Issues

Vendored Go undo (vendor --revert, rollback, remove) stays silent about a stale vendor/modules.txt, so every build fails with "inconsistent vendoring"

SocketDev/socket-patch#1777 · opened

on Oct 28, 2026

3

Nightly mode_migration_vlt red: vendor tests predate #1648 eject

SocketDev/socket-patch#1774 · opened

on Oct 28, 2026

2

Nightly e2e_bun_lockb red: offline takeover test predates #1648

SocketDev/socket-patch#1770 · opened

on Oct 28, 2026

2

Go rollback and remove in a go.work member stay silent about a stale `go work vendor` modules.txt, so every workspace build fails with "inconsistent vendoring"

SocketDev/socket-patch#1766 · opened

on Oct 28, 2026

3

Gem `vendor --dry-run` eject previews `eject_planned` (exit 0) for a hosted gem declared in a `group` block, but the real `vendor` refuses `gemfile_declaration_not_editable` (exit 1)

SocketDev/socket-patch#1761 · opened

on Oct 28, 2026

2

Hosted → vendored over requirements.txt + a `pip lock` pylock.toml un-hosts both files but wires only pylock.toml, so `pip install -r requirements.txt` goes from patched to unpatched while `vendor` exits 0

SocketDev/socket-patch#1758 · opened

on Oct 28, 2026

3

npm rewrites a CRLF shebang in an installed bin file, so agent apply fails on it (or, with consent and on v5.0.1, breaks the bin) and hosted vex refuses a correctly patched install

SocketDev/socket-patch#1756 · opened

on Oct 28, 2026

3

Hosted Go scan in a go.work member pins a version another member outranks

SocketDev/socket-patch#1753 · opened

on Oct 27, 2026

2

In a go.work workspace where another member requires a newer version, Go apply writes an inert replace for the member's older version, and apply --check and VEX report it patched while the workspace build links the unpatched module

SocketDev/socket-patch#1751 · opened

on Oct 27, 2026

3

Hosted gem on Bundler < 2.2 locks: once two gems are redirected, `vex` finds no patch refs and every re-scan skips both gems as `redirect_unattributable` (exit 0), so superseding patches never land

SocketDev/socket-patch#1749 · opened

on Oct 27, 2026

5

CI perf: ci-ok — 2-second check waits up to 2.6 min for a Depot host to boot, serially at the end of every run (~0.5–2.6 min per merge)

SocketDev/socket-patch#1745 · opened

on Oct 27, 2026

3

CI perf (coverage tradeoff): Windows-only path bugs reach main because `test (windows-latest, *)` runs only nightly

SocketDev/socket-patch#1720 · opened

on Oct 25, 2026

4

CI perf (settings): 90-min merge-queue check timeout let one stuck check freeze main for 77 min

SocketDev/socket-patch#1670 · opened

on Oct 22, 2026

2

Depot runners lost mid-job evicted 2 merge-queue entries in 27h

SocketDev/socket-patch#1660 · opened

on Oct 21, 2026

5

Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry)

SocketDev/socket-patch#1650 · opened

on Oct 21, 2026

4

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

SocketDev/socket-patch#1607 · opened

on Oct 16, 2026

12

CI: pinned actions still target deprecated Node.js 20

SocketDev/socket-patch#1588 · opened

on Oct 15, 2026

3

CI perf (settings): slow Depot 16-core hosts since 10-13 15:20 add ~1.5–2.5 min to the merge-queue critical path (~0.6k Linux job-min/day)

SocketDev/socket-patch#1512 · opened

on Oct 14, 2026

14

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

SocketDev/socket-patch#1472 · opened

on Oct 13, 2026

1

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

SocketDev/socket-patch#1425 · opened

on Oct 12, 2026

2

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

SocketDev/socket-patch#1424 · opened

on Oct 12, 2026

3

Swarm health manager log

SocketDev/socket-patch#1382 · opened

on Oct 11, 2026

16

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

SocketDev/socket-patch#1352 · opened

on Oct 9, 2026

2

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

SocketDev/socket-patch#1268 · opened

on Oct 9, 2026

2

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)

SocketDev/socket-patch#1248 · opened

on Oct 9, 2026

11

Navigation Menu

Repository navigation

Issues

Vendored Go undo (vendor --revert, rollback, remove) stays silent about a stale vendor/modules.txt, so every build fails with "inconsistent vendoring"

Nightly mode_migration_vlt red: vendor tests predate #1648 eject

Nightly e2e_bun_lockb red: offline takeover test predates #1648

Go rollback and remove in a go.work member stay silent about a stale `go work vendor` modules.txt, so every workspace build fails with "inconsistent vendoring"

Gem `vendor --dry-run` eject previews `eject_planned` (exit 0) for a hosted gem declared in a `group` block, but the real `vendor` refuses `gemfile_declaration_not_editable` (exit 1)

Hosted → vendored over requirements.txt + a `pip lock` pylock.toml un-hosts both files but wires only pylock.toml, so `pip install -r requirements.txt` goes from patched to unpatched while `vendor` exits 0

npm rewrites a CRLF shebang in an installed bin file, so agent apply fails on it (or, with consent and on v5.0.1, breaks the bin) and hosted vex refuses a correctly patched install

Hosted Go scan in a go.work member pins a version another member outranks

In a go.work workspace where another member requires a newer version, Go apply writes an inert replace for the member's older version, and apply --check and VEX report it patched while the workspace build links the unpatched module

Hosted gem on Bundler < 2.2 locks: once two gems are redirected, `vex` finds no patch refs and every re-scan skips both gems as `redirect_unattributable` (exit 0), so superseding patches never land

CI perf: ci-ok — 2-second check waits up to 2.6 min for a Depot host to boot, serially at the end of every run (~0.5–2.6 min per merge)

CI perf (coverage tradeoff): Windows-only path bugs reach main because `test (windows-latest, *)` runs only nightly

CI perf (settings): 90-min merge-queue check timeout let one stuck check freeze main for 77 min

Depot runners lost mid-job evicted 2 merge-queue entries in 27h

Flake: nightly poetry hosted rollback fails on one transient PyPI request (UpstreamClient has no retry)

Perf regression: yarn-berry/rescan wall +21% (a43cf327..17793173; #1321/#1323/#1397 candidates)

CI: pinned actions still target deprecated Node.js 20

CI perf (settings): slow Depot 16-core hosts since 10-13 15:20 add ~1.5–2.5 min to the merge-queue critical path (~0.6k Linux job-min/day)

Perf regression: maven/hosted cpu +23% (9c43dfc9..17793173)

Perf regression: nuget/rescan wall +31% (f3c6313a..17793173; #1340/#1341)

Perf regression: golang/rescan wall +34% (1d523d30, #1403)

Swarm health manager log

Decide (post-v5): fix/undo/sync command model and exit 0 when there is nothing to undo

Hosted pnpm rollback/remove in a `sharedWorkspaceLockfile: false` workspace leaves `trustLockfile: true` without the documented `pnpm_trust_lockfile_left` warning

CI perf (settings): merge queue builds 5 entries at a time — a 13-PR burst took 100 min to drain on a 21-min CI run (~21 min per PR past the 5th)