diff --git a/.github/workflows/pipenv-compatibility.yml b/.github/workflows/pipenv-compatibility.yml new file mode 100644 index 00000000..7345146b --- /dev/null +++ b/.github/workflows/pipenv-compatibility.yml @@ -0,0 +1,100 @@ +name: Pipenv compatibility + +# Drives the real CLI and real Pipenv releases through hosted, vendored, +# agent and out-of-tree agent mode on Linux and macOS (the `test` job already +# runs the in-process hosted Pipenv CLI tests on all three platforms, +# Windows included). The pre-2018 releases need Docker and stay in the local +# matrix (`docs/testing/pipenv-compatibility.md`). Needs network (PyPI + the +# public patch service); no Socket token. + +on: + pull_request: + paths: + - 'crates/socket-patch-core/src/patch/redirect/pipenv.rs' + - 'crates/socket-patch-core/src/vendor/pypi_pipenv.rs' + - 'crates/socket-patch-core/src/vendor/pypi.rs' + - 'crates/socket-patch-core/src/vendor/lock_inventory.rs' + - 'crates/socket-patch-core/src/crawlers/python_crawler.rs' + - 'crates/socket-patch-core/src/utils/pipenv.rs' + - 'crates/socket-patch-cli/src/commands/scan/hosted.rs' + - 'crates/socket-patch-cli/src/commands/vendor.rs' + - 'crates/socket-patch-cli/src/commands/rollback.rs' + - 'crates/socket-patch-cli/src/commands/vex.rs' + - 'crates/socket-patch-core/src/patch/redirect/replay.rs' + - 'scripts/backtest-pipenv.py' + - '.github/workflows/pipenv-compatibility.yml' + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + matrix: + strategy: + fail-fast: false + matrix: + include: + # Every 2018+ major, plus the shapes that exercise the relock and + # line-ending paths on the newest and the last Python-3.8 release. + - os: ubuntu-latest + versions: 2018.11.26 2020.11.15 2021.11.23 2022.12.19 2023.12.1 2024.4.1 2025.1.3 2026.8.0 + shapes: direct + - os: ubuntu-latest + versions: 2022.12.19 2026.8.0 + shapes: crlf marker-excluded extras category + - os: macos-latest + versions: 2018.11.26 2022.12.19 2023.12.1 2026.8.0 + shapes: direct + runs-on: ${{ matrix.os }} + timeout-minutes: 60 + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Install Rust + run: rustup show + - name: Cache cargo + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + with: + key: pipenv-compat + save-if: ${{ github.ref == 'refs/heads/main' }} + - name: Install uv + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 + - name: Install the Pythons the Pipenv releases run on + run: uv python install 3.8 3.12 + - name: Build the CLI + run: | + cargo build --locked -p socket-patch-cli + mkdir -p "$RUNNER_TEMP/bin" + cp target/debug/socket-patch "$RUNNER_TEMP/bin/socket-patch" + - name: Run the Pipenv matrix + env: + SOCKET_NO_CONFIG: '1' + SOCKET_NO_UPDATE_CHECK: '1' + # The runners carry whatever patch release uv ships; the harness + # only needs one 3.8 and one 3.12. + BACKTEST_PY38: '3.8' + BACKTEST_PY312: '3.12' + PIPENV_VERSIONS: ${{ matrix.versions }} + PIPENV_SHAPES: ${{ matrix.shapes }} + run: | + # shellcheck disable=SC2086 + python3 scripts/backtest-pipenv.py \ + --socket-patch "$RUNNER_TEMP/bin/socket-patch" \ + --socket-patch-revision "$GITHUB_SHA" \ + --output "$RUNNER_TEMP/pipenv-compat" \ + --versions $PIPENV_VERSIONS \ + --shapes $PIPENV_SHAPES \ + --modes hosted vendored agent agent-oot \ + --jobs 4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + if: always() + with: + name: pipenv-compat-${{ matrix.os }}-${{ strategy.job-index }} + path: | + ${{ runner.temp }}/pipenv-compat/summary.json + ${{ runner.temp }}/pipenv-compat/summary.md + if-no-files-found: warn + retention-days: 7 diff --git a/CHANGELOG.md b/CHANGELOG.md index eb5c1efe..73791aeb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,43 @@ into the new version's section — see docs/releasing.md. ### Added +- **Pipenv projects can use hosted patches, and vendored patches keep every + category.** `scan --mode hosted` rewrites every `Pipfile.lock` category + (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched + release to the hosted wheel — `file` references for Pipenv 2018 and later, + `path` for 7–11 (probed once with `pipenv --version`; `SOCKET_PIPENV_MAJOR` + pins it), pipfile-spec < 6 refused — preserving markers, extras, unrelated + entries, the Pipfile and its content hash, with per-entry rollback + (`redirect_pipenv_entry`). Vendored mode keeps custom categories and extras, + uses `path` for wheels with extras (Pipenv 2022's file-URL bug) and refuses + installers older than 2018 (`pypi_pipenv_installer_unsupported`). A stale + Pipfile.lock only vetoes the sibling Python rewriters on a real pin/source + conflict (`redirect_pipenv_refused`); anything else is + `redirect_pipenv_skipped`. Measured across the last stable release of all + 18 published Pipenv majors — see `docs/testing/pipenv-compatibility.md` and + `scripts/backtest-pipenv.py`. +- **`Pipfile.lock` is inventoried.** Lock-only Pipenv checkouts (a fresh + clone with nothing installed) now discover their pins in every mode — + hosted redirects them, vendored fetches the pristine wheel by one of the + lock's recorded digests (`LockIntegrity::Sha256AnyOf`, resolved through + PyPI's JSON API and verified against the same digest) and agent/scan list + them as lockfile-only packages. Previously they discovered nothing and + exited 0. Socket's own references stay discoverable, so a re-scan of an + already-redirected or already-vendored lock-only checkout re-confirms it; + a lock that resolves only from private indexes is never looked up on + pypi.org. +- **Pipenv's out-of-tree virtualenv is discovered.** Agent mode (bare `scan`, + `rollback`, `vex`) now finds `$WORKON_HOME/-[-]` (the + `.venv` file pointer, `PIPENV_CUSTOM_VENV_NAME` and `PIPENV_PIPFILE` + included) exactly as Pipenv 7 through 2026 place it, instead of falling + through to the global interpreter's site-packages. +- **Pipenv stale-install guard.** Pipenv never reinstalls a release that is + already present, so a hosted or vendored rewrite over a warm venv leaves the + upstream bytes installed; `redirect_pypi_stale_install` / + `pypi_pipenv_stale_install` now say so, naming the site-packages dir and + the verified remedy (`pipenv run pip uninstall -y && pipenv sync`, or + a clean `pipenv --rm && pipenv sync`), and the stale purl is excluded from + the same-run `--vex`. - **Poetry projects take hosted patches, and vendored patches now cover every `poetry.lock` generation.** `scan --mode hosted` rewrites `poetry.lock` to a `[package.source] type = "url"` pointing at the Socket-hosted, SHA-256-pinned @@ -200,6 +237,23 @@ into the new version's section — see docs/releasing.md. ### Fixed +- **Rollback after a Pipenv relock no longer refuses forever.** `pipenv lock` + (and `update`, and `install ` before 2024) regenerates a redirected + or vendored entry to registry shape on every Pipenv major; that is now the + desired end state — the hosted edit retires and the vendored record is + dropped (`vendor_lock_entry_relocked`) — instead of a permanent drift + refusal that held every pypi revert and kept the orphaned wheel dir. A + foreign `file`/`path` reference is still drift. +- **Same-run `--vex` attests lock-only pypi redirects.** The confirmed purl is + unqualified while the ledger records the API's artifact-qualified purl; + both sides now match on the qualifier-stripped purl, so a lock-only Pipenv + (or uv) checkout no longer exits 1 `no_applicable_patches` after + redirecting its lock. +- **The Pipenv installer probe runs only when a patch targets the lock**, warns + only when the lock was actually rewritten, resolves `pipenv` on absolute + `PATH` entries only (a relative entry would have executed a `pipenv` planted + in the scanned repository), finds `.bat`/`.cmd` shims on Windows, and takes + only the token after `version` (never a stray `Python 3.12` banner). - Hosted Python redirects now warn when installed files still contain upstream or modified bytes and omit those packages from same-run VEX. The read-only probe covers Poetry virtualenvs, repeats on re-scans, and uses persisted patch diff --git a/README.md b/README.md index 5f2d91af..e2fd00f3 100644 --- a/README.md +++ b/README.md @@ -254,6 +254,51 @@ Mode support varies by ecosystem — e.g. Go can't do hosted, Rush monorepos can vendored. See the full **[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)** for details and per-ecosystem caveats. +### Pipenv compatibility + +Hosted mode rewrites every `Pipfile.lock` category that pins the patched +release (`default`, `develop`, and Pipenv 2022+ named categories) and +preserves the Pipfile, its content hash, markers, extras, and unrelated lock +entries, so `pipenv install --deploy`, `pipenv sync` and `pipenv verify` keep +passing. The reference shape follows the installing Pipenv: releases 7–11 +need `path` references, 2018 and later use `file` references, and lock +formats before `pipfile-spec: 6` (Pipenv 0–6) are refused without changing +the lock. Socket Patch probes `pipenv --version` once per run (only when a +patch targets the lock); `SOCKET_PIPENV_MAJOR=` pins the answer for +machines without pipenv on PATH. Hosted references carry both the `#sha256=` +URL fragment (verified by Pipenv 2023+) and a `hashes` entry (verified by +2018–2022; Pipenv 11 verifies either), so a tampered lock fails to install +on every supported release. + +Vendored mode requires Pipenv 2018 or later. Wheels with extras use `path` +references to avoid Pipenv 2022's local-file URL parsing bug. Pipenv 2023+ +does not enforce hashes on local wheels; commit the wheel and run +`socket-patch vex --product ` (a Pipfile names no project, so pass the +product purl explicitly). + +Fresh checkouts work in every mode: a clone with only `Pipfile` + +`Pipfile.lock` is discovered from the lock (hosted redirects it, vendored +fetches the pristine wheel by one of the lock's recorded digests), and agent +mode finds Pipenv's default out-of-tree virtualenv under `WORKON_HOME` +without `pipenv run`. + +Pipenv never reinstalls a release that is already present: `pipenv install`, +`pipenv install --deploy` and `pipenv sync` all exit 0 and keep the installed +bytes, on every Pipenv major. A hosted or vendored rewrite therefore +protects fresh installs, and Socket Patch warns +(`redirect_pypi_stale_install` / `pypi_pipenv_stale_install`) when a venv +still holds the upstream release, with the verified remedy: +`pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && +pipenv sync`). Do not use `pipenv uninstall ` for this — it rewrites the +Pipfile and re-locks the patch away. `pipenv lock` / `pipenv update` +regenerate the entry to its registry reference (a silent unpatch): re-run +Socket Patch afterwards; `rollback` retires the stale record cleanly. + +`scripts/backtest-pipenv.py` drives the real CLI and the last stable release +of every published Pipenv major through hosted, vendored, agent and +out-of-tree agent mode, and `docs/testing/pipenv-compatibility.md` holds the +measured boundaries and results. + ## Common tasks ### Patch everything that can be patched diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md index 95c6ec83..fff18dde 100644 --- a/crates/socket-patch-cli/CLI_CONTRACT.md +++ b/crates/socket-patch-cli/CLI_CONTRACT.md @@ -120,10 +120,12 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc `scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL, or — for golang — the `patch.socket.dev/gopatch/` module path) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Re-runs over already-rewritten output record zero new edits. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove ` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. -The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock`), `requirements.txt` / `uv.lock` / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 1 or 2 — bun 1.3/1.4 share one emitted grammar; a binary `bun.lockb` with no text lock is auto-migrated to text via `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` before the read, recorded as a `removed` FileEdit; `redirect_bun_lockb_would_migrate` on `--dry-run`, `redirect_bun_lockb_unsupported` when the migration is unavailable). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces//pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `-socket.` by rewriting the literal `` (`redirect_maven_dep_version`) or adding a `` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed). +The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock`), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 1 or 2 — bun 1.3/1.4 share one emitted grammar; a binary `bun.lockb` with no text lock is auto-migrated to text via `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` before the read, recorded as a `removed` FileEdit; `redirect_bun_lockb_would_migrate` on `--dry-run`, `redirect_bun_lockb_unsupported` when the migration is unavailable). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces//pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `-socket.` by rewriting the literal `` (`redirect_maven_dep_version`) or adding a `` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed). **Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using ` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract. +**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and the Python stale-install guard (`redirect_pypi_stale_install`, see above) names the site-packages dir and the Pipenv-specific verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry, compared as parsed JSON (a whole-file CRLF/LF conversion or a Pipenv re-serialization that kept our reference and hashes is not drift; the original is spliced back in the live file's line ending); an entry a relock removed retires the edit; a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. **Discovery**: `Pipfile.lock` is part of the lockfile inventory (every category's `==` pins, with the lock's digest set as `Sha256AnyOf` integrity so a lock-only checkout can be vendored by fetching the pure wheel through PyPI's JSON API — only when `_meta.sources` name the public index; a private-index lock stays discovery-only and never reaches pypi.org), and Socket's own hosted / vendored references stay discoverable as the package they replace, so a re-scan of an already-redirected or already-vendored lock-only checkout re-confirms it (`--vex` attests, vendored reports `already_vendored`) instead of finding nothing. + **Mode ledgers (contract surfaces).