Issues

• Nightly gem e2e red on bundler 1.17/2.1: CRLF source-block rollback unattributable

  ci-janitor
  SocketDev/socket-patch#1997 · Filter by author mikolalysenko opened on Nov 3, 2026

• Move the cargo e2e fixture helpers into cargo_e2e_matrix: cargo(), sparse_index_rel, find_registry_crate, locked_version and package_block are copied in 3-4 suites that already include it

  arch-auditrefactor
  SocketDev/socket-patch#1993 · Filter by author mikolalysenko opened on Nov 2, 2026

• Share one bun e2e toolchain module: 7 helpers are md5-identical across the 3 bun build suites and bun_toolchain drifted only in a suite name

  arch-auditrefactor
  SocketDev/socket-patch#1992 · Filter by author mikolalysenko opened on Nov 2, 2026

• Carry apply/rollback advisories as typed values: ApplyResult.error doubles as a warning string that three consumers decode by substring, and they disagree

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1987 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• e2e_hosted_production and e2e_vendored_production are a near-fork: 11 identical helpers, a copied PURL/UUID catalog and hand-rolled VEX checkers beside vex_e2e_common

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1983 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Gradle --global-prefix e2e tests pass without --global-prefix: the harness always sets GRADLE_USER_HOME, and no test asserts gradle_user_home_differs fires

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1982 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• hermetic test children inherit GOFLAGS, GOENV, GOWORK, GOPATH and GOMODCACHE, which the go crawler and apply read; two hosted-production Go/Deno tests can't fail

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1981 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Share the Go e2e harness through golang_e2e_matrix: go(), the file-proxy publisher, Machine/ChmodGuard and the grant mocks are copied across 5 suites

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1980 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Copy test fixture trees through one tests/common::copy_tree: 38 recursive copiers, 20 identical

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1979 · Filter by author mikolalysenko opened on Nov 2, 2026
  2

• Move npm-family workspace resolution out of hosted::governing_root: vendor, vex, scan and the crawler all import it

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1974 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• 8 of 9 docker agent e2e suites serve an all-zeros beforeHash and apply with --force, so they only prove the --force path; port gem's real-beforeHash probe

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1970 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• prebuilt_common::prepare_command silently drops --offline from vendor/repair, so 49 "--offline" test calls actually run online against a fixture server

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1969 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED

  agent:claimedagent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1968 · Filter by author mikolalysenko opened on Nov 2, 2026
  2

• npm hosted and vendored scans pin a dependency that overrides forces to a remote tarball URL; npm ci installs it unpatched, and vendored vex / vendor --check still pass

  agent:claimedagent:needs-humanagent:triagedbugbughuntpm:npmpriority:p1
  SocketDev/socket-patch#1965 · Filter by author mikolalysenko opened on Nov 2, 2026
  4

• Read gradle-wrapper.properties through one parser: the hosted and vendored Gradle 6.8 gates read the wrapper version two different ways and disagree on distributionUrl = …

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1963 · Filter by author mikolalysenko opened on Nov 2, 2026
  1

• Use tests/common's helpers in the suites that already include it: has_command ×9, sha256_hex ×16, a dead stderr_chatter filter ×5, and rollback_json's drifted envelope readers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1959 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Run tests/common's selftests in one binary: 21 helper selftests are compiled into and re-run by every one of ~104 includers

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1957 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• formats::xml::attr matches a name inside another attribute's quoted value and never decodes entities; NuGet keeps a second, quote-aware attribute reader

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1950 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• hosted-e2e red on every PR: patch.socket.dev 403s bun; new transitive gem patches

  agent:triagedci-janitorpriority:p3
  SocketDev/socket-patch#1945 · Filter by author mikolalysenko opened on Nov 1, 2026
  2

• Gate toolchain e2e suites through one common::toolchain_gate: ten *_E2E_REQUIRED readers disagree on whether =0 and =true mean required

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1940 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Move Bundler settings parsing out of ruby_crawler into formats/gem/settings.rs, and read .bundle/config keys with one parser (two drifted today)

  agent:triagedarch-auditpriority:p1refactor
  SocketDev/socket-patch#1935 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Hosted composer.lock rewrite splices the server's url and sha1 through expanding Regex::replace with no validation or JSON escaping

  agent:triagedarch-auditbugpriority:p2
  SocketDev/socket-patch#1934 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example

  agent:triagedarch-auditbugpriority:p2
  SocketDev/socket-patch#1933 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• vex omission tags are untyped strings, and gradle_unpatched_copy has no phrase: it prints "the patch could not be verified"

  agent:triagedarch-auditbugpriority:p3
  SocketDev/socket-patch#1927 · Filter by author mikolalysenko opened on Nov 1, 2026
  1

• The "copy may still hold the patch" rule is written twice and drifted: cargo GC keeps a missing-blob modified copy, rollback's other-scope check drops it

  agent:triagedarch-auditpriority:p3refactor
  SocketDev/socket-patch#1926 · Filter by author mikolalysenko opened on Nov 1, 2026
  1