Issues

• CI perf: coverage-docker — each of 10 legs compiles the dependency graph twice (target/ and llvm-cov-target/) (~10,000 Linux job-min/day)

  ci-perf
  SocketDev/socket-patch#1199 · Filter by author mikolalysenko opened on Oct 9, 2026

• CI perf: compatibility workflows (sbt, PDM, vlt, Bun, Composer, +5) — full matrices on ~80% of PR pushes, 0 failures (~80,000 Linux + 26,000 Windows job-min/day)

  ci-perf
  SocketDev/socket-patch#1198 · Filter by author mikolalysenko opened on Oct 9, 2026

• Vendored pnpm 7–11 scan exits 1 after pnpm remove (or an upgrade) because it tries to vendor the orphaned node_modules/.pnpm/<name>@<ver> that pnpm keeps for 7 days, and the suggested pnpm install doesn't clear it

  bugbughuntpm:pnpm
  SocketDev/socket-patch#1197 · Filter by author mikolalysenko opened on Oct 9, 2026

• Hosted npm scan appends allow-remote=all to a CRLF .npmrc with no final newline as "\nallow-remote=all\r", leaving an LF line and a bare-CR ending that socket-patch's own .npmrc planner refuses

  bugbughuntpm:npm
  SocketDev/socket-patch#1196 · Filter by author mikolalysenko opened on Oct 9, 2026

• Capped hosted scan (--max-new-patches 0) defers an already-pinned npm patch as NEW when a second lock entry of the same version is unpinned, so the vex remedy loops and that copy stays unpatched (regression from #1058)

  bugbughuntpm:npm
  SocketDev/socket-patch#1195 · Filter by author mikolalysenko opened on Oct 9, 2026

• Hosted gem re-scan refreshes a patch-registry GEM remote in place without re-sorting the lock's GEM sections, so after a superseding patch on a two-gem project every Bundler 4.0.19+ frozen install fails

  agent:claimedagent:triagedbugbughuntpm:bundlerpriority:p1
  SocketDev/socket-patch#1186 · Filter by author mikolalysenko opened on Oct 8, 2026
  3

• remove and rollback call a vendored PyPI residual-reference keep "lockfile wiring drifted", and their "re-run scan --mode vendored to normalize, then remove" remedy loops (Pipenv pipenv requirements export)

  agent:triagedbugbughuntpm:pipenvpriority:p1
  SocketDev/socket-patch#1184 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI performance dashboard

  agent:triagedci-perf-dashboardpriority:p3
  SocketDev/socket-patch#1182 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: ci.yml test-release — single 29.5-min job is now the whole PR critical path (~12 min off PR push→ci-ok)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1181 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• CI perf: ci.yml e2e — ~120 sub-2.5-min Linux/Windows legs per run, 64% setup overhead (~12,000 job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1178 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: Gradle patch compatibility — PR runs repeat ci.yml's Gradle e2e tier and run nightly-only extras (~17,000 Linux job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1177 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• CI perf: ci.yml e2e-macos — 23 one-minute macOS jobs per merge_group/push run (~2,300 macOS job starts/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1176 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: coverage — cargo llvm-cov report runs twice over the same profiles (~2.5 min/run, ~530 job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1174 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: test (windows/macos) — redundant cargo build step + full debuginfo linking ~240 test binaries (~930 job-min/day, ~300 macOS)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1173 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• CI perf: e2e fan-out — 23 e2e-macos + ~118 Linux e2e jobs/run, 82–87% under 2 min, 30–58% of job time is setup (~1,200 macOS + ~6,000 Linux job-min/day)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1172 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: Gradle e2e shards unbalanced — b-p leg is the merge-queue critical path (~3 min/merge-group run)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1171 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• CI perf: CI on push to main re-tests the exact SHA the merge queue just passed (~16,000 job-min/day, ~1,800 macOS)

  agent:triagedci-perfpriority:p3
  SocketDev/socket-patch#1170 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• Vendored→hosted takeover on yarn classic un-patches a vendored npm: alias copy when a direct copy is pinned, instead of retracting the takeover

  agent:claimedagent:triagedbugbughuntpm:yarn-classicpriority:p1
  SocketDev/socket-patch#1158 · Filter by author mikolalysenko opened on Oct 8, 2026
  3

• A vendored-to-hosted takeover interrupted after its commit journal is written leaves the vendored artifact directory behind for good: recovery finishes the files but not the deferred deletions, and no GC can reclaim it once the ledger is gone

  agent:triagedbugbughuntpm:pnpmpriority:p1
  SocketDev/socket-patch#1157 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• Decide: support tiers for bun.lockb writes, vendored pnpm 7/8 locks, vlt pre-1.0 locks and hosted Maven/Gradle

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1156 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• After npm install <pkg>@<other version> moves a vendored npm package off its patched version, scan --prune, vendor --revert, remove and rollback all drift-keep it, so vendor --check stays red and every remedy it names loops

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1155 · Filter by author mikolalysenko opened on Oct 8, 2026
  4

• Lower merge-queue check timeout from 360 to 120 min

  agent:needs-humanagent:triagedci-janitorpriority:p3
  SocketDev/socket-patch#1149 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• A failed VEX write leaves a truncated OpenVEX document at the output path

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1144 · Filter by author mikolalysenko opened on Oct 8, 2026
  1

• Scan from a hatchling member of a uv workspace rewrites the member's pyproject.toml as a lockless Hatch project, so the root uv.lock goes stale, uv sync --frozen installs the unpatched release and vendored vex attests not_affected

  agent:triagedbugbughuntpm:uvpriority:p1
  SocketDev/socket-patch#1138 · Filter by author mikolalysenko opened on Oct 8, 2026
  2

• Agent-mode cargo with HOME unset finds no registry cache, reports the crate as lockfile-only and exits 0, while cargo builds the unpatched copy from the passwd home's ~/.cargo

  agent:triagedbugbughuntpm:cargopriority:p2
  SocketDev/socket-patch#1135 · Filter by author mikolalysenko opened on Oct 8, 2026
  1