** Each committable mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write these files, so path + schema are part of the contract: * `.socket/vendor/state.json` — the **vendored**-mode ledger (see "Ownership, state, and reversal" below): wiring edits with verbatim pre-vendor originals, artifact fingerprints, optional `detached` records. @@ -1073,6 +1075,14 @@ Every `--json` invocation emits a single JSON object that follows the **unified | `vendor_lock_checksums_unsupported` / `vendor_stale_lock_checksum` | `failed` | vendor (gem): an ambiguous/platform CHECKSUMS entry, or a v1-wired lock whose stale token blocks the hot path (run `vendor --revert` + re-vendor). | | `redirect_pypi_stale_install` | `redirect.warnings[]` (warning) | Hosted Python redirect: readable installed files differ from patched hashes. Read-only, repeated on re-scan, and excludes the package from same-run VEX. See the "Python stale-install guard" section. | | `redirect_gem_stale_install` | `redirect.warnings[]` (warning) | scan `--mode hosted` (gem): a stale UNPATCHED materialization (installed gem, or committed `vendor/cache` archive) that `bundle install` will reuse instead of fetching the redirected patch; the detail carries the verified remedy. Full rules and flavors: the "Gem stale-install guard" section. | +| `redirect_pipenv_refused` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the Pipfile.lock pins another version or a non-registry / foreign source for the package — refused atomically across categories, and the patch is vetoed from the sibling Python rewriters (see the "Pipenv hosted redirect" section). | +| `redirect_pipenv_skipped` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): no entry for the package, pipfile-spec < 6, an unparseable lock or a digest-less patch — nothing rewritten here; the sibling rewriters proceed. | +| `redirect_pipenv_installer_unknown` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the lock was rewritten with the modern `file` reference because no `pipenv` answered on PATH; Pipenv 7–11 projects need `path` — put that pipenv on PATH or set `SOCKET_PIPENV_MAJOR`. | +| `pypi_pipenv_installer_unsupported` | `failed` | vendor (pipenv): the installed Pipenv is older than 2018 and cannot consume vendored wheel references — upgrade Pipenv or use hosted mode. | +| `pypi_pipenv_version_mismatch` / `pypi_pipenv_invalid_wheel` | `failed` | vendor (pipenv): a category pins a different version than the patch (or the wheel filename carries no version) — refused before any write. | +| `pypi_pipenv_stale_install` | `skipped` (warning) | vendor (pipenv): the vendored twin of `redirect_pypi_stale_install` — the project's venv still holds the upstream release Pipenv will not reinstall over; the detail names the `pipenv run pip uninstall -y && pipenv sync` remedy. | +| `pypi_pipenv_installer_unknown` | `skipped` (warning) | vendor (pipenv): no `pipenv` answered on PATH; the vendored references assume Pipenv 2018 or later (7–11 cannot consume them — use hosted mode there); `SOCKET_PIPENV_MAJOR` pins the release. | +| `vendor_lock_entry_relocked` | revert `warnings[]` | vendor `--revert` / rollback (pipenv): a relock regenerated the wired entry to a registry reference, or removed it; the record is retired (artifact removed, ledger entry dropped) instead of drift-kept. | | `pypi_{poetry,pdm,pipenv}_no_lockfile` | `failed` | vendor (pypi): a lock-less tool marker with no `requirements.txt` fallback — run ` lock`. | | `pypi_poetry_integrity_unverified` | `skipped` (warning) | vendor (pypi / poetry): the lock was written by Poetry < 1.4 (0.12 `[metadata.hashes]`, lock 1.0/1.1, or a 2.0 lock without a `@generated by Poetry X.Y.Z` header — 1.3 wrote those). That installer does not verify local wheel hashes (the committed wheel bytes are the protection) and does not replace an already-installed package at the same version; recreate the virtualenv or `pip uninstall` the package before `poetry install`, or upgrade Poetry. | | `redirect_poetry_stale_install_risk` | `redirect.warnings[]` (warning) | scan `--mode hosted` (poetry): same writer test as above — a warm virtualenv keeps the upstream package after the redirect on Poetry < 1.4 (1.4+ re-installs from the new source); fresh installs pick up the patched wheel. Emitted once per rewritten lock, only on the run that rewrites it. | diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs index be72ca41..0582a0f9 100644 --- a/crates/socket-patch-cli/src/commands/repair_vendor.rs +++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs @@ -1119,6 +1119,7 @@ pub(crate) async fn repair_vendored_artifacts( // ── Rebuild via the normal backends ────────────────────────────────── let vendored_at = now_rfc3339(); + let pipenv_version = tokio::sync::OnceCell::new(); for c in candidates { if unrebuildable.contains(&c.purl) { continue; @@ -1181,6 +1182,7 @@ pub(crate) async fn repair_vendored_artifacts( false, // Repair rebuilds locally from the recorded patch — no service. None, + &pipenv_version, ) .await; match outcome { diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 50fb9605..033c0274 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -808,7 +808,7 @@ pub(crate) async fn run_redirect_selected( ) -> i32 { use socket_patch_core::manifest::schema::PatchRecord; use socket_patch_core::patch::redirect::{ - rewrite_registry_redirect_with_python_metadata, DepOverride, RedirectState, + rewrite_registry_redirect_with_pipenv_version, DepOverride, RedirectState, }; let mut skipped: Vec = Vec::new(); @@ -1401,8 +1401,37 @@ pub(crate) async fn run_redirect_selected( } } overrides.retain(|dep| !unavailable_python_artifacts.contains(&dep.artifact_url)); - let mut rewrite = - rewrite_registry_redirect_with_python_metadata(&files, &overrides, &python_metadata); + // The Pipfile.lock reference shape depends on the installing Pipenv + // (`path` for 7–11, `file` from 2018 on), so the installed release is + // probed (`pipenv --version`, up to 10 s) — but only when a pypi patch + // actually targets an entry of THIS lock: a stray Pipfile.lock in a uv / + // Poetry project, a re-scan with nothing left to do and any non-Python + // run must neither spawn Pipenv nor warn about its absence. + let targets_pipenv_lock = + socket_patch_core::patch::redirect::pipenv_lock_targets(&files, &overrides); + let pipenv_major = if targets_pipenv_lock { + socket_patch_core::utils::pipenv::installed_major(&common.cwd).await + } else { + None + }; + let mut rewrite = rewrite_registry_redirect_with_pipenv_version( + &files, + &overrides, + &python_metadata, + pipenv_major, + ); + + // Unknown installer → the modern `file` shape was chosen; say so only + // when the lock was (or, on --dry-run, would be) rewritten. + if targets_pipenv_lock && pipenv_major.is_none() && rewrite.files.contains_key("Pipfile.lock") { + rewrite.warnings.push(socket_patch_core::patch::redirect::RewriteWarning { + code: "redirect_pipenv_installer_unknown".into(), + detail: format!( + "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}= and re-run `scan --mode hosted`.", + socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV + ), + }); + } // The lockb→text migration is only KEPT when the rewrite actually landed // in the migrated bun.lock. Otherwise nothing was redirected there and the @@ -1685,6 +1714,9 @@ pub(crate) async fn run_redirect_selected( .iter() .filter( |(purl, uuid, artifact_url, index_url, suffixed_version, go_module_path)| { + if rewrite.refused_pipenv_uuids.contains(uuid) { + return false; + } if rewrite.python_lock_uuids.contains(uuid) { return rewrite.confirmed_python_lock_uuids.contains(uuid) && !rewrite.refused_python_lock_uuids.contains(uuid); @@ -1692,8 +1724,11 @@ pub(crate) async fn run_redirect_selected( if rewrite.hatch_uuids.contains(uuid) { return rewrite.confirmed_hatch_uuids.contains(uuid); } + // A Pipfile.lock rewrite confirms its own uuids (the sibling + // requirements.txt rewriter may have had nothing to do). if purl.starts_with("pkg:pypi/") { - return rewrite.confirmed_requirements_uuids.contains(uuid); + return rewrite.confirmed_pipenv_uuids.contains(uuid) + || rewrite.confirmed_requirements_uuids.contains(uuid); } if rewrite.refused_pnpm_uuids.contains(uuid) { return false; @@ -1976,11 +2011,17 @@ pub(crate) async fn run_redirect_selected( ) .await }; - let python_stale = if common.dry_run { StaleInstallOutcome::default() } else { - python::stale_install_warnings(common, &confirmed, &records, &ledger_records).await + python::stale_install_warnings( + common, + &confirmed, + &rewrite.confirmed_pipenv_uuids, + &records, + &ledger_records, + ) + .await }; // Cross-mode takeover: a committed vendored ledger (`.socket/vendor/state.json`) diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs index 37433a6c..975df585 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs @@ -16,6 +16,7 @@ use super::{installed_stale_positive_evidence, StaleInstallOutcome}; pub(super) async fn stale_install_warnings( common: &crate::args::GlobalArgs, confirmed: &[(String, String)], + pipenv_uuids: &BTreeSet, records: &BTreeMap, ledger_records: &BTreeMap, ) -> StaleInstallOutcome { @@ -37,14 +38,24 @@ pub(super) async fn stale_install_warnings( } let crawler = PythonCrawler::new(); - let paths = crawler - .get_site_packages_paths(&CrawlerOptions { - cwd: common.cwd.clone(), - global: common.global, - global_prefix: common.global_prefix.clone(), - }) - .await - .unwrap_or_default(); + // Only venvs that belong to THIS project (VIRTUAL_ENV, ./.venv, ./venv, + // Poetry's and Pipenv's out-of-tree venvs): the crawler's project-marker + // fallback to the global interpreters would judge some unrelated Python's + // copy of the release (a tool venv on PATH) and warn about a venv the + // project's installer never touches — a false positive that also fails + // the same-run --vex. --global / --global-prefix keep their meaning. + let paths = if common.global || common.global_prefix.is_some() { + crawler + .get_site_packages_paths(&CrawlerOptions { + cwd: common.cwd.clone(), + global: common.global, + global_prefix: common.global_prefix.clone(), + }) + .await + .unwrap_or_default() + } else { + socket_patch_core::crawlers::python_crawler::find_local_venv_site_packages(&common.cwd).await + }; #[derive(Default)] struct Judgment { @@ -56,7 +67,11 @@ pub(super) async fn stale_install_warnings( // the package identity. Any matching artifact variant can prove this // package patched; a healthy *different* package cannot. let mut judgments = BTreeMap::new(); + let mut pipenv_purls: BTreeSet = BTreeSet::new(); for (purl, record) in candidates { + if pipenv_uuids.contains(&record.uuid) { + pipenv_purls.insert(purl.clone()); + } let base = strip_purl_qualifiers(purl).to_string(); for site in &paths { let found = crawler @@ -82,15 +97,40 @@ pub(super) async fn stale_install_warnings( continue; } for purl in judgment.purls { + // Pipenv never reinstalls a release that is already present + // (`install`, `install --deploy`, `sync` all keep the installed + // bytes on every major), and `pipenv uninstall` rewrites the + // Pipfile and re-locks the patch away — name the verified remedy. + let remedy = if pipenv_purls.contains(&purl) { + let name = strip_purl_qualifiers(&purl) + .strip_prefix("pkg:pypi/") + .and_then(|rest| rest.split('@').next()) + .unwrap_or("") + .to_string(); + format!( + "Pipenv does not reinstall a release that is already present (`pipenv \ + install`, `pipenv install --deploy` and `pipenv sync` all keep those \ + bytes), so the rewritten Pipfile.lock only protects fresh installs. \ + Reinstall it from the lock without touching the Pipfile: `pipenv run pip \ + uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before \ + Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — \ + NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the \ + patch away; then `socket-patch vex --product ` re-verifies the \ + installed files." + ) + } else { + "Reinstall from the rewritten lock in this interpreter and verify with \ + `socket-patch vex`. Poetry before 1.4 may keep same-version packages: \ + recreate the project virtualenv or uninstall this package before \ + installing." + .to_string() + }; out.warnings.push(serde_json::json!({ "code": "redirect_pypi_stale_install", "detail": format!( "{purl} was redirected to a hosted patch, but installed files in {} \ - still differ from the patched hashes. Reinstall from the rewritten \ - lock in this interpreter and verify with `socket-patch vex`. \ - Poetry before 1.4 may keep same-version packages: recreate the \ - project virtualenv or uninstall this package before installing. \ - The installed files were left unchanged.", + still differ from the patched hashes. {remedy} The installed files \ + were left unchanged.", site.display() ), })); @@ -150,7 +190,7 @@ mod tests { ("one".into(), record("first-uuid", "first.py", b"patched")), ("two".into(), record("second-uuid", "second.py", b"patched")), ]); - let out = stale_install_warnings(&common, &confirmed, &BTreeMap::new(), &ledger).await; + let out = stale_install_warnings(&common, &confirmed, &BTreeSet::new(), &BTreeMap::new(), &ledger).await; assert_eq!(out.stale_purls, BTreeSet::from([first.to_string()])); assert_eq!(out.warnings.len(), 1); assert!(out.warnings[0]["detail"] @@ -165,7 +205,7 @@ mod tests { "variant".into(), )); ledger.insert("three".into(), record("variant", "first.py", b"upstream")); - let out = stale_install_warnings(&common, &confirmed, &BTreeMap::new(), &ledger).await; + let out = stale_install_warnings(&common, &confirmed, &BTreeSet::new(), &BTreeMap::new(), &ledger).await; assert!(out.stale_purls.is_empty()); assert!(out.warnings.is_empty()); } diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs index 7c896751..24a4b6f1 100644 --- a/crates/socket-patch-cli/src/commands/vendor.rs +++ b/crates/socket-patch-cli/src/commands/vendor.rs @@ -105,6 +105,7 @@ pub(crate) async fn dispatch_vendor_one( // --vendor` / repair. Per-ecosystem backends consume it as they gain a // service path. service: Option<&VendorServiceConfig>, + pipenv_version: &tokio::sync::OnceCell>, ) -> Option { let eco = ecosystem_dir_for_purl(purl)?; @@ -155,7 +156,21 @@ pub(crate) async fn dispatch_vendor_one( // The flavor router probes the project's lockfile (package-lock / // yarn / pnpm / bun) and dispatches or refuses per flavor. "npm" => vend!(vendor::npm_flavor::vendor_npm_any), - "pypi" => vend!(vendor::pypi::vendor_pypi), + "pypi" => { + vendor::pypi::vendor_pypi_with_pipenv_version( + purl, + pkg_path, + project_root, + record, + sources, + vendored_at, + dry_run, + force, + service, + pipenv_version, + ) + .await + } "gem" => vend!