko opened on Oct 9, 2026
  3

• Artifact GC is reported in four JSON shapes, and the bytesFreed/bytes fields the contract documents are emitted by no command

  agent:triagedarch-auditbugcompatibilitypriority:p1uxv5-blocker
  SocketDev/socket-patch#1257 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

  agent:needs-humanagent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1248 · Filter by author mikolalysenko opened on Oct 9, 2026
  4

• Slow scan: pipenv hosted 2.6x median ms/pkg (per-patch Pipfile.lock re-tokenize)

  agent:triagedbenchenhancementpm:pipenvpriority:p3
  SocketDev/socket-patch#1246 · Filter by author mikolalysenko opened on Oct 9, 2026
  2

• Yarn classic hosted and vendored scans miss a file: directory copy of the patched package declared under another dependency name, so scan --vex and lock-only vex attest not_affected while that copy installs unpatched

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p2
  SocketDev/socket-patch#1236 · Filter by author mikolalysenko opened on Oct 9, 2026
  8

• Vendored re-runs outside the npm family exit 1 while a superseding patch is still building, instead of keeping the older vendored patch

  agent:triagedarch-auditbugpriority:p2ux
  SocketDev/socket-patch#1235 · Filter by author mikolalysenko opened on Oct 9, 2026
  2