Issues

• vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified"

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1927 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1926 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Write every --json envelope through ui::print_json: 43 production sites print println!("{}", env.to_pretty_json()) instead

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1925 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Emit --json error envelopes through one json_envelope::emit_error: the builder is written 5 times and the human branch drifted

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1924 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• vendor and vendor --check run from an npm workspace member directory exit 0 without looking at the root lock: the eject says "nothing to vendor" and the check passes over a tampered artifact

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1921 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Crawler unit tests read the developer's real HOME, YARN_NODE_LINKER and VIRTUAL_ENV: 12 pkg_managers/pnpm_layout tests fail under a user nodeLinker setting

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1919 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Read pnpm YAML settings through one formats::pnpm scalar reader: three top-level-value readers drifted on quotes and empty values, and .modules.yaml is parsed twice

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1918 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Walk a NuGet project tree through one helper: the crawler's restore scope and vendor::nuget_config each walk it, and they drifted on project-file case and non-UTF-8 names

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1917 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• A lockless uv project with a Poetry plugin table loses its UV_PROJECT_ENVIRONMENT packages: "is this Poetry" is read three ways

  agent:claimedagent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#1916 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Type the vendor reference status: four copies interpret PackageVendorResult.status strings and disagree on which answers are settled

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1912 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• The project-patch (user_patches) gate loop is written five times, and scan's and vendor's copies have drifted

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1911 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• scan --prune's vendored GC reverts entries by hand instead of through VendoredBackend::revert, and drops each revert's error and still-wired orphans

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1910 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• vendor's download plan re-walks the vendor loop's candidate selection, and the copy skips the vlt refusal and the ambiguous-variant check

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1909 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• scan's vendored planning and preview run the refusal preflights twice, and the planning copy skips the PyPI refusals

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1908 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Vendored scan/get run from an npm workspace member directory refuses with "no package-lock.json … run your package manager's install first", a remedy that loops; hosted names the workspace root

  agent:claimedagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1904 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Under the default --cwd ".", the npm crawler never sees a parent .yarnrc --modules-folder or a parent yarn pnpm store, because it walks lexical ancestors of "."

  agent:claimedagent:triagedarch-auditbugpriority:p1
  SocketDev/socket-patch#1902 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Tokenize yarn-classic .yarnrc lines in one formats/yarn helper: the crawler's copy keeps single quotes that redirect's reader strips

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1901 · Filter by author mikolalysenko opened on Nov 1, 2026
  3

• Read package.json workspaces through one helper: five readers disagree on non-string items, null and empty lists

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1900 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• npm_crawler classifies node_modules store children three times, and the copies drifted on store entries and legacy/global stores

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1899 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Share one scoped env-var test guard: EnvGuard is copy-pasted 11 times across core unit and integration tests

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1889 · Filter by author mikolalysenko opened on Oct 30, 2026
  2

• Memoize env-keyed subprocess probes through one helper: composer, python and ruby each define the same env key and drifted on when an answer is kept

  agent:claimedagent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1888 · Filter by author mikolalysenko opened on Oct 30, 2026
  3

• Interpolate Maven ${...} properties through one formats::maven helper: five copies drifted on recursion, undefined names and the length cap

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1887 · Filter by author mikolalysenko opened on Oct 30, 2026
  1

• Decide: one hosted redirect JSON block for disk scan and the in-memory engine (today {mode, rewrittenFiles} vs a seven-key block)

  agent:needs-humanagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1881 · Filter by author mikolalysenko opened on Oct 30, 2026

• Render a patch's vulnerability labels through one ui helper: scan, get and list each write the CVE-else-advisory rule, and their order, dedup and severity case drifted

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1880 · Filter by author mikolalysenko opened on Oct 30, 2026

• Carry hosted stale-install and takeover warnings as RunWarning, not serde_json::Value round-tripped through run_warning_of

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1879 · Filter by author mikolalysenko opened on Oct 30, 2026