(vendor::gem::vendor_gem), "cargo" => vend!(vendor::cargo::vendor_cargo_crate), "golang" => vend!(vendor::golang::vendor_go_module), @@ -662,23 +677,32 @@ pub(crate) async fn fetch_pristine_package( purl: &str, ledger_entry: Option<&VendorEntry>, ) -> PristineFetch { - let entry = match lock_inventory::lookup(inventory, purl) { - Some(e) => e.clone(), - None => { - let Some(le) = ledger_entry else { - return PristineFetch::NoSource; - }; - match lock_inventory::recover_lock_entry(project_root, le).await { - Ok(rec) => rec, - Err(e) => { - return PristineFetch::Unverifiable(format!( - "the lockfile no longer records a registry resolution for {purl} \ - (rewired to the vendored artifact) and the ledger cannot recover \ - one: {e}" - )) - } + // A lock entry that carries an integrity is the registry resolution to + // fetch. A DISCOVERY-ONLY entry (the lock is rewired to OUR reference, + // whose recorded hashes are the patched wheel's — nothing PyPI serves) + // cannot be fetched by itself: the ledger's pre-vendor fragment can, so + // an already-vendored lock-only checkout re-scans green. + let inventory_entry = lock_inventory::lookup(inventory, purl).cloned(); + let fetchable = inventory_entry + .as_ref() + .filter(|e| e.integrity != lock_inventory::LockIntegrity::None) + .cloned(); + let entry = match (fetchable, ledger_entry) { + (Some(e), _) => e, + (None, Some(le)) => match lock_inventory::recover_lock_entry(project_root, le).await { + Ok(rec) => rec, + Err(e) => { + return PristineFetch::Unverifiable(format!( + "the lockfile no longer records a registry resolution for {purl} \ + (rewired to the vendored artifact) and the ledger cannot recover \ + one: {e}" + )) } - } + }, + (None, None) => match inventory_entry { + Some(e) => e, + None => return PristineFetch::NoSource, + }, }; match registry_fetch::fetch_and_stage(&entry, client).await { Ok(fetched) => PristineFetch::Fetched(fetched), @@ -958,6 +982,7 @@ pub(crate) async fn vendor_records( Err(corrupt) => (None, Some(corrupt)), }; + let pipenv_version = tokio::sync::OnceCell::new(); for (purl, pkg_path) in &all_packages { let is_variant_eco = Ecosystem::from_purl(purl).is_some_and(|e| e.supports_release_variants()); @@ -1151,6 +1176,7 @@ pub(crate) async fn vendor_records( common.dry_run, force, service, + &pipenv_version, ) .await; @@ -1809,6 +1835,7 @@ mod dispatch_tests { false, false, Some(&service), + &tokio::sync::OnceCell::new(), ) .await; // The backend itself may refuse (nothing is installed in the diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs new file mode 100644 index 00000000..149ae33b --- /dev/null +++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs @@ -0,0 +1,413 @@ +//! In-process CLI tests for `scan --mode hosted` on Pipenv projects: mocks +//! the API (discovery + reference + view) via wiremock, lays down a native +//! `Pipfile.lock` (the committed Pipenv 2026.8.0 fixture) and drives the +//! real command wiring. Covered here (the rewriter bytes themselves are +//! pinned by the core `patch::redirect::pipenv` tests): +//! +//! * the lock-only fresh-checkout shape (nothing installed) is discovered +//! from `Pipfile.lock` alone, repointed with a `file` reference carrying +//! the `#sha256=` fragment and a matching `hashes` entry, attested by the +//! same-run `--vex`, re-scanned idempotently and rolled back byte for byte; +//! * `SOCKET_PIPENV_MAJOR=11` selects the legacy `path` reference shape the +//! installer probe would otherwise need a real Pipenv 7–11 on PATH for; +//! * a stale `Pipfile.lock` that does not pin the package no longer vetoes +//! the sibling `requirements.txt` redirect (Bugbot HIGH on #242); +//! * a venv still holding the UPSTREAM release is reported stale and kept +//! out of the same-run attestation. + +use std::path::Path; + +use serial_test::serial; +use socket_patch_cli::args::GlobalArgs; +use socket_patch_cli::commands::rollback::{self, RollbackArgs}; +use socket_patch_cli::commands::scan::{run, ScanArgs}; +use socket_patch_cli::commands::vex::VexEmbedArgs; +use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes; +use wiremock::matchers::{method, path, path_regex}; +use wiremock::{Mock, MockServer, ResponseTemplate}; + +const ORG: &str = "test-org"; +/// Discovery names the base purl (the lockfile supplement's spelling)… +const PURL: &str = "pkg:pypi/urllib3@1.26.18"; +/// …while the patch record carries the API's artifact-qualified purl, which +/// is what the redirect ledger is keyed by. +const RECORD_PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"; +const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98"; +const HOSTED_URL: &str = "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/22222222-2222-4222-8222-222222222222/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"; +const GHSA: &str = "GHSA-gm62-xv2j-4w53"; +const MAJOR_ENV: &str = socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV; + +const LOCK: &str = + include_str!("../../socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock"); +const PIPFILE: &str = include_str!("../../socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile"); + +/// The upstream and patched bytes of the record's one file, so the venv +/// tests can materialize a real `Ready` (upstream) install. +const UPSTREAM: &[u8] = b"def upstream():\n return 'vulnerable'\n"; +const PATCHED: &[u8] = b"def patched():\n return 'fixed'\n"; + +fn sha256() -> String { + "c".repeat(64) +} + +fn global(cwd: &Path, api_url: String) -> GlobalArgs { + GlobalArgs { + cwd: cwd.to_path_buf(), + org: Some(ORG.to_string()), + api_token: Some("fake".to_string()), + api_url: Some(api_url), + json: true, + yes: true, + ..GlobalArgs::default() + } +} + +fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs { + ScanArgs { + paths: Vec::new(), + common: global(cwd, api_url), + batch_size: 100, + apply: false, + prune: false, + sync: false, + vendor: false, + detached: false, + redirect: true, + mode: None, + all_releases: false, + vex: VexEmbedArgs { + vex: vex.map(Path::to_path_buf), + // A Pipfile names no project, so the embedded VEX cannot detect a + // product purl on its own (nor without a git remote): callers pass + // `--vex-product`, as documented for Pipenv projects. + vex_product: vex.map(|_| "pkg:pypi/pipenv-fixture@0.1.0".to_string()), + ..Default::default() + }, + } +} + +async fn mock_api(server: &MockServer) { + Mock::given(method("POST")) + .and(path(format!("/v0/orgs/{ORG}/patches/batch"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "packages": [{ + "purl": PURL, + "patches": [{ + "uuid": UUID, "purl": RECORD_PURL, "tier": "free", + "cveIds": ["CVE-2025-66418"], "ghsaIds": [GHSA], "severity": "HIGH", + "title": "pipenv redirect fixture" + }] + }], + "canAccessPaidPatches": false, + }))) + .mount(server) + .await; + Mock::given(method("GET")) + .and(path_regex(format!("^/v0/orgs/{ORG}/patches/by-package/.+$"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "patches": [{ + "uuid": UUID, "purl": RECORD_PURL, + "publishedAt": "2026-07-29T20:20:47Z", + "description": "x", "license": "MIT", "tier": "free", + "vulnerabilities": {} + }], + "canAccessPaidPatches": false, + }))) + .mount(server) + .await; + Mock::given(method("POST")) + .and(path(format!("/v0/orgs/{ORG}/patches/package"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "results": { + UUID: { + "status": "granted", + "url": HOSTED_URL, + "purl": PURL, + "artifacts": [{ + "kind": "tarball", + "url": HOSTED_URL, + "integrity": { "sha256": sha256() } + }], + "registryOverride": null + } + } + }))) + .mount(server) + .await; + Mock::given(method("GET")) + .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "uuid": UUID, + "purl": RECORD_PURL, + "publishedAt": "2026-07-29T20:20:47Z", + "files": { + "urllib3/response.py": { + "beforeHash": compute_git_sha256_from_bytes(UPSTREAM), + "afterHash": compute_git_sha256_from_bytes(PATCHED), + } + }, + "vulnerabilities": { + GHSA: { + "cves": ["CVE-2025-66418"], + "summary": "pipenv redirect vex fixture", + "severity": "HIGH", + "description": "d" + } + }, + "description": "x", "license": "MIT", "tier": "free" + }))) + .mount(server) + .await; +} + +fn site_packages(root: &Path) -> std::path::PathBuf { + if cfg!(windows) { + root.join(".venv").join("Lib").join("site-packages") + } else { + root.join(".venv") + .join("lib") + .join("python3.12") + .join("site-packages") + } +} + +/// A Pipenv project with nothing installed: the lock is the only source of +/// the dependency. An EMPTY in-project venv keeps the crawl hermetic (without +/// it the project-marker fallback would walk this machine's global +/// interpreters). +fn write_project(root: &Path) { + std::fs::write(root.join("Pipfile"), PIPFILE).unwrap(); + std::fs::write(root.join("Pipfile.lock"), LOCK).unwrap(); + std::fs::create_dir_all(site_packages(root)).unwrap(); +} + +/// The same project with the UPSTREAM release installed in its venv (the +/// warm-venv shape Pipenv never reinstalls over). +fn write_project_with_upstream_install(root: &Path) { + write_project(root); + let site = site_packages(root); + let dist_info = site.join("urllib3-1.26.18.dist-info"); + std::fs::create_dir_all(&dist_info).unwrap(); + std::fs::write( + dist_info.join("METADATA"), + "Metadata-Version: 2.1\nName: urllib3\nVersion: 1.26.18\n", + ) + .unwrap(); + std::fs::create_dir_all(site.join("urllib3")).unwrap(); + std::fs::write(site.join("urllib3").join("response.py"), UPSTREAM).unwrap(); +} + +fn read(path: &Path) -> String { + std::fs::read_to_string(path).unwrap() +} + +/// Pins the installer major for the duration of a test (restored on drop) so +/// the reference shape does not depend on whatever `pipenv` the machine has. +struct MajorGuard(Option); + +impl MajorGuard { + fn set(major: &str) -> Self { + let saved = std::env::var(MAJOR_ENV).ok(); + std::env::set_var(MAJOR_ENV, major); + MajorGuard(saved) + } +} + +impl Drop for MajorGuard { + fn drop(&mut self) { + match &self.0 { + Some(v) => std::env::set_var(MAJOR_ENV, v), + None => std::env::remove_var(MAJOR_ENV), + } + } +} + +fn urllib3_entry(lock: &str) -> serde_json::Value { + let value: serde_json::Value = serde_json::from_str(lock).expect("lock stays JSON"); + value["default"]["urllib3"].clone() +} + +async fn roll_back(cwd: &Path, api_url: String) { + let code = rollback::run(RollbackArgs { + targets: Vec::new(), + common: global(cwd, api_url), + one_off: false, + preserve_state: false, + }) + .await; + assert_eq!(code, 0, "rollback must succeed"); +} + +#[tokio::test] +#[serial] +async fn lock_only_pipenv_project_redirects_attests_rescans_and_rolls_back() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + let vex_path = tmp.path().join("out.vex.json"); + + // 1. Hosted redirect with same-run --vex on the lock-only checkout. + let code = run(hosted_args(tmp.path(), server.uri(), Some(&vex_path))).await; + assert_eq!(code, 0, "hosted redirect + same-run vex must succeed"); + let redirected = read(&lock_path); + let entry = urllib3_entry(&redirected); + assert_eq!( + entry["file"].as_str(), + Some(format!("{HOSTED_URL}#sha256={}", sha256()).as_str()), + "{redirected}" + ); + assert_eq!( + entry["hashes"], + serde_json::json!([format!("sha256:{}", sha256())]), + "{redirected}" + ); + assert!(entry.get("version").is_none() && entry.get("index").is_none(), "{entry}"); + assert_eq!( + entry["markers"], + urllib3_entry(LOCK)["markers"], + "markers are preserved" + ); + let before: serde_json::Value = serde_json::from_str(LOCK).unwrap(); + let after: serde_json::Value = serde_json::from_str(&redirected).unwrap(); + assert_eq!(after["_meta"], before["_meta"], "the Pipfile content hash stays"); + assert_eq!(read(&tmp.path().join("Pipfile")), PIPFILE, "Pipfile untouched"); + let ledger: serde_json::Value = + serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))) + .unwrap(); + assert!( + ledger["records"][RECORD_PURL].is_object(), + "ledger keyed by the artifact-qualified purl: {ledger}" + ); + assert_eq!( + ledger["edits"][0]["kind"].as_str(), + Some("redirect_pipenv_entry"), + "{ledger}" + ); + assert_eq!( + ledger["edits"][0]["key"].as_str(), + Some(r#"["default","urllib3"]"#), + "{ledger}" + ); + // Attested from the ledger (assume_applied) although the base purl the + // run confirmed differs from the record's qualified purl. + let vex: serde_json::Value = serde_json::from_str(&read(&vex_path)).unwrap(); + let statements = vex["statements"].as_array().expect("statements"); + assert_eq!(statements.len(), 1, "{vex}"); + assert_eq!(statements[0]["vulnerability"]["name"].as_str(), Some(GHSA), "{vex}"); + assert_eq!(statements[0]["status"].as_str(), Some("not_affected"), "{vex}"); + + // 2. Idempotent re-scan: no further edits, lock byte-identical. + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + assert_eq!(read(&lock_path), redirected, "re-scan must not touch the lock"); + let ledger: serde_json::Value = + serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))) + .unwrap(); + assert_eq!(ledger["edits"].as_array().map(Vec::len), Some(1), "one edit, not two"); + + // 3. rollback unwinds the redirect and drops the record. + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK, "rollback must restore the pristine lock byte for byte"); + let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json"); + if ledger_path.exists() { + let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap(); + assert!( + ledger["records"] + .as_object() + .is_none_or(|records| records.is_empty()), + "no redirect record may survive rollback: {ledger}" + ); + } +} + +#[tokio::test] +#[serial] +async fn legacy_installer_major_selects_path_references() { + let _major = MajorGuard::set("11"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + let redirected = read(&lock_path); + let entry = urllib3_entry(&redirected); + assert_eq!( + entry["path"].as_str(), + Some(format!("{HOSTED_URL}#sha256={}", sha256()).as_str()), + "Pipenv 7–11 install `path` references: {redirected}" + ); + assert!(entry.get("file").is_none(), "{entry}"); + assert_eq!(entry["hashes"], serde_json::json!([format!("sha256:{}", sha256())])); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK); +} + +#[tokio::test] +#[serial] +async fn stale_pipfile_lock_does_not_veto_the_requirements_redirect() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + // The Pipfile.lock left behind pins a DIFFERENT package; the project + // installs from requirements.txt. + let stale = LOCK.replace("\"urllib3\"", "\"six\"").replace("==1.26.18", "==1.16.0"); + std::fs::write(tmp.path().join("Pipfile.lock"), &stale).unwrap(); + std::fs::write(tmp.path().join("requirements.txt"), "urllib3==1.26.18\n").unwrap(); + + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + let requirements = read(&tmp.path().join("requirements.txt")); + assert!