Issues

Issues

• Add scan --check: a read-only exit status for "patches are available but not applied"

  SocketDev/socket-patch#2051 · opened on Nov 10, 2026

• Cargo VEX: an ignored [patch] Socket pin still attests a transitive crate; bypass remedies name ambiguous or incomplete commands

  SocketDev/socket-patch#2045 · opened on Nov 9, 2026
  1

• pnpm reader follow-ups from #2009's review

  SocketDev/socket-patch#2044 · opened on Nov 9, 2026
  2

• Merge queue evicts entries on CLI_CONTRACT.md conflicts (3 PRs, 4 evictions on 11-07)

  SocketDev/socket-patch#2036 · opened on Nov 7, 2026
  1

• Move the cargo e2e fixture helpers into cargo_e2e_matrix: cargo(), sparse_index_rel, find_registry_crate, locked_version and package_block are copied in 3-4 suites that already include it

  SocketDev/socket-patch#1993 · opened on Nov 2, 2026

• Share one bun e2e toolchain module: 7 helpers are md5-identical across the 3 bun build suites and bun_toolchain drifted only in a suite name

  SocketDev/socket-patch#1992 · opened on Nov 2, 2026

• Carry apply/rollback advisories as typed values: ApplyResult.error doubles as a warning string that three consumers decode by substring, and they disagree

  SocketDev/socket-patch#1987 · opened on Nov 2, 2026
  1

• e2e_hosted_production and e2e_vendored_production are a near-fork: 11 identical helpers, a copied PURL/UUID catalog and hand-rolled VEX checkers beside vex_e2e_common

  SocketDev/socket-patch#1983 · opened on Nov 2, 2026
  1

• Gradle --global-prefix e2e tests pass without --global-prefix: the harness always sets GRADLE_USER_HOME, and no test asserts gradle_user_home_differs fires

  SocketDev/socket-patch#1982 · opened on Nov 2, 2026
  1

• hermetic test children inherit GOFLAGS, GOENV, GOWORK, GOPATH and GOMODCACHE, which the go crawler and apply read; two hosted-production Go/Deno tests can't fail

  SocketDev/socket-patch#1981 · opened on Nov 2, 2026
  1

• Share the Go e2e harness through golang_e2e_matrix: go(), the file-proxy publisher, Machine/ChmodGuard and the grant mocks are copied across 5 suites

  SocketDev/socket-patch#1980 · opened on Nov 2, 2026
  1

• Copy test fixture trees through one tests/common::copy_tree: 38 recursive copiers, 20 identical

  SocketDev/socket-patch#1979 · opened on Nov 2, 2026
  3

• Move npm-family workspace resolution out of hosted::governing_root: vendor, vex, scan and the crawler all import it

  SocketDev/socket-patch#1974 · opened on Nov 2, 2026
  1

• 8 of 9 docker agent e2e suites serve an all-zeros beforeHash and apply with --force, so they only prove the --force path; port gem's real-beforeHash probe

  SocketDev/socket-patch#1970 · opened on Nov 2, 2026
  1

• prebuilt_common::prepare_command silently drops --offline from vendor/repair, so 49 "--offline" test calls actually run online against a fixture server

  SocketDev/socket-patch#1969 · opened on Nov 2, 2026
  1

• Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED

  SocketDev/socket-patch#1968 · opened on Nov 2, 2026
  3

• Read gradle-wrapper.properties through one parser: the hosted and vendored Gradle 6.8 gates read the wrapper version two different ways and disagree on distributionUrl = …

  SocketDev/socket-patch#1963 · opened on Nov 2, 2026
  1

• Use tests/common's helpers in the suites that already include it: has_command ×9, sha256_hex ×16, a dead stderr_chatter filter ×5, and rollback_json's drifted envelope readers

  SocketDev/socket-patch#1959 · opened on Nov 1, 2026
  1

• formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

  SocketDev/socket-patch#1950 · opened on Nov 1, 2026
  1

• Gate toolchain e2e suites through one common::toolchain_gate: ten *_E2E_REQUIRED readers disagree on whether =0 and =true mean required

  SocketDev/socket-patch#1940 · opened on Nov 1, 2026
  1

• Move Bundler settings parsing out of ruby_crawler into formats/gem/settings.rs, and read .bundle/config keys with one parser (two drifted today)

  SocketDev/socket-patch#1935 · opened on Nov 1, 2026
  1

• Hosted composer.lock rewrite splices the server's url and sha1 through expanding Regex::replace with no validation or JSON escaping

  SocketDev/socket-patch#1934 · opened on Nov 1, 2026
  2

• Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example

  SocketDev/socket-patch#1933 · opened on Nov 1, 2026
  1

• vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified"

  SocketDev/socket-patch#1927 · opened on Nov 1, 2026
  1

• The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it

  SocketDev/socket-patch#1926 · opened on Nov 1, 2026
  1