GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing github.com — Yarn classic VEX attests not_affected while a bundled copy of the patched package@version stays unpatched (yarn.lock has no inBundle, so the #325 fix can't see it) · Issue #758 · SocketDev/socket-patch Closed Labels agent:triagedbugSomething isn't workingSomething isn't workingbughuntFound by a scheduled package-manager bug-hunt agentFound by a scheduled package-manager bug-hunt agentpm:yarn-classicYarn classic (1.x)Yarn classic (1.x)priority:p2 Description[agent] Found by the scheduled Yarn classic (1.x) bug-hunt routine (ledger #304). SummaryThis is the yarn classic version of #325. A yarn classic project can install the same
PR #669 (the open #325 fix) only adds ImpactA false VEX statement. The shipped ReproThis uses a local mock patch API ( # parent package that bundles [email protected] mkdir -p bundsrc/package/node_modules/left-pad tar xzf left-pad-1.3.0.tgz -C bundsrc/package/node_modules/left-pad --strip-components=1 echo '{"name":"bund","version":"1.0.0","dependencies":{"left-pad":"1.3.0"},"bundledDependencies":["left-pad"]}' > bundsrc/package/package.json echo 'module.exports=require("left-pad")' > bundsrc/package/index.js tar czf bund-1.0.0.tgz -C bundsrc package mkdir proj && cd proj && git init -q && cp ../bund-1.0.0.tgz . echo '{"name":"proj","version":"1.0.0","dependencies":{"left-pad":"^1.3.0","bund":"file:./bund-1.0.0.tgz"}}' > package.json yarn install # yarn.lock has no trace of the bundled copy socket-patch scan --mode hosted --vex v0.json # (or --mode vendored) + mock URLs grep '"status"' v0.json # "not_affected", no warning in either mode rm -rf node_modules && yarn install --frozen-lockfile head -c 25 node_modules/left-pad/index.js # /* SOCKET-PATCHED-HUNT */ head -c 25 node_modules/bund/node_modules/left-pad/index.js # /* This program is free s (unpatched) socket-patch vex --output v1.json # vendored: "not_affected" (+ vendored_tree_out_of_sync warning); hosted: purl omitted (correct) Expected vs actual
Matrix (Linux, Node 22, main
|
| yarn | hosted in-run --vex |
hosted post-install vex |
vendored in-run --vex |
vendored post-install vex |
scan-time bundled warning |
|---|---|---|---|---|---|
| 1.7.0 | not_affected (wrong) | omitted (correct) | not_affected (wrong) | not_affected (wrong) | none |
| 1.10.1 | not_affected (wrong) | omitted (correct) | not_affected (wrong) | not_affected (wrong) | none |
| 1.22.22 | not_affected (wrong) | omitted (correct) | not_affected (wrong) | not_affected (wrong, ×2) | none |
Agent mode (scan --mode agent --vex) patches both copies and attests correctly (1.22.22). macOS and Windows weren't probed. The logic is OS-independent (lock-only rewriters plus VEX assembly).
Suspect code
crates/socket-patch-cli/src/commands/scan/hosted.rs:1262:assume_appliedonly drops uuids inrewrite.bundled_skipped_uuids, andrewrite_yarn_classic(crates/socket-patch-core/src/patch/redirect/mod.rs:3060) never fills it. It can't from yarn.lock alone; it would need the installed tree, or the parents'bundledDependencies.crates/socket-patch-cli/src/commands/vex.rs:672-688: the vendored attestation stands on the committed artifact even when an installed copy differs. For a bundled copy, the "re-run your install" remedy is wrong, and the copy should block the attestation, as npm VEX attests not_affected while a bundled (inBundle) copy of the same package@version stays unpatched #325 does for npm.
Related: #325 (npm, fix in #669), #497 (Bun's version of the npm-only #326 fix), #601 (bundled copies in vlt/pnpm agent mode).
Activity
- addedbugSomething isn't workingSomething isn't workingbughuntFound by a scheduled package-manager bug-hunt agentFound by a scheduled package-manager bug-hunt agentpm:yarn-classicYarn classic (1.x)Yarn classic (1.x)
on Oct 4, 2026 - added a commit that references this issue
on Oct 4, 2026 mikolalysenko commented
on Oct 4, 2026 CollaboratorAuthorMore actions[agent] Related to open PR #669 (#325, npm
inBundle). That PR only fillsbundled_skipped_uuidsfrom package-lock, so it does not fix this: yarn.lock has no record of bundled copies, so the yarn classic fix has to read the installed tree or the parents'bundledDependencies. Tracked as a separate cause.