( + requirements.contains(HOSTED_URL), + "requirements.txt must be redirected past a stale Pipfile.lock: {requirements}" + ); + assert_eq!(read(&tmp.path().join("Pipfile.lock")), stale, "the stale lock is left alone"); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&tmp.path().join("requirements.txt")), "urllib3==1.26.18\n"); + assert_eq!(read(&tmp.path().join("Pipfile.lock")), stale); +} + +#[tokio::test] +#[serial] +async fn warm_venv_with_the_upstream_release_is_not_attested() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project_with_upstream_install(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + let vex_path = tmp.path().join("out.vex.json"); + + // The lock is rewritten, but the installed release is the UPSTREAM one + // Pipenv will not reinstall: the stale purl is kept out of the same-run + // attestation (`redirect_pypi_stale_install`), so nothing can be + // attested and the embedded-VEX contract fails the command. + let code = run(hosted_args(tmp.path(), server.uri(), Some(&vex_path))).await; + let redirected = read(&lock_path); + assert!(redirected.contains(HOSTED_URL), "the lock is still repointed: {redirected}"); + let attested = vex_path + .exists() + .then(|| serde_json::from_str::(&read(&vex_path)).unwrap()) + .and_then(|v| v["statements"].as_array().map(Vec::len)) + .unwrap_or(0); + assert_eq!(attested, 0, "a stale install must not be attested from the ledger"); + assert_ne!(code, 0, "nothing to attest fails the embedded-VEX run"); + assert_eq!( + std::fs::read(site_packages(tmp.path()).join("urllib3").join("response.py")).unwrap(), + UPSTREAM, + "the probe is read-only" + ); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK); +} diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs index f59c6822..df675e8c 100644 --- a/crates/socket-patch-core/src/crawlers/python_crawler.rs +++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs @@ -275,6 +275,16 @@ pub async fn find_local_venv_site_packages(cwd: &Path) -> Vec { results.extend(find_poetry_virtualenv_site_packages(cwd).await); } + // 4. Pipenv keeps its virtualenv OUTSIDE the project by default + // (`$WORKON_HOME/-`), so a plain `pipenv install` leaves + // nothing above to find and the crawl used to fall through to the global + // interpreter's site-packages — patching the wrong Python (or nothing) + // and reporting success. Measured on real Pipenv 11.10.4, 2018.11.26 and + // 2026.8.0. + if results.is_empty() { + results.extend(find_pipenv_virtualenv_site_packages(cwd).await); + } + results } @@ -584,6 +594,371 @@ pub async fn find_poetry_virtualenv_site_packages(cwd: &Path) -> Vec { results } +/// `site-packages` of the virtualenv Pipenv would use for the project at +/// `cwd` when it is not in-project: the `.venv` FILE pointer (a path relative +/// to the project or a name under `WORKON_HOME`), `PIPENV_CUSTOM_VENV_NAME`, +/// or Pipenv's derived name `-<8-char hash>` with any +/// `-` suffix. Empty for non-Pipenv projects and whenever the +/// placement cannot be resolved. Read-only: nothing is executed, no `pipenv` +/// binary is needed. +pub async fn find_pipenv_virtualenv_site_packages(cwd: &Path) -> Vec { + let var = |name: &str| std::env::var(name).ok(); + find_pipenv_virtualenv_site_packages_with(cwd, &var).await +} + +/// [`find_pipenv_virtualenv_site_packages`] over an explicit environment +/// (tests pass a closure instead of mutating the process environment). +async fn find_pipenv_virtualenv_site_packages_with( + cwd: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec { + let is_file = |leaf: &str| cwd.join(leaf).is_file(); + if !is_file("Pipfile") && !is_file("Pipfile.lock") { + return Vec::new(); + } + let mut venvs: Vec = Vec::new(); + // A `.venv` FILE names the virtualenv (Pipenv 2018+): a path (contains a + // separator) is relative to the project, anything else is a directory + // name under WORKON_HOME; an empty file means the default placement. + let dot_venv = cwd.join(".venv"); + if dot_venv.is_file() { + if let Ok(text) = std::fs::read_to_string(&dot_venv) { + let name = text.trim(); + if !name.is_empty() { + if name.contains('/') || name.contains('\\') { + venvs.push(cwd.join(name)); + } else if let Some(home) = pipenv_workon_home(var) { + venvs.push(home.join(name)); + } + } + } + } + if venvs.is_empty() { + if let Some(home) = pipenv_workon_home(var) { + venvs.extend(pipenv_workon_home_venvs(cwd, &home, var)); + } + } + let mut results = Vec::new(); + for venv in venvs { + let direct = find_site_packages_under(&venv, "site-packages").await; + if !direct.is_empty() { + results.extend(direct); + continue; + } + // Pipenv 2018–2021 append the FULL `PIPENV_PYTHON` string to the + // name (`--/usr/bin/python3`), so the virtualenv lives at + // the bottom of a directory chain under WORKON_HOME; 2022+ append the + // basename. Walk the chain down to the first directory that holds a + // site-packages (bounded, never following symlinks). + results.extend(find_nested_venv_site_packages(&venv, 12).await); + } + results +} + +/// The site-packages of the virtualenv(s) at the bottom of a directory +/// chain rooted at `dir` (see the caller): every directory that itself holds +/// a `site-packages` stops the descent there, and the depth is bounded. +async fn find_nested_venv_site_packages(dir: &Path, depth: usize) -> Vec { + if depth == 0 { + return Vec::new(); + } + let mut results = Vec::new(); + let Ok(mut entries) = tokio::fs::read_dir(dir).await else { + return results; + }; + let mut children = Vec::new(); + while let Ok(Some(entry)) = entries.next_entry().await { + let Ok(kind) = entry.file_type().await else { + continue; + }; + if !kind.is_dir() { + continue; + } + // No name-based pruning: the chain literally contains `bin/python` + // when PIPENV_PYTHON pointed at an interpreter, and the descent stops + // at the first directory that holds a site-packages anyway. + children.push(entry.path()); + } + children.sort(); + for child in children { + let here = find_site_packages_under(&child, "site-packages").await; + if !here.is_empty() { + results.extend(here); + } else { + results.extend(Box::pin(find_nested_venv_site_packages(&child, depth - 1)).await); + } + } + results +} + +/// Pipenv's `WORKON_HOME`: the environment variable (with `~`, `$VAR`, +/// `${VAR}` and, on Windows, `%VAR%` expanded the way Pipenv's +/// `expandvars`/`expanduser` do), else `$XDG_DATA_HOME/virtualenvs` or +/// `~/.local/share/virtualenvs` (POSIX) / `~/.virtualenvs` (Windows) — +/// unchanged from the pew era (Pipenv 7) through 2026. +fn pipenv_workon_home(var: &impl Fn(&str) -> Option) -> Option { + if let Some(raw) = var("WORKON_HOME").filter(|v| !v.trim().is_empty()) { + return Some(pipenv_expand_path(raw.trim(), var)); + } + let home = pipenv_home_dir(var)?; + if cfg!(windows) { + return Some(home.join(".virtualenvs")); + } + let data_home = var("XDG_DATA_HOME") + .filter(|v| !v.trim().is_empty()) + .map(|v| pipenv_expand_path(v.trim(), var)) + .unwrap_or_else(|| home.join(".local").join("share")); + Some(data_home.join("virtualenvs")) +} + +/// `os.path.expanduser("~")` as Pipenv's Python sees it: `USERPROFILE` (then +/// `HOMEDRIVE`+`HOMEPATH`) on Windows — Python 3.8+ ignores `HOME` there, so a +/// Git-Bash `HOME=/c/Users/u` must not win — and `HOME` elsewhere. +fn pipenv_home_dir(var: &impl Fn(&str) -> Option) -> Option { + let non_empty = |v: String| (!v.trim().is_empty()).then_some(v); + if cfg!(windows) { + var("USERPROFILE") + .and_then(non_empty) + .or_else(|| { + let drive = var("HOMEDRIVE").and_then(non_empty)?; + let path = var("HOMEPATH").and_then(non_empty)?; + Some(format!("{drive}{path}")) + }) + .or_else(|| var("HOME").and_then(non_empty)) + .map(PathBuf::from) + } else { + var("HOME").and_then(non_empty).map(PathBuf::from) + } +} + +/// `os.path.expanduser(os.path.expandvars(raw))`: `$NAME` / `${NAME}` (and +/// `%NAME%` on Windows) from the environment — unknown names stay as written, +/// like Python — then a leading `~` from the home directory. +fn pipenv_expand_path(raw: &str, var: &impl Fn(&str) -> Option) -> PathBuf { + let chars: Vec = raw.chars().collect(); + let mut out = String::new(); + let mut i = 0; + while i < chars.len() { + let c = chars[i]; + if c == '$' { + if chars.get(i + 1) == Some(&'{') { + if let Some(end) = chars[i + 2..].iter().position(|&ch| ch == '}') { + let name: String = chars[i + 2..i + 2 + end].iter().collect(); + match var(&name) { + Some(v) => out.push_str(&v), + None => out.push_str(&format!("${{{name}}}")), + } + i += end + 3; + continue; + } + } + let start = i + 1; + let mut end = start; + while end < chars.len() && (chars[end].is_ascii_alphanumeric() || chars[end] == '_') { + end += 1; + } + if end > start { + let name: String = chars[start..end].iter().collect(); + match var(&name) { + Some(v) => out.push_str(&v), + None => { + out.push('$'); + out.push_str(&name); + } + } + i = end; + continue; + } + } else if c == '%' && cfg!(windows) { + if let Some(end) = chars[i + 1..].iter().position(|&ch| ch == '%') { + let name: String = chars[i + 1..i + 1 + end].iter().collect(); + if !name.is_empty() { + match var(&name) { + Some(v) => out.push_str(&v), + None => out.push_str(&format!("%{name}%")), + } + i += end + 2; + continue; + } + } + } + out.push(c); + i += 1; + } + if out == "~" { + if let Some(home) = pipenv_home_dir(var) { + return home; + } + } + if let Some(rest) = out.strip_prefix("~/").or_else(|| out.strip_prefix("~\\")) { + if let Some(home) = pipenv_home_dir(var) { + return home.join(rest); + } + } + PathBuf::from(out) +} + +/// `Project._sanitize`: shell-hostile characters become `_` and the name is +/// cut to 42 characters. Pipenv 2022+ also replaces `& ( ) [ ]` (`wide`); +/// both spellings are tried so a virtualenv created by either generation is +/// found. +fn pipenv_sanitize(name: &str, wide: bool) -> String { + name.chars() + .map(|c| { + let narrow = matches!( + c, + ' ' | '$' | '`' | '!' | '*' | '@' | '"' | '\\' | '\r' | '\n' | '\t' + ); + let extra = wide && matches!(c, '&' | '(' | ')' | '[' | ']'); + if narrow || extra { + '_' + } else { + c + } + }) + .take(42) + .collect() +} + +/// The 8-character virtualenv suffix — `Project._get_virtualenv_hash`: the +/// first 6 bytes of `sha256(pipfile_location)`, URL-safe base64. Stable from +/// Pipenv 7 through 2026 and pinned by known-answer vectors in the tests. +fn pipenv_venv_hash(pipfile_location: &str) -> String { + use base64::Engine as _; + use sha2::{Digest, Sha256}; + + let digest = Sha256::digest(pipfile_location.as_bytes()); + base64::engine::general_purpose::URL_SAFE.encode(&digest[..6]) +} + +/// The path string Pipenv hashes: on Windows the verbatim `\\?\` prefix is +/// dropped and the drive letter upper-cased (`normalize_drive`); elsewhere +/// the path as displayed. +fn pipenv_path_string(path: &Path) -> String { + let mut text = path.to_string_lossy().into_owned(); + if cfg!(windows) { + if let Some(rest) = text.strip_prefix(r"\\?\UNC\") { + text = format!(r"\\{rest}"); + } else if let Some(rest) = text.strip_prefix(r"\\?\") { + text = rest.to_string(); + } + let mut chars: Vec = text.chars().collect(); + if chars.len() >= 2 && chars[1] == ':' && chars[0].is_ascii_lowercase() { + chars[0] = chars[0].to_ascii_uppercase(); + text = chars.into_iter().collect(); + } + } + text +} + +/// `(project name, Pipfile location)` pairs Pipenv may have derived the +/// virtualenv name from, most likely first: `PIPENV_PIPFILE` as given (made +/// absolute), the Pipfile under the symlink-resolved project directory +/// (`find_pipfile` walks `Path.cwd().resolve()` — the physical path), then +/// the lexical absolute path. +fn pipenv_project_identities( + cwd: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec<(String, String)> { + let mut out: Vec<(String, String)> = Vec::new(); + let mut push = |pipfile: PathBuf| { + let name = pipfile + .parent() + .and_then(Path::file_name) + .map(|n| n.to_string_lossy().into_owned()); + let Some(name) = name else { + return; + }; + let location = pipenv_path_string(&pipfile); + if !out.iter().any(|(_, l)| l == &location) { + out.push((name, location)); + } + }; + if let Some(explicit) = var("PIPENV_PIPFILE").filter(|v| !v.trim().is_empty()) { + let p = PathBuf::from(explicit.trim()); + push(if p.is_absolute() { p } else { cwd.join(p) }); + } + if let Ok(real) = std::fs::canonicalize(cwd) { + push(real.join("Pipfile")); + } + let lexical = if cwd.is_absolute() { + cwd.to_path_buf() + } else { + std::path::absolute(cwd).unwrap_or_else(|_| cwd.to_path_buf()) + }; + push(lexical.join("Pipfile")); + out +} + +/// Every directory under `workon_home` that Pipenv could have created for the +/// project at `cwd`: `PIPENV_CUSTOM_VENV_NAME` verbatim, else +/// `-` optionally followed by `-` +/// (matched as a `-` suffix rather than reproduced — the suffix's spelling +/// changed across releases), plus Pipenv's case-insensitive-filesystem +/// fallback (a same-name-different-case directory whose hash was computed +/// over the recased location). Sorted; never follows the entries. +fn pipenv_workon_home_venvs( + cwd: &Path, + workon_home: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec { + if let Some(custom) = var("PIPENV_CUSTOM_VENV_NAME").filter(|v| !v.trim().is_empty()) { + return vec![workon_home.join(custom.trim())]; + } + let identities = pipenv_project_identities(cwd, var); + if identities.is_empty() { + return Vec::new(); + } + let mut exact: Vec = Vec::new(); + for (name, location) in &identities { + let hash = pipenv_venv_hash(location); + for wide in [true, false] { + let candidate = format!