Issues

• Windows: hot_patch test compares a Path::join result against a /-joined string (main CI red since #2068)

  agent:triagedci-janitorpriority:p1
  SocketDev/socket-patch#2080 · Filter by author mikolalysenko opened on Nov 14, 2026

• vex warns vendored_tree_out_of_sync for every vendored gem after bundle install, and the remedy it names never clears it because Bundler keeps the unused registry copy

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1ux
  SocketDev/socket-patch#2076 · Filter by author mikolalysenko opened on Nov 14, 2026
  1

• Vendored gem scan exits 1 with "Gemfile.lock GEM specs has no entry" for a gem in the shared gem home that the project does not lock, where hosted mode skips it with a warning

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#2075 · Filter by author mikolalysenko opened on Nov 14, 2026
  1

• Flake: composer oracle test races the COMPOSER_VENDOR_DIR EnvGuard added in #2064

  agent:triagedci-janitorpriority:p2
  SocketDev/socket-patch#2072 · Filter by author mikolalysenko opened on Nov 13, 2026

• scan --mode agent --no-gem-native-rebuild (and SOCKET_NO_GEM_NATIVE_REBUILD=1) still rebuilds the gem native extension and vex attests it; only apply and get honor the opt-out

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#2069 · Filter by author mikolalysenko opened on Nov 13, 2026
  1

• A hosted-patched gem disappears from bundle outdated and bundle update can no longer move it, and nothing in the scan output or docs says so

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1ux
  SocketDev/socket-patch#2070 · Filter by author mikolalysenko opened on Nov 13, 2026
  1

• Add scan --check: a read-only exit status for "patches are available but not applied"

  agent:needs-humanagent:triagedenhancementpriority:p3ux
  SocketDev/socket-patch#2051 · Filter by author mikolalysenko opened on Nov 10, 2026
  1

• Cargo VEX: an ignored [patch] Socket pin still attests a transitive crate; bypass remedies name ambiguous or incomplete commands

  agent:triagedbugpm:cargopriority:p2
  SocketDev/socket-patch#2045 · Filter by author mikolalysenko opened on Nov 9, 2026
  1

• pnpm reader follow-ups from #2009's review

  agent:triagedpm:pnpmpriority:p1
  SocketDev/socket-patch#2044 · Filter by author mikolalysenko opened on Nov 9, 2026
  2

• Merge queue evicts entries on CLI_CONTRACT.md conflicts (3 PRs, 4 evictions on 11-07)

  agent:needs-humanagent:triagedci-janitorpriority:p3
  SocketDev/socket-patch#2036 · Filter by author mikolalysenko opened on Nov 7, 2026
  2

• Move the cargo e2e fixture helpers into cargo_e2e_matrix: cargo(), sparse_index_rel, find_registry_crate, locked_version and package_block are copied in 3-4 suites that already include it

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1993 · Filter by author mikolalysenko opened on Nov 2, 2026

• Share one bun e2e toolchain module: 7 helpers are md5-identical across the 3 bun build suites and bun_toolchain drifted only in a suite name

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1992 · Filter by author mikolalysenko opened on Nov 2, 2026

• Carry apply/rollback advisories as typed values: ApplyResult.error doubles as a warning string that three consumers decode by substring, and they disagree

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1987 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• e2e_hosted_production and e2e_vendored_production are a near-fork: 11 identical helpers, a copied PURL/UUID catalog and hand-rolled VEX checkers beside vex_e2e_common

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1983 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Gradle --global-prefix e2e tests pass without --global-prefix: the harness always sets GRADLE_USER_HOME, and no test asserts gradle_user_home_differs fires

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1982 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• hermetic test children inherit GOFLAGS, GOENV, GOWORK, GOPATH and GOMODCACHE, which the go crawler and apply read; two hosted-production Go/Deno tests can't fail

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1981 · Filter by author mikolalysenko opened on Nov 2, 2026
  2

• Share the Go e2e harness through golang_e2e_matrix: go(), the file-proxy publisher, Machine/ChmodGuard and the grant mocks are copied across 5 suites

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1980 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Copy test fixture trees through one tests/common::copy_tree: 38 recursive copiers, 20 identical

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1979 · Filter by author mikolalysenko opened on Nov 2, 2026
  3

• Move npm-family workspace resolution out of hosted::governing_root: vendor, vex, scan and the crawler all import it

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1974 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• 8 of 9 docker agent e2e suites serve an all-zeros beforeHash and apply with --force, so they only prove the --force path; port gem's real-beforeHash probe

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1970 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• prebuilt_common::prepare_command silently drops --offline from vendor/repair, so 49 "--offline" test calls actually run online against a fixture server

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1969 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1968 · Filter by author mikolalysenko opened on Nov 2, 2026
  3

• Read gradle-wrapper.properties through one parser: the hosted and vendored Gradle 6.8 gates read the wrapper version two different ways and disagree on distributionUrl = …

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1963 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Use tests/common's helpers in the suites that already include it: has_command ×9, sha256_hex ×16, a dead stderr_chatter filter ×5, and rollback_json's drifted envelope readers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1959 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1950 · Filter by author mikolalysenko opened on Nov 1, 2026
  1