Generated by Claude Code
mikolalysenko commented
on Oct 5, 2026 CollaboratorAuthorMore actions[agent] Yarn classic bug-hunt re-triage (ledger #304): still reproduces on main
4646693, which has #669 (#325, npm bundled copies in hosted in-run VEX) and #605 (npm store copies in agent apply / vex). Neither covers yarn.lock.Same repro as the issue body, using the local mock API. Linux, Node 22:
yarn hosted in-run --vexhosted post-install vexvendored in-run --vexvendored post-install vexbundled copy after --frozen-lockfile1.10.1 not_affected (wrong) omitted, exit 1 (correct) not_affected (wrong) not_affected (wrong) unpatched 1.22.22 not_affected (wrong) omitted, exit 1 (correct) not_affected (wrong) not_affected (wrong) unpatched The scan still gives no bundled-copy warning in either mode.
Generated by Claude Code
mikolalysenko commented
on Oct 7, 2026 CollaboratorAuthorMore actions[agent] Re-triage on main
05ecc6e(after #940): still reproduces on Linux, yarn 1.22.22, ×2.Same setup as the issue: root
[email protected]plus a localfile:./host-1.0.0.tgzwhosebundledDependenciesships its own[email protected].step hosted vendored scan --vex in.json(in-run)exit 0, not_affectedexit 0, not_affectedvexwithnode_modulesremoved (lock-only)exit 0, not_affectedexit 0, not_affectedfresh yarn install --frozen-lockfileroot copy patched, node_modules/host/node_modules/left-padunpatchedsame vexafter the installomitted ( not_applied), correctexit 0, not_affectedwith avendored_tree_out_of_sync-style warning telling you to re-run the install, which can't fix the bundled copySo #940's same-lock-copy check doesn't cover a bundled copy: the bundled copy has no lock block of its own. The scan still gives no warning.
Generated by Claude Code
mikolalysenko commented
on Oct 8, 2026 CollaboratorAuthorMore actions[agent] Re-checked on main
ea09714(after #1033, which covers pnpm bundled copies but not yarn classic): still reproduces, ×2, on yarn 1.22.22.The project has a direct
[email protected]plusbund(afile:tarball whosebundledDependenciesincludes left-pad 1.3.0).scan --mode hosted --vex vex.json --jsonexits 0 with only the berry-migration warning, and nothing mentions the bundled copy. The in-run VEX saysnot_affected. After a freshyarn install --frozen-lockfile,node_modules/left-padis patched andnode_modules/bund/node_modules/left-padis not. Post-install standalonevexcorrectly omits the package (not_applied, exit 1), as before.
Generated by Claude Code
mikolalysenko commented
on Oct 9, 2026 CollaboratorAuthorMore actions[agent] Re-triage on main
f3c6313(after #1008, whose #828 change covers bundled copies in npm, Bun and vlt but not yarn classic): still reproduces, Linux, yarn 1.22.22, issue repro.Mode in-run scan --vexafter fresh --frozen-lockfilepost-install vexhosted not_affected, no warning node_modules/bund/node_modules/left-padunpatchedomitted (correct) vendored (×2) not_affected, no warning same not_affected
Generated by Claude Code
mikolalysenko commented
on Oct 9, 2026 CollaboratorAuthorMore actionsv5 triage: P2, not a release blocker. Retain the Yarn classic bundled-copy evidence limitation at P2; avoid expanding lockfile-only crawling into an archive inventory project for this release.
This follows the maintainer's release scope: one normally completing CLI instance, prioritizing valid-lockfile patch/install behavior, compatibility, and actionable CLI UX.
mikolalysenko commented
on Oct 24, 2026 CollaboratorAuthorMore actions[agent] Claiming this issue (shared root cause: yarn classic hosted, vendored and lockfile-VEX paths read only yarn.lock, which never records copies unpacked from a parent's
bundledDependencies, so nothing sees the unpatched bundled copy innode_modules). Branch: agent/fix-yarn-classic-bundled-copies. Claim-ID: 2026-10-24T10:21:10Z-ee2054
Generated by Claude Code
mikolalysenko commented
on Oct 24, 2026 CollaboratorAuthorMore actions- added 2 commits that reference this issue
on Oct 24, 2026 mikolalysenko commented
on Oct 24, 2026 CollaboratorAuthorMore actions[agent] #1712 is ready for review. CI is green on
44f1a19and Bugbot found no issues. Whenyarn.lockholds a Socket wiring, yarn classic discovery now reads bundled copies (bundleDependencies) from the installednode_modules, sovexand the in-run VEX no longer attest a package whose bundled copy stays unpatched. Hosted scans name the copy withredirect_copy_unpatched, and vendored scans name it withvendor_bundled_instance_skipped. One limit remains: a lock-onlyvexwith nonode_modulesstill can't see the copy, because yarn.lock has no trace of it.
Generated by Claude Code
Metadata
Metadata
Assignees
Labels
Type
Projects
Milestone
Relationships
Development
Issue actions
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.