("{}-{hash}", pipenv_sanitize(name, wide)); + if !exact.contains(&candidate) { + exact.push(candidate); + } + } + } + let Ok(entries) = std::fs::read_dir(workon_home) else { + return Vec::new(); + }; + let mut found: Vec = Vec::new(); + for entry in entries.flatten() { + let file_name = entry.file_name(); + let Some(leaf) = file_name.to_str() else { + continue; + }; + let direct = exact + .iter() + .any(|c| leaf == c || leaf.strip_prefix(c.as_str()).is_some_and(|rest| rest.starts_with('-'))); + if direct { + found.push(entry.path()); + continue; + } + // Case-insensitive fallback: `-` where the hash was + // computed over the location with the recased name spliced in. + let Some((env_name, hash)) = leaf.rsplit_once('-') else { + continue; + }; + if hash.len() != 8 { + continue; + } + for (name, location) in &identities { + let sanitized = pipenv_sanitize(name, true); + if env_name.eq_ignore_ascii_case(&sanitized) + && env_name != sanitized + && pipenv_venv_hash(&location.replace(name.as_str(), env_name)) == hash + { + found.push(entry.path()); + break; + } + } + } + found.sort(); + found.dedup(); + found +} + /// Get global/system Python `site-packages` directories. /// /// Queries `python3` for site-packages paths, then checks well-known system @@ -1056,6 +1431,274 @@ mod tests { use super::*; use crate::utils::purl::parse_pypi_purl; + // ── Pipenv out-of-tree virtualenv discovery ───────────────────────────── + + /// Known-answer vectors computed with Pipenv's own algorithm + /// (`base64.urlsafe_b64encode(hashlib.sha256(location.encode()).digest()[:6])`). + #[test] + fn pipenv_venv_hash_matches_pipenv_get_virtualenv_hash() { + assert_eq!(pipenv_venv_hash("/tmp/proj/Pipfile"), "9zRXrcHj"); + assert_eq!(pipenv_venv_hash("/Users/dev/My App/Pipfile"), "OhBEiq15"); + assert_eq!(pipenv_venv_hash(r"C:\Users\dev\app\Pipfile"), "6E88tlV3"); + } + + #[test] + fn pipenv_sanitize_replaces_shell_hostile_characters_and_caps_at_42() { + assert_eq!(pipenv_sanitize("My App", true), "My_App"); + assert_eq!(pipenv_sanitize("a(b)[c]&d", true), "a_b__c__d"); + assert_eq!(pipenv_sanitize("a(b)[c]&d", false), "a(b)[c]&d"); + assert_eq!(pipenv_sanitize("we$ird`na!me*@\"x\\", false), "we_ird_na_me___x_"); + let long = "p".repeat(60); + assert_eq!(pipenv_sanitize(&long, true).chars().count(), 42); + // Case is preserved (Pipenv does not lowercase the project name). + assert_eq!(pipenv_sanitize("MixedCase", true), "MixedCase"); + } + + #[test] + fn pipenv_expand_path_expands_variables_and_home_like_python() { + let var = |name: &str| match name { + "HOME" => Some("/home/u".to_string()), + "X" => Some("/x".to_string()), + _ => None, + }; + assert_eq!(pipenv_expand_path("$X/venvs", &var), PathBuf::from("/x/venvs")); + assert_eq!(pipenv_expand_path("${X}/v", &var), PathBuf::from("/x/v")); + assert_eq!(pipenv_expand_path("~/w", &var), PathBuf::from("/home/u/w")); + assert_eq!(pipenv_expand_path("~", &var), PathBuf::from("/home/u")); + assert_eq!( + pipenv_expand_path("$UNSET/v", &var), + PathBuf::from("$UNSET/v"), + "unknown names stay as written" + ); + assert_eq!(pipenv_expand_path("/plain", &var), PathBuf::from("/plain")); + } + + #[test] + fn pipenv_workon_home_honours_env_then_xdg_then_default() { + let with = |workon: Option<&str>, xdg: Option<&str>| { + let workon = workon.map(str::to_string); + let xdg = xdg.map(str::to_string); + let var = move |name: &str| match name { + "HOME" | "USERPROFILE" => Some("/home/u".to_string()), + "WORKON_HOME" => workon.clone(), + "XDG_DATA_HOME" => xdg.clone(), + _ => None, + }; + pipenv_workon_home(&var) + }; + assert_eq!(with(Some("~/envs"), None), Some(PathBuf::from("/home/u/envs"))); + if cfg!(windows) { + assert_eq!(with(None, None), Some(PathBuf::from("/home/u").join(".virtualenvs"))); + // USERPROFILE wins over a Git-Bash style HOME, like Python's expanduser. + let var = |name: &str| match name { + "HOME" => Some("/c/Users/u".to_string()), + "USERPROFILE" => Some(r"C:\Users\u".to_string()), + _ => None, + }; + assert_eq!(pipenv_workon_home(&var), Some(PathBuf::from(r"C:\Users\u").join(".virtualenvs"))); + } else { + assert_eq!( + with(None, None), + Some(PathBuf::from("/home/u/.local/share/virtualenvs")) + ); + assert_eq!(with(None, Some("/data")), Some(PathBuf::from("/data/virtualenvs"))); + } + assert_eq!(with(Some(" "), None).is_some(), true, "blank WORKON_HOME falls through"); + let no_home = |_: &str| None::; + assert_eq!(pipenv_workon_home(&no_home), None); + } + + /// Lay a fake virtualenv at `workon_home/` and return its + /// site-packages (platform layout). + fn fake_venv(workon_home: &Path, leaf: &str) -> PathBuf { + let site = if cfg!(windows) { + workon_home.join(leaf).join("Lib").join("site-packages") + } else { + workon_home + .join(leaf) + .join("lib") + .join("python3.12") + .join("site-packages") + }; + std::fs::create_dir_all(&site).unwrap(); + site + } + + /// The end-to-end shape: a Pipenv project with NO in-project venv and + /// Pipenv's default out-of-tree placement under WORKON_HOME is found by + /// name+hash (with and without the `-` suffix), while a + /// sibling with another hash, a non-Pipenv project, and a project whose + /// WORKON_HOME is empty all stay invisible. + #[tokio::test] + async fn pipenv_out_of_tree_virtualenv_is_discovered_by_name_and_hash() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("My App"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + "HOME" | "USERPROFILE" => Some("/nonexistent-home".to_string()), + _ => None, + }; + + // Pipenv hashes the Pipfile under the RESOLVED project directory. + let real = std::fs::canonicalize(&project).unwrap(); + let hash = pipenv_venv_hash(&pipenv_path_string(&real.join("Pipfile"))); + let plain = fake_venv(&workon, &format!("My_App-{hash}")); + let suffixed = fake_venv(&workon, &format!("My_App-{hash}-python3.12")); + let _other = fake_venv(&workon, "My_App-AAAAAAAA"); + let _unrelated = fake_venv(&workon, "other-BBBBBBBB"); + + let mut found = find_pipenv_virtualenv_site_packages_with(&project, &var).await; + found.sort(); + let mut want = vec![plain.clone(), suffixed.clone()]; + want.sort(); + assert_eq!(found, want, "name+hash (and the PIPENV_PYTHON-suffixed twin) only"); + + // Not a Pipenv project → nothing, even with a matching directory. + let plain_dir = tmp.path().join("plain"); + std::fs::create_dir_all(&plain_dir).unwrap(); + assert!(find_pipenv_virtualenv_site_packages_with(&plain_dir, &var) + .await + .is_empty()); + + // The lock alone marks a Pipenv project (fresh checkouts often + // commit both, but a lock-only clone must still resolve). + std::fs::remove_file(project.join("Pipfile")).unwrap(); + std::fs::write(project.join("Pipfile.lock"), "{}").unwrap(); + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var) + .await + .len(), + 2 + ); + + // Unresolvable WORKON_HOME (no env, no home) → nothing. + let no_env = |_: &str| None::; + assert!(find_pipenv_virtualenv_site_packages_with(&project, &no_env) + .await + .is_empty()); + } + + /// The crawler's public entry point wires step 3 in: with no VIRTUAL_ENV + /// and no in-project venv, `find_local_venv_site_packages` returns the + /// out-of-tree Pipenv venv instead of nothing (which used to trigger the + /// global fallback). + /// Pipenv 2018–2021 with an absolute PIPENV_PYTHON append the whole + /// interpreter path to the venv name, so the virtualenv sits at the + /// bottom of `/--///`; the crawler must + /// walk down to it. + #[tokio::test] + async fn pipenv_nested_interpreter_suffix_venv_is_discovered() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("project"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let real = std::fs::canonicalize(&project).unwrap(); + let hash = pipenv_venv_hash(&pipenv_path_string(&real.join("Pipfile"))); + let nested = fake_venv( + &workon, + &format!("project-{hash}-/opt/tools/2018.11.26/bin/python"), + ); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![nested] + ); + } + + #[tokio::test] + async fn pipenv_custom_name_and_dot_venv_file_pointer_are_honoured() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("svc"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let workon_str = workon.to_string_lossy().into_owned(); + + // PIPENV_CUSTOM_VENV_NAME wins over the derived name. + let custom = fake_venv(&workon, "my-custom-env"); + let w = workon_str.clone(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(w.clone()), + "PIPENV_CUSTOM_VENV_NAME" => Some("my-custom-env".to_string()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![custom] + ); + + // A `.venv` FILE naming a WORKON_HOME directory. + let named = fake_venv(&workon, "named-env"); + std::fs::write(project.join(".venv"), "named-env\n").unwrap(); + let w = workon_str.clone(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(w.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![named] + ); + + // A `.venv` FILE holding a project-relative path. + let rel = fake_venv(&project, "envs/here"); + std::fs::write(project.join(".venv"), "envs/here").unwrap(); + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![rel] + ); + } + + #[tokio::test] + async fn pipenv_case_insensitive_fallback_matches_recased_directory() { + // Pipenv on a case-insensitive filesystem reuses `-` + // where the hash was computed over the location with the recased + // name spliced in (`_get_virtualenv_hash`'s fallback loop). + let tmp = tempfile::tempdir().unwrap(); + // Pipenv's fallback (mirrored here) splits the directory name at its + // LAST dash, so a hash that contains a dash is invisible to Pipenv + // itself; pick a project name whose recased hash has none. + let (project, recased_hash) = (0..64) + .map(|i| { + let project = tmp.path().join(format!("proj{i}")); + std::fs::create_dir_all(&project).unwrap(); + let real = std::fs::canonicalize(&project).unwrap(); + let location = pipenv_path_string(&real.join("Pipfile")); + let recased = location.replace(&format!("proj{i}"), &format!("Proj{i}")); + (project, pipenv_venv_hash(&recased)) + }) + .find(|(_, hash)| !hash.contains('-')) + .expect("some project name yields a dash-free hash"); + let name = project.file_name().unwrap().to_string_lossy().into_owned(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let recased_name = name.replacen("proj", "Proj", 1); + let recased = fake_venv(&workon, &format!("{recased_name}-{recased_hash}")); + let _wrong = fake_venv(&workon, &format!("{recased_name}-CCCCCCCC")); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![recased] + ); + } + #[cfg(unix)] #[tokio::test] async fn hatch_discovery_does_not_block_on_fifo_configuration() { diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs index 2805012e..f4961682 100644 --- a/crates/socket-patch-core/src/patch/redirect/mod.rs +++ b/crates/socket-patch-core/src/patch/redirect/mod.rs @@ -24,6 +24,7 @@ use crate::crawlers::composer_crawler::normalize_version; use crate::vendor::yarn_berry_lock::yarnrc_compression_level; pub mod golang_local; +mod pipenv; mod pnpm; mod poetry; mod replay; @@ -172,6 +173,8 @@ pub struct RewriteResult { /// presence in rewritten files (a `[registries.…]` config block alone /// pins nothing). pub confirmed_cargo_uuids: std::collections::BTreeSet, + pub confirmed_pipenv_uuids: std::collections::BTreeSet, + pub refused_pipenv_uuids: std::collections::BTreeSet, /// An incomplete pnpm rewrite must not be confirmed by finding its URL /// in another instance, a comment, or another lockfile. pub refused_pnpm_uuids: std::collections::BTreeSet, @@ -213,8 +216,38 @@ pub fn rewrite_registry_redirect_with_python_metadata( files: &BTreeMap, overrides: &[DepOverride], python_metadata: &BTreeMap, +) -> RewriteResult { + rewrite_registry_redirect_with_pipenv_version(files, overrides, python_metadata, None) +} + +/// Whether any pypi override targets an entry of `files["Pipfile.lock"]` — +/// callers use it to decide whether probing the installed Pipenv release is +/// worth a subprocess and whether its absence deserves a warning. +pub fn pipenv_lock_targets(files: &BTreeMap, overrides: &[DepOverride]) -> bool { + pipenv::lock_targets(files, overrides) +} + +/// Whether a live Pipfile.lock entry is the one Socket wrote, re-serialized by +/// a Pipenv relock (same `file`/`path` reference; only `hashes`/`version`/ +/// `index` may differ). Shared with the vendored backend's revert. +pub fn pipenv_reserialized_around_reference(live: &serde_json::Value, ours: &serde_json::Value) -> bool { + pipenv::reserialized_around_reference(live, ours) +} + +pub fn rewrite_registry_redirect_with_pipenv_version( + files: &BTreeMap, + overrides: &[DepOverride], + python_metadata: &BTreeMap, + pipenv_major: Option, ) -> RewriteResult { let mut result = RewriteResult::default(); + pipenv::rewrite(files, overrides, pipenv_major, &mut result); + let overrides: Vec<_> = overrides + .iter() + .filter(|dep| !result.refused_pipenv_uuids.contains(&dep.patch_uuid)) + .cloned() + .collect(); + let overrides = overrides.as_slice(); rewrite_npm_lock(files, overrides, &mut result); rewrite_pnpm_lock(files, overrides, &mut result); rewrite_yarn_classic(files, overrides, &mut result); diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs new file mode 100644 index 00000000..960de90d --- /dev/null +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -0,0 +1,933 @@ +use std::collections::{BTreeMap, BTreeSet}; +use std::ops::Range; + +use serde::Serialize; +use serde_json::{json, Value}; + +use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning}; +use crate::crawlers::python_crawler::canonicalize_pypi_name; + +struct Property { + name: String, + range: Range, + value: Value, +} + +fn properties(text: &str, offset: usize) -> Result, String> { + let mut index = offset + 1; + let mut names = BTreeSet::new(); + let mut result = Vec::new(); + loop { + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + if text.as_bytes().get(index) == Some(&b'}') { + return Ok(result); + } + let mut keys = serde_json::Deserializer::from_str(&text[index..]).into_iter::(); + let name = keys + .next() + .ok_or("missing JSON key")? + .map_err(|e| e.to_string())?; + if !names.insert(name.clone()) { + return Err("duplicate JSON key".into()); + } + index += keys.byte_offset(); + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + if text.as_bytes().get(index) != Some(&b':') { + return Err("missing JSON colon".into()); + } + index += 1; + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + let start = index; + let mut values = serde_json::Deserializer::from_str(&text[index..]).into_iter::(); + let value = values + .next() + .ok_or("missing JSON value")? + .map_err(|e| e.to_string())?; + index += values.byte_offset(); + result.push(Property { + name, + range: start..index, + value, + }); + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + match text.as_bytes().get(index) { + Some(b',') => index += 1, + Some(b'}') => return Ok(result), + _ => return Err("invalid JSON object".into()), + } + } +} + +fn entries(text: &str) -> Result, String> { + // A UTF-8 BOM (Windows editors) is not JSON; parse past it. Offsets + // below come from `text.find('{')`, so they stay byte-accurate. + let value: Value = serde_json::from_str(text.trim_start_matches('\u{feff}')) + .map_err(|e| e.to_string())?; + if !value.is_object() { + return Err("Pipfile.lock is not an object".into()); + } + if value.pointer("/_meta/pipfile-spec").and_then(Value::as_u64) != Some(6) { + return Err("only pipfile-spec 6 supports patch file references".into()); + } + let mut result = Vec::new(); + for section in properties(text, text.find('{').ok_or("missing root")?)? { + if section.name == "_meta" { + continue; + } + if !section.value.is_object() { + return Err(format!("{} is not a category object", section.name)); + } + for entry in properties(text, section.range.start)? { + if entry.value.is_object() { + properties(text, entry.range.start)?; + } + result.push((section.name.clone(), entry)); + } + } + Ok(result) +} + +fn format_entry(value: &Value, text: &str, start: usize) -> Result { + let mut bytes = Vec::new(); + let formatter = serde_json::ser::PrettyFormatter::with_indent(b" "); + value + .serialize(&mut serde_json::Serializer::with_formatter( + &mut bytes, formatter, + )) + .map_err(|e| e.to_string())?; + let formatted = String::from_utf8(bytes).map_err(|e| e.to_string())?; + let line_start = text[..start].rfind('\n').map_or(0, |i| i + 1); + let indent: String = text[line_start..start] + .chars() + .take_while(|c| *c == ' ' || *c == '\t') + .collect(); + let ending = if text.contains("\r\n") { "\r\n" } else { "\n" }; + Ok(formatted.replace('\n', &format!("{ending}{indent}"))) +} + +/// Whether `live` is `ours` as Pipenv itself re-serializes it: the same +/// `file`/`path` reference string (it carries the uuid and the `#sha256=` +/// pin, so an identical string is positive evidence the entry is the redirect +/// we wrote) with only the fields a relock rewrites — `hashes`, `version`, +/// `index` — allowed to differ. Pipenv 2023+ relocks an entry excluded by its +/// marker by keeping our reference and restoring the registry `hashes` and +/// `version`; `--keep-outdated` re-adds `version`/`index`. Anything else that +/// changed (a marker, an extra, the reference itself) is a hand edit or a +/// foreign source: drift. +pub(super) fn reserialized_around_reference(live: &Value, ours: &Value) -> bool { + let (Some(live), Some(ours)) = (live.as_object(), ours.as_object()) else { + return false; + }; + let reference = |object: &serde_json::Map| { + object + .get("file") + .or_else(|| object.get("path")) + .and_then(Value::as_str) + .map(str::to_owned) + }; + let Some(our_reference) = reference(ours) else { + return false; + }; + if reference(live) != Some(our_reference) { + return false; + } + const RELOCK_REWRITES: [&str; 5] = ["hashes", "version", "index", "file", "path"]; + live.keys() + .chain(ours.keys()) + .filter(|key| !RELOCK_REWRITES.contains(&key.as_str())) + .all(|key| live.get(key) == ours.get(key)) +} + +pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { + if edit.path != "Pipfile.lock" { + return Err("Pipenv edit must target Pipfile.lock".into()); + } + let [section, name]: [String; 2] = + serde_json::from_str(edit.key.as_deref().ok_or("missing Pipenv key")?) + .map_err(|e| e.to_string())?; + let original = edit + .original + .as_ref() + .and_then(Value::as_str) + .ok_or("missing Pipenv original")?; + // The ledger is committed and tamper-able: only a JSON object may be + // spliced back into the lock (never arbitrary text that would corrupt + // it or smuggle in extra entries). + if !serde_json::from_str::(original).is_ok_and(|value| value.is_object()) { + return Err("Pipenv original is not a JSON object".into()); + } + let new = edit + .new + .as_ref() + .and_then(Value::as_str) + .ok_or("missing Pipenv replacement")?; + let Some((_, entry)) = entries(text)? + .into_iter() + .find(|(category, entry)| category == §ion && entry.name == name) + else { + // A relock that DROPPED the entry (`pipenv uninstall `, a Pipfile + // edit + `pipenv lock`): the redirect is gone with it — nothing to + // unwind, the edit retires. + return Ok(text.into()); + }; + let live = &text[entry.range.clone()]; + let ending = if text.contains("\r\n") { "\r\n" } else { "\n" }; + let original_value: Value = serde_json::from_str(original).map_err(|e| e.to_string())?; + let new_value: Option = serde_json::from_str(new).ok(); + // Comparisons are SEMANTIC (parsed JSON), so a line-ending conversion of + // the whole file (git autocrlf, a cross-OS checkout) or a re-serialization + // that only moved whitespace is neither drift nor a reason to refuse. + if live == original || entry.value == original_value { + return Ok(text.into()); + } + // "Still ours": Pipenv re-serialized the entry around the very reference + // we wrote (see [`reserialized_around_reference`]). + let same_reference = new_value + .as_ref() + .is_some_and(|new_value| reserialized_around_reference(&entry.value, new_value)); + if live != new && new_value.as_ref() != Some(&entry.value) && !same_reference { + // A relock (`pipenv lock`, `pipenv update`, `pipenv install ` + // on <= 2023) regenerates the entry to registry shape: the redirect + // is already gone and the user's fresh resolution is the desired end + // state, so the edit is retired instead of holding every pypi revert + // hostage forever. A DIFFERENT `file`/`path` reference (a user's own + // source, a hand edit) is real drift and still refuses. + let registry_shaped = entry + .value + .as_object() + .is_some_and(|object| !object.contains_key("file") && !object.contains_key("path")); + if registry_shaped { + return Ok(text.into()); + } + return Err(format!("Pipenv entry {section}.{name} drifted")); + } + // Still our reference (byte-identical, re-serialized by Pipenv, or a + // `--keep-outdated` hybrid that kept our `file`/`path`): splice the + // recorded original back, in the live file's line ending. + let restored = if ending == "\r\n" { + original.replace("\r\n", "\n").replace('\n', "\r\n") + } else { + original.replace("\r\n", "\n") + }; + let mut result = text.to_owned(); + result.replace_range(entry.range, &restored); + Ok(result) +} + +/// Whether any pypi override names a package this `Pipfile.lock` pins — the +/// cheap pre-check that decides whether the installer probe +/// (`pipenv --version`, up to 10 s) is worth running and whether its +/// absence is worth a warning. An absent or unparseable lock targets nothing. +pub(super) fn lock_targets(files: &BTreeMap, overrides: &[DepOverride]) -> bool { + let Some(text) = files.get("Pipfile.lock") else { + return false; + }; + let Ok(entries) = entries(text) else { + return false; + }; + overrides + .iter() + .filter(|dep| dep.ecosystem == "pypi") + .any(|dep| { + let wanted = canonicalize_pypi_name(&dep.name); + entries + .iter() + .any(|(_, entry)| canonicalize_pypi_name(&entry.name) == wanted) + }) +} + +pub(super) fn rewrite( + files: &BTreeMap, + overrides: &[DepOverride], + pipenv_major: Option, + result: &mut RewriteResult, +) { + let Some(original) = files.get("Pipfile.lock") else { + return; + }; + let mut text = original.clone(); + for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") { + let planned = plan(&text, dep, pipenv_major); + match planned { + Ok((rewritten, edits)) => { + result.confirmed_pipenv_uuids.insert(dep.patch_uuid.clone()); + text = rewritten; + result.edits.extend(edits); + } + // A CONFLICT (another version pinned, a foreign source, a VCS / + // path dependency) means the project's Pipenv install would not + // pick the patch up even if a sibling requirements.txt / uv.lock + // were repointed — so the sibling rewriters are vetoed too and + // nothing is half-redirected. Anything else (no entry for the + // package, an old pipfile-spec, an unparseable or BOM-prefixed + // lock, a patch without a digest) says nothing about the files + // the project installs from: warn and leave the siblings alone, + // or a stale Pipfile.lock left behind in a uv / Poetry / + // requirements project blocks every hosted redirect. + // …but only for a LIVE lock. A Pipfile.lock with no Pipfile + // beside it is abandoned (nothing installs from it), so even a + // conflicting pin says nothing about the project's real install + // files: refuse this file, leave the siblings alone. + Err(PlanError::Conflict(detail)) if files.contains_key("Pipfile") => { + result.refused_pipenv_uuids.insert(dep.patch_uuid.clone()); + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_refused".into(), + detail, + }); + } + Err(PlanError::Conflict(detail)) => { + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_refused".into(), + detail: format!("{detail} (no Pipfile beside the lock: the sibling Python files are still redirected)"), + }); + } + Err(PlanError::Skip(detail)) => { + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_skipped".into(), + detail, + }); + } + } + } + if &text != original { + result.files.insert("Pipfile.lock".into(), text); + } +} + +/// Whether `value` is a Socket-issued hosted reference for `dep` — served +/// from the same origin as the grant's own artifact URL (patch.socket.dev, +/// or a `--patch-server-url` host), with the `/patch/pypi/// +/// //` shape for this package and version. Such an entry +/// is ours to rotate; anything else is a user's or a fork's source. +fn owned_url(value: &str, dep: &DepOverride) -> bool { + let Ok(url) = reqwest::Url::parse(value) else { + return false; + }; + let Ok(ours) = reqwest::Url::parse(&dep.artifact_url) else { + return false; + }; + let same_origin = url.scheme() == ours.scheme() + && url.host_str() == ours.host_str() + && url.port_or_known_default() == ours.port_or_known_default(); + let parts: Vec<_> = url.path().split('/').collect(); + (same_origin || (url.scheme() == "https" && url.host_str() == Some("patch.socket.dev"))) + && url.username().is_empty() + && url.password().is_none() + && url.query().is_none() + && parts.len() == 8 + && parts[1] == "patch" + && parts[2] == "pypi" + && canonicalize_pypi_name(parts[3]) == canonicalize_pypi_name(&dep.name) + && parts[4] == dep.version + && !parts[5].is_empty() + && !parts[6].is_empty() + && parts[7].ends_with(".whl") + && parts[7] + .split('-') + .next() + .is_some_and(|name| canonicalize_pypi_name(name) == canonicalize_pypi_name(&dep.name)) + && parts[7].split('-').nth(1) == Some(dep.version.as_str()) +} + +/// Why a Pipfile.lock plan did not happen. Only a [`PlanError::Conflict`] +/// vetoes the sibling Python rewriters (see [`rewrite`]). +#[derive(Debug, Clone, PartialEq, Eq)] +pub(super) enum PlanError { + /// The lock pins another version or a non-registry / foreign source for + /// the package: the project's install cannot pick the patch up. + Conflict(String), + /// Nothing to do here (no entry, unsupported spec, unparseable lock, + /// no digest): says nothing about the project's other install files. + Skip(String), +} + +impl From for PlanError { + fn from(detail: String) -> Self { + PlanError::Skip(detail) + } +} + +impl From<&str> for PlanError { + fn from(detail: &str) -> Self { + PlanError::Skip(detail.to_owned()) + } +} + +fn plan( + text: &str, + dep: &DepOverride, + pipenv_major: Option, +) -> Result<(String, Vec), PlanError> { + let sha = dep + .integrity + .sha256 + .as_deref() + .filter(|hash| hash.len() == 64 && hash.bytes().all(|byte| byte.is_ascii_hexdigit())) + .ok_or("Pipenv patch requires a SHA-256 digest")?; + let url = format!( + "{}#sha256={sha}", + dep.artifact_url + .split('#') + .next() + .ok_or("missing artifact URL")? + ); + let targets: Vec<_> = entries(text)? + .into_iter() + .filter(|(_, entry)| { + canonicalize_pypi_name(&entry.name) == canonicalize_pypi_name(&dep.name) + }) + .collect(); + if targets.is_empty() { + return Err(PlanError::Skip(format!( + "Pipfile.lock has no entry for {}", + dep.name + ))); + } + let source_key = if pipenv_major.is_some_and(|major| (7..2018).contains(&major)) { + "path" + } else { + "file" + }; + let mut changes = Vec::new(); + for (section, entry) in targets { + let object = entry + .value + .as_object() + .ok_or("Pipenv dependency is not an object")?; + if ["git", "hg", "svn", "bzr", "editable"] + .iter() + .any(|key| object.contains_key(*key)) + || (object.contains_key("file") && object.contains_key("path")) + { + return Err(PlanError::Conflict(format!( + "Pipenv source for {} is not a registry package", + dep.name + ))); + } + if let Some(file) = object.get("file").or_else(|| object.get("path")) { + if !file.as_str().is_some_and(|value| owned_url(value, dep)) { + return Err(PlanError::Conflict(format!( + "Pipenv source for {} already exists", + dep.name + ))); + } + // Ours. A `version` Pipenv re-added next to it (`pipenv lock + // --keep-outdated`, `install --keep-outdated ` on 2022 + // write a file+version+index hybrid that still installs) must + // still name the patched release; then the entry is simply + // re-planned to the canonical shape. + if let Some(pinned) = object.get("version").and_then(Value::as_str) { + if pinned != format!("=={}", dep.version) { + return Err(PlanError::Conflict(format!( + "Pipenv version for {} does not match {}", + dep.name, dep.version + ))); + } + } + if object.get(source_key).and_then(Value::as_str) == Some(&url) + && object.get("hashes") == Some(&json!([format!("sha256:{sha}")])) + && !object.contains_key("version") + && !object.contains_key("index") + { + continue; + } + } else if object.get("version").and_then(Value::as_str) + != Some(format!("=={}", dep.version).as_str()) + { + return Err(PlanError::Conflict(format!( + "Pipenv version for {} does not match {}", + dep.name, dep.version + ))); + } + let mut new = object.clone(); + new.remove("version"); + new.remove("index"); + new.remove("file"); + new.remove("path"); + new.insert(source_key.into(), Value::String(url.clone())); + new.insert("hashes".into(), json!([format!("sha256:{sha}")])); + let mut new = Value::Object(new); + new.sort_all_objects(); + let replacement = format_entry(&new, text, entry.range.start)?; + let edit = FileEdit { + path: "Pipfile.lock".into(), + kind: "redirect_pipenv_entry".into(), + action: "rewritten".into(), + key: Some(json!([section, entry.name]).to_string()), + original: Some(Value::String(text[entry.range.clone()].into())), + new: Some(Value::String(replacement.clone())), + }; + changes.push((entry.range, replacement, edit)); + } + let mut rewritten = text.to_owned(); + let mut edits = Vec::new(); + for (range, replacement, edit) in changes.into_iter().rev() { + rewritten.replace_range(range, &replacement); + edits.push(edit); + } + Ok((rewritten, edits)) +} + +#[cfg(test)] +mod tests { + use super::*; + + pub(super) fn dependency(name: &str, version: &str, uuid: &str) -> DepOverride { + serde_json::from_value(json!({ + "ecosystem":"pypi", "name":name, "version":version, + "patchUuid":uuid,"token":"token", + "artifactUrl":format!("https://patch.socket.dev/patch/pypi/{name}/{version}/token/{uuid}/{name}-{version}-py3-none-any.whl"), + "integrity":{"sha256":"a".repeat(64)} + })).unwrap() + } + + pub(super) fn lock() -> String { + let mut value = json!({"_meta":{"pipfile-spec":6,"hash":{"sha256":"unchanged"}},"default":{"urllib3":{"version":"==1.26.18","index":"pypi","hashes":["old"],"extras":["socks"],"markers":"python_version < '4'"}},"develop":{},"tests":{"urllib3":{"version":"==1.26.18"}}}); + value.sort_all_objects(); + format_entry(&value, "{", 0).unwrap() + "\n" + } + + #[test] + fn all_categories_preserve_extras_markers_metadata_and_repeat_bytes() { + for ending in ["\n", "\r\n"] { + let original = lock().replace('\n', ending); + let dep = dependency("URLLib3", "1.26.18", "patch-one"); + let (text, edits) = plan(&original, &dep, None).unwrap(); + assert_eq!(edits.len(), 2); + let value: Value = serde_json::from_str(&text).unwrap(); + let before: Value = serde_json::from_str(&original).unwrap(); + assert_eq!(value["_meta"], before["_meta"]); + for field in ["extras", "markers"] { + assert_eq!( + value["default"]["urllib3"][field], + before["default"]["urllib3"][field] + ); + } + assert_eq!(plan(&text, &dep, None).unwrap(), (text.clone(), Vec::new())); + let mut restored = text; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + } + } + + #[test] + fn refusal_is_atomic_across_categories() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + for bad in [ + json!({"version":"==2.0"}), + json!({"version":"*"}), + json!({"file":"https://example.org/fork.whl"}), + json!({"version":"==1.26.18","git":"https://example.org/fork"}), + json!({"version":"==1.26.18","editable":false}), + json!(null), + json!({"version":"==1.26.18","path":"./fork"}), + ] { + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + let is_null = bad.is_null(); + value["tests"]["urllib3"] = bad; + let original = serde_json::to_string(&value).unwrap(); + // A live lock (Pipfile beside it): conflicts veto the siblings. + let files = BTreeMap::from([ + ("Pipfile".to_string(), "[packages]\nurllib3 = \"*\"\n".to_string()), + ("Pipfile.lock".to_string(), original), + ]); + let mut result = RewriteResult::default(); + rewrite(&files, std::slice::from_ref(&dep), None, &mut result); + assert!(result.files.is_empty()); + assert!(result.edits.is_empty()); + assert!(result.confirmed_pipenv_uuids.is_empty()); + assert_eq!(result.warnings.len(), 1); + // A pin / source CONFLICT vetoes the sibling Python rewriters; a + // malformed (non-object) entry is merely skipped. + if is_null { + assert_eq!(result.warnings[0].code, "redirect_pipenv_skipped"); + assert!(result.refused_pipenv_uuids.is_empty()); + } else { + assert_eq!(result.warnings[0].code, "redirect_pipenv_refused"); + assert!(result.refused_pipenv_uuids.contains("patch-one")); + } + } + } + + /// Only conflicts veto the sibling rewriters (Bugbot HIGH on #242): a + /// Pipfile.lock without the package, an old pipfile-spec, an unparseable + /// lock or a digest-less patch is SKIPPED with `redirect_pipenv_skipped` + /// and the requirements.txt / uv.lock rewrite still lands. + #[test] + fn non_conflict_refusals_do_not_veto_sibling_rewriters() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let stale_locks = [ + // no entry for the package at all + lock().replace("\"urllib3\"", "\"other-package\""), + // pipfile-spec 5 + lock().replace("\"pipfile-spec\": 6", "\"pipfile-spec\": 5"), + // unparseable + "{".to_owned(), + // BOM-prefixed but otherwise fine is NOT a skip: it must plan. + ]; + for stale in &stale_locks { + let files = BTreeMap::from([ + ("Pipfile.lock".to_string(), stale.clone()), + ("requirements.txt".to_string(), "urllib3==1.26.18\n".to_string()), + ]); + let result = super::super::rewrite_registry_redirect(&files, std::slice::from_ref(&dep)); + assert!( + !result.refused_pipenv_uuids.contains("patch-one"), + "a non-conflict must not veto: {stale}" + ); + assert!( + result.warnings.iter().any(|w| w.code == "redirect_pipenv_skipped"), + "{:?}", + result.warnings + ); + assert!( + result.files.get("requirements.txt").is_some_and(|t| t.contains("patch.socket.dev")), + "requirements.txt must still be redirected past a stale Pipfile.lock: {result:?}" + ); + assert!(!result.files.contains_key("Pipfile.lock")); + } + // A digest-less patch is a skip too (the other rewriters decide for + // themselves whether they need one). + let mut no_digest = dep.clone(); + no_digest.integrity.sha256 = None; + let mut result = RewriteResult::default(); + rewrite( + &BTreeMap::from([("Pipfile.lock".to_string(), lock())]), + std::slice::from_ref(&no_digest), + None, + &mut result, + ); + assert!(result.refused_pipenv_uuids.is_empty()); + assert_eq!(result.warnings[0].code, "redirect_pipenv_skipped"); + } + + #[test] + fn bom_prefixed_lock_is_rewritten_and_restored_with_the_bom_intact() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let original = format!("\u{feff}{}", lock()); + let (text, edits) = plan(&original, &dep, None).unwrap(); + assert!(text.starts_with('\u{feff}'), "the BOM is preserved"); + assert!(text.contains("patch.socket.dev")); + let mut restored = text; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + } + + #[test] + fn malformed_duplicate_and_unsupported_locks_refuse() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + for text in [ + "null".to_owned(), + "[]".into(), + "{".into(), + lock().replace("\"pipfile-spec\": 6", "\"pipfile-spec\": 5"), + lock().replace("\"default\": {", "\"default\": {}, \"default\": {"), + lock().replace( + "\"version\": \"==1.26.18\"", + "\"version\": \"==2.0\", \"version\": \"==1.26.18\"", + ), + ] { + assert!(plan(&text, &dep, None).is_err(), "{text}"); + } + let mut missing_hash = dep.clone(); + missing_hash.integrity.sha256 = None; + assert!(plan(&lock(), &missing_hash, None).is_err()); + } + + /// `pipenv lock` (and `update`, and `install ` before 2024) + /// regenerates the redirected entry to registry shape. That is the + /// desired end state of a rollback, so the edit retires cleanly instead + /// of refusing forever; a foreign `file`/`path` reference is still drift. + /// A re-scan after the relock (second edit on the same key) unwinds + /// newest-first to the relocked text. + #[test] + fn relocked_registry_entry_retires_the_edit_instead_of_refusing() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + // One category, so the relock below regenerates the ONLY redirect. + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + value.as_object_mut().unwrap().remove("tests"); + let original = format_entry(&value, "{", 0).unwrap() + "\n"; + let (redirected, edits) = plan(&original, &dep, None).unwrap(); + assert_eq!(edits.len(), 1); + let redirected_entry = edits[0].new.as_ref().unwrap().as_str().unwrap(); + let relocked_entry = format_entry( + &json!({"hashes": ["sha256:relocked"], "index": "pypi", "version": "==1.26.18"}), + &redirected, + redirected.find(redirected_entry).unwrap(), + ) + .unwrap(); + let relocked = redirected.replacen(redirected_entry, &relocked_entry, 1); + assert_eq!( + restore(&relocked, &edits[0]).unwrap(), + relocked, + "a registry-shaped entry is already unwound" + ); + let foreign = redirected.replacen( + redirected_entry, + &format_entry(&json!({"file": "https://example.org/fork.whl"}), &redirected, 0).unwrap(), + 1, + ); + assert!(restore(&foreign, &edits[0]).is_err(), "a foreign reference is drift"); + + // Re-scan after the relock, then roll back newest-first. + let (again, second) = plan(&relocked, &dep, None).unwrap(); + let mut current = again; + for edit in second.iter().chain(edits.iter()) { + current = restore(¤t, edit).unwrap(); + } + assert_eq!(current, relocked); + } + + #[test] + fn lock_targets_requires_a_matching_pin_in_a_parseable_lock() { + let dep = dependency("URLlib3", "1.26.18", "patch-one"); + let other = dependency("six", "1.16.0", "patch-two"); + let files = |text: &str| BTreeMap::from([("Pipfile.lock".to_string(), text.to_string())]); + assert!(lock_targets(&files(&lock()), std::slice::from_ref(&dep))); + assert!(!lock_targets(&files(&lock()), std::slice::from_ref(&other))); + assert!(!lock_targets(&files("{ not json"), std::slice::from_ref(&dep))); + assert!(!lock_targets(&BTreeMap::new(), std::slice::from_ref(&dep))); + let mut npm = dep.clone(); + npm.ecosystem = "npm".into(); + assert!(!lock_targets(&files(&lock()), std::slice::from_ref(&npm))); + } + + /// `pipenv lock --keep-outdated` (2022) rewrites our entry into a + /// file+version+index hybrid that Pipenv still installs from: it is + /// ours, so it is re-planned to the canonical shape instead of being + /// refused as a foreign source (which also vetoed the sibling rewriters); + /// a hybrid naming ANOTHER version is a real conflict. + #[test] + fn owned_hybrid_entries_are_replanned_not_refused() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let (redirected, _) = plan(&lock(), &dep, None).unwrap(); + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["version"] = json!("==1.26.18"); + value["default"]["urllib3"]["index"] = json!("pypi"); + let hybrid = serde_json::to_string_pretty(&value).unwrap(); + let (fixed, edits) = plan(&hybrid, &dep, None).unwrap(); + assert!(!edits.is_empty(), "the hybrid is re-planned"); + let entry: Value = serde_json::from_str(&fixed).unwrap(); + assert!(entry["default"]["urllib3"].get("version").is_none()); + assert!(entry["default"]["urllib3"].get("index").is_none()); + assert!(entry["default"]["urllib3"]["file"].as_str().unwrap().contains("patch-one")); + + value["default"]["urllib3"]["version"] = json!("==2.0.0"); + let conflicting = serde_json::to_string(&value).unwrap(); + assert!(matches!( + plan(&conflicting, &dep, None), + Err(PlanError::Conflict(detail)) if detail.contains("does not match") + )); + } + + /// The Socket origin comes from the grant's own artifact URL, so a + /// `--patch-server-url` deployment recognizes its previous references + /// (rotation, idempotency) exactly like patch.socket.dev; a fork on + /// another host is never ours. + #[test] + fn owned_url_follows_the_grant_origin() { + let mut dep = dependency("urllib3", "1.26.18", "patch-one"); + let public = "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl"; + assert!(owned_url(public, &dep)); + assert!(!owned_url("https://example.org/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl", &dep)); + dep.artifact_url = "https://patches.internal.example:8443/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl".into(); + assert!(owned_url(&dep.artifact_url, &dep), "the grant's own origin is ours"); + assert!(owned_url(public, &dep), "and so is the public service"); + assert!(!owned_url("https://patches.internal.example:8443/patch/pypi/urllib3/1.26.19/tok/patch-one/urllib3-1.26.19-py3-none-any.whl", &dep), "another version is not"); + // Rotation on the custom origin restores through the chain. + let original = lock(); + let (first, edits) = plan(&original, &dep, None).unwrap(); + dep.artifact_url = dep.artifact_url.replace("/tok/", "/rotated/"); + let (second, rotation) = plan(&first, &dep, None).unwrap(); + let mut restored = second; + for edit in rotation.iter().chain(edits.iter()) { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + } + + #[test] + fn restore_refuses_a_non_object_ledger_original() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let (text, edits) = plan(&lock(), &dep, None).unwrap(); + for bad in ["\"just a string\"", "[1, 2]", "not json at all", "{\"a\": 1}, \"injected\": {}"] { + let mut edit = edits[0].clone(); + edit.original = Some(Value::String(bad.to_string())); + assert!(restore(&text, &edit).is_err(), "{bad}"); + } + } + + #[test] + fn rollback_is_per_entry_preserves_unrelated_edits_and_refuses_drift() { + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + value["default"]["six"] = json!({"version":"==1.16.0"}); + let original = serde_json::to_string_pretty(&value).unwrap(); + let first = dependency("urllib3", "1.26.18", "patch-one"); + let second = dependency("six", "1.16.0", "patch-two"); + let (one, first_edits) = plan(&original, &first, None).unwrap(); + let (two, second_edits) = plan(&one, &second, None).unwrap(); + for first_removed in [true, false] { + let mut current = two.replace("unchanged", "unrelated-edit"); + let edits = if first_removed { + first_edits + .iter() + .chain(second_edits.iter()) + .collect::>() + } else { + second_edits.iter().chain(first_edits.iter()).collect() + }; + for edit in edits { + current = restore(¤t, edit).unwrap(); + } + assert_eq!(current, original.replace("unchanged", "unrelated-edit")); + } + for edit in &first_edits { + let replacement = edit.new.as_ref().unwrap().as_str().unwrap(); + // A tampered reference (its `#sha256=` pin) is drift… + let drift = two.replacen(replacement, &replacement.replace("#sha256=", "#sha256=0"), 1); + assert!(restore(&drift, edit).is_err()); + // …while a re-serialized entry that kept our reference (Pipenv + // 2023+ relocking a marker-excluded entry restores the registry + // `hashes` and `version` next to it) is still ours and restores. + let mut value: Value = serde_json::from_str(&two).unwrap(); + let section: &str = serde_json::from_str::<[String; 2]>(edit.key.as_deref().unwrap()).unwrap()[0].clone().leak(); + value[section]["urllib3"]["hashes"] = json!(["sha256:upstream-a", "sha256:upstream-b"]); + value[section]["urllib3"]["version"] = json!("==1.26.18"); + let kept = serde_json::to_string_pretty(&value).unwrap(); + let restored: Value = serde_json::from_str(&restore(&kept, edit).unwrap()).unwrap(); + assert!(restored[section]["urllib3"].get("file").is_none(), "{restored}"); + let mut unsafe_edit = edit.clone(); + unsafe_edit.path = "../Pipfile.lock".into(); + assert!(restore(&two, &unsafe_edit).is_err()); + } + } +} + +#[cfg(test)] +mod compatibility_tests { + use super::*; + #[test] + fn rotates_owned_grants_and_preserves_rollback_chain() { + let mut dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + for major in [Some(7), Some(11), Some(2018), Some(2026), None] { + let original = super::tests::lock(); + let (first, edits) = plan(&original, &dep, major).unwrap(); + let parsed: Value = serde_json::from_str(&first).unwrap(); + let field = if major.is_some_and(|value| value < 2018) { + "path" + } else { + "file" + }; + assert!(parsed["default"]["urllib3"][field].is_string()); + dep.artifact_url = dep.artifact_url.replace("/token/", "/rotated/"); + let (second, rotation) = plan(&first, &dep, major).unwrap(); + let mut restored = second; + for edit in rotation.iter().chain(edits.iter()) { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + dep.artifact_url = dep.artifact_url.replace("/rotated/", "/token/"); + } + } + + #[test] + fn conflicting_pipenv_pin_cannot_partially_redirect_requirements() { + let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + let files = BTreeMap::from([ + ("Pipfile".into(), "[packages]\nurllib3 = \"==2.0\"\n".into()), + ( + "Pipfile.lock".into(), + super::tests::lock().replace("==1.26.18", "==2.0"), + ), + ("requirements.txt".into(), "urllib3==1.26.18\n".into()), + ]); + let result = super::super::rewrite_registry_redirect(&files, &[dep.clone()]); + assert!(result.files.is_empty()); + assert!(result.edits.is_empty()); + assert!(result.refused_pipenv_uuids.contains("patch-one")); + + // The same conflicting lock with NO Pipfile beside it is abandoned: + // the requirements pin is what installs, so it is redirected. + let mut abandoned = files.clone(); + abandoned.remove("Pipfile"); + let result = super::super::rewrite_registry_redirect(&abandoned, &[dep]); + assert!(!result.refused_pipenv_uuids.contains("patch-one")); + assert!(result.files["requirements.txt"].contains("patch.socket.dev")); + assert!(!result.files.contains_key("Pipfile.lock")); + assert!(result.warnings.iter().any(|w| w.code == "redirect_pipenv_refused" && w.detail.contains("no Pipfile"))); + } + + /// Rollback survives what git and Pipenv do to the lock between the + /// redirect and the revert: a whole-file CRLF<->LF conversion, Pipenv + /// re-serializing our entry (a `--keep-outdated` hybrid that kept our + /// reference), and a relock that dropped the entry altogether. + #[test] + fn rollback_tolerates_line_ending_conversion_hybrids_and_dropped_entries() { + let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + let original = super::tests::lock(); + let (redirected, edits) = plan(&original, &dep, None).unwrap(); + // CRLF conversion of the redirected file → restores the original in CRLF. + let crlf = redirected.replace('\n', "\r\n"); + let mut restored = crlf; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original.replace('\n', "\r\n")); + // LF file, CRLF-recorded edits (the redirect ran on a CRLF checkout). + let crlf_original = original.replace('\n', "\r\n"); + let (crlf_redirected, crlf_edits) = plan(&crlf_original, &dep, None).unwrap(); + let mut restored = crlf_redirected.replace("\r\n", "\n"); + for edit in crlf_edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + // Hybrid: Pipenv re-added version/index next to our reference. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["version"] = json!("==1.26.18"); + value["default"]["urllib3"]["index"] = json!("pypi"); + let hybrid = serde_json::to_string_pretty(&value).unwrap(); + let default_edit = edits.iter().find(|e| e.key.as_deref() == Some(r#"["default","urllib3"]"#)).unwrap(); + let restored = restore(&hybrid, default_edit).unwrap(); + let value: Value = serde_json::from_str(&restored).unwrap(); + assert_eq!(value["default"]["urllib3"]["version"], json!("==1.26.18")); + assert!(value["default"]["urllib3"].get("file").is_none(), "{restored}"); + // Dropped entry (`pipenv uninstall`): nothing to unwind, retires. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"].as_object_mut().unwrap().remove("urllib3"); + let dropped = serde_json::to_string_pretty(&value).unwrap(); + assert_eq!(restore(&dropped, default_edit).unwrap(), dropped); + // A foreign reference is still drift. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["file"] = json!("https://example.org/fork.whl"); + let foreign = serde_json::to_string_pretty(&value).unwrap(); + assert!(restore(&foreign, default_edit).is_err()); + } +} diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs index e58bbfb4..20229a8a 100644 --- a/crates/socket-patch-core/src/patch/redirect/replay.rs +++ b/crates/socket-patch-core/src/patch/redirect/replay.rs @@ -52,6 +52,7 @@ enum Inverse { /// writers record an `original` that is a substring of `new` (the /// Cargo.toml insert variant, the maven version suffix). ReplaceFragment, + PipenvEntry, HatchDocument, /// action `added` with only `new` recorded: the redirect inserted the /// fragment into a pre-existing file, so the inverse removes it once @@ -87,6 +88,7 @@ enum Inverse { /// Gemfile.lock) revert together or not at all. fn classify(kind: &str, action: &str) -> (&'static str, Inverse) { match kind { + "redirect_pipenv_entry" => ("pypi", Inverse::PipenvEntry), "redirect_requirements_line" | "redirect_uv_lock_wheel" | "redirect_poetry_lock_package" => { ("pypi", Inverse::ReplaceFragment) } @@ -412,6 +414,31 @@ pub async fn revert_remaining_redirect_edits( refused_groups.insert(group); continue 'group; } + Inverse::PipenvEntry => { + let restored = match staged_read(&staged, project_root, &edit.path).await { + Ok(Some(content)) => { + super::pipenv::restore(&content, &edit).map(|restored| (content, restored)) + } + Ok(None) => Err(format!("{} no longer exists", edit.path)), + Err(error) => Err(error), + }; + match restored { + Ok((content, restored)) => { + // An already-unwound or retired entry returns the + // text unchanged: no write, no `editedFiles` credit + // (mirrors the ReplaceFragment already-original arm). + if restored != content { + staged.insert(edit.path.clone(), Some(restored)); + } + group_drops.insert(idx); + } + Err(error) => { + refuse(error, &mut outcome); + refused_groups.insert(group); + continue 'group; + } + } + } Inverse::ReplaceFragment | Inverse::HatchDocument => { let (Some(original), Some(new)) = (str_payload(&edit.original), str_payload(&edit.new)) @@ -426,10 +453,7 @@ pub async fn revert_remaining_redirect_edits( let content = match staged_read(&staged, project_root, &edit.path).await { Ok(Some(c)) => c, Ok(None) => { - refuse( - format!("{} no longer exists", edit.path), - &mut outcome, - ); + refuse(format!("{} no longer exists", edit.path), &mut outcome); refused_groups.insert(group); continue 'group; } @@ -468,10 +492,7 @@ pub async fn revert_remaining_redirect_edits( refused_groups.insert(group); continue 'group; } - staged.insert( - edit.path.clone(), - Some(content.replacen(new, original, 1)), - ); + staged.insert(edit.path.clone(), Some(content.replacen(new, original, 1))); group_drops.insert(idx); } else if content.contains(original) && !new.contains(original) { // Already at the pre-edit state (an interrupted @@ -706,7 +727,13 @@ mod tests { use serde_json::json; use tempfile::TempDir; - fn edit(path: &str, kind: &str, action: &str, original: Option<&str>, new: Option<&str>) -> FileEdit { + fn edit( + path: &str, + kind: &str, + action: &str, + original: Option<&str>, + new: Option<&str>, + ) -> FileEdit { FileEdit { path: path.into(), kind: kind.into(), @@ -731,7 +758,8 @@ mod tests { description: String::new(), license: String::new(), tier: "free".into(), - }); + }, + ); } state } @@ -775,7 +803,12 @@ mod tests { #[tokio::test] async fn rewritten_fragment_replays_to_original() { let dir = TempDir::new().unwrap(); - write(dir.path(), "requirements.txt", "left-pad @ https://patch.example/x.whl\n").await; + write( + dir.path(), + "requirements.txt", + "left-pad @ https://patch.example/x.whl\n", + ) + .await; let mut state = state_with( vec![edit( "requirements.txt", @@ -798,7 +831,12 @@ mod tests { async fn substring_original_checks_new_first() { // The maven version-suffix shape: original is a substring of new. let dir = TempDir::new().unwrap(); - write(dir.path(), "pom.xml", "2.17.1-socket-abc\n").await; + write( + dir.path(), + "pom.xml", + "2.17.1-socket-abc\n", + ) + .await; let mut state = state_with( vec![edit( "pom.xml", @@ -910,7 +948,12 @@ mod tests { #[tokio::test] async fn chained_reredirect_unwinds_newest_first_to_pristine() { let dir = TempDir::new().unwrap(); - write(dir.path(), "go.mod", "module m\n\nreplace x => gopatch.socket.dev/x v2\n").await; + write( + dir.path(), + "go.mod", + "module m\n\nreplace x => gopatch.socket.dev/x v2\n", + ) + .await; let mut state = state_with( vec![ edit( @@ -1201,7 +1244,13 @@ mod tests { async fn unknown_kind_fails_closed() { let dir = TempDir::new().unwrap(); let mut state = state_with( - vec![edit("f", "redirect_future_thing", "rewritten", Some("a"), Some("b"))], + vec![edit( + "f", + "redirect_future_thing", + "rewritten", + Some("a"), + Some("b"), + )], &[], ); let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; @@ -1214,7 +1263,12 @@ mod tests { async fn leftover_npm_json_edit_refuses_and_holds_every_npm_family_record() { let dir = TempDir::new().unwrap(); write(dir.path(), "package-lock.json", "{}\n").await; - write(dir.path(), "bun.lock", "\"pkg\": [\"https://patch.example/t.tgz\"]\n").await; + write( + dir.path(), + "bun.lock", + "\"pkg\": [\"https://patch.example/t.tgz\"]\n", + ) + .await; let mut state = state_with( vec![ FileEdit { @@ -1397,7 +1451,12 @@ mod tests { #[tokio::test] async fn dry_run_reports_without_touching_disk_or_ledger() { let dir = TempDir::new().unwrap(); - write(dir.path(), "requirements.txt", "left-pad @ https://patch.example/x.whl\n").await; + write( + dir.path(), + "requirements.txt", + "left-pad @ https://patch.example/x.whl\n", + ) + .await; let mut state = state_with( vec![edit( "requirements.txt", @@ -1426,7 +1485,13 @@ mod tests { let dir = TempDir::new().unwrap(); for bad in ["/etc/passwd", "../outside", "a/../../b", "c:\\windows\\x"] { let mut state = state_with( - vec![edit(bad, "redirect_requirements_line", "rewritten", Some("a"), Some("b"))], + vec![edit( + bad, + "redirect_requirements_line", + "rewritten", + Some("a"), + Some("b"), + )], &[], ); let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; @@ -1878,7 +1943,12 @@ mod tests { #[tokio::test] async fn trust_line_already_absent_leaves_the_file_untouched() { let dir = TempDir::new().unwrap(); - write(dir.path(), "pnpm-workspace.yaml", "packages:\n - 'apps/*'\n").await; + write( + dir.path(), + "pnpm-workspace.yaml", + "packages:\n - 'apps/*'\n", + ) + .await; let mut state = state_with( vec![FileEdit { path: "pnpm-workspace.yaml".into(), @@ -2035,7 +2105,13 @@ mod tests { Some("a"), Some("b"), ), - edit("f", "redirect_future_thing", "rewritten", Some("a"), Some("b")), + edit( + "f", + "redirect_future_thing", + "rewritten", + Some("a"), + Some("b"), + ), ], &["pkg:nuget/A@1", "pkg:hex/x@1"], ); @@ -2069,4 +2145,40 @@ mod tests { assert_eq!(remove_fragment_once("F\n", "F"), ""); assert_eq!(remove_fragment_once("\nF\n", "F"), ""); } + #[tokio::test] + async fn pipenv_replay_restores_categories_and_refuses_drift_atomically() { + use crate::patch::redirect::{rewrite_registry_redirect, DepOverride}; + let dep: DepOverride=serde_json::from_value(serde_json::json!({"ecosystem":"pypi","name":"urllib3","version":"1.26.18","patchUuid":"one","token":"token","artifactUrl":"https://patch.socket.dev/patch/pypi/urllib3/1.26.18/token/one/urllib3-1.26.18-py3-none-any.whl","integrity":{"sha256":"a".repeat(64)}})).unwrap(); + let original="{\"_meta\":{\"pipfile-spec\":6},\"default\":{\"urllib3\":{\"version\":\"==1.26.18\"}},\"tests\":{\"urllib3\":{\"version\":\"==1.26.18\"}}}"; + let result = rewrite_registry_redirect( + &BTreeMap::from([("Pipfile.lock".into(), original.into())]), + &[dep], + ); + for drift in [false, true] { + let dir = TempDir::new().unwrap(); + let text = result.files["Pipfile.lock"].clone(); + // Drift = the REFERENCE itself changed (its `#sha256=` pin here); + // a hashes-only change next to an intact reference is what a + // Pipenv relock does and rolls back (see pipenv::restore). + let live = if drift { + text.replacen("#sha256=", "#sha256=0", 1) + } else { + text + }; + write(dir.path(), "Pipfile.lock", &live).await; + let mut state = state_with(result.edits.clone(), &["pkg:pypi/urllib3@1.26.18"]); + let before = state.edits.len(); + let preview = revert_remaining_redirect_edits(dir.path(), &mut state, true).await; + assert_eq!(preview.fully_reverted(), !drift); + assert_eq!(read(dir.path(), "Pipfile.lock").await, live); + assert_eq!(state.edits.len(), before); + let outcome = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; + assert_eq!(outcome.fully_reverted(), !drift); + assert_eq!( + read(dir.path(), "Pipfile.lock").await, + if drift { live.as_str() } else { original } + ); + assert_eq!(state.edits.is_empty(), !drift); + } + } } diff --git a/crates/socket-patch-core/src/utils/mod.rs b/crates/socket-patch-core/src/utils/mod.rs index 30cbe466..77efcd3e 100644 --- a/crates/socket-patch-core/src/utils/mod.rs +++ b/crates/socket-patch-core/src/utils/mod.rs @@ -1,6 +1,7 @@ pub mod env_compat; pub mod fs; pub(crate) mod http; +pub mod pipenv; pub mod poetry_lock; pub mod process; pub mod purl; diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs new file mode 100644 index 00000000..e0e50225 --- /dev/null +++ b/crates/socket-patch-core/src/utils/pipenv.rs @@ -0,0 +1,249 @@ +//! Which Pipenv release installs this project. The hosted rewriter writes +//! `path` references for Pipenv 7–11 and `file` references from 2018 on, and +//! the vendored backend refuses installers older than 2018, so both ask +//! [`installed_major`] once per command. + +use std::ffi::OsString; +use std::path::{Path, PathBuf}; + +/// Pins the answer without spawning anything: CI images without pipenv on +/// PATH, or a project installed with a different release than the machine's +/// default pipenv. +pub const MAJOR_OVERRIDE_ENV: &str = "SOCKET_PIPENV_MAJOR"; + +/// `SOCKET_PIPENV_MAJOR` accepts the bare major (`11`, `2026`) or the full +/// release as `pipenv --version` prints it (`11.10.4`, `2026.8.0`); anything +/// else is ignored (the probe then runs as if the variable were unset). +fn parse_override(value: &str) -> Option { + let value = value.trim().trim_start_matches('v'); + value.split('.').next()?.parse::().ok() +} + +/// `pipenv, version 2026.8.0` — every release from 0.2.8 through 2026.8.0 +/// prints exactly this shape on stdout (measured). Only the token after +/// `version` counts: a bare dotted number elsewhere (a `Python 3.12` banner +/// from a wrapper, a "Courtesy Notice" line) must never be mistaken for the +/// major, because a wrong major silently picks the wrong lock reference +/// shape or refuses vendoring. +fn parse_major(output: &str) -> Option { + let tokens: Vec<&str> = output.split_whitespace().collect(); + let index = tokens + .iter() + .position(|token| token.trim_end_matches(':').eq_ignore_ascii_case("version"))?; + let token = tokens + .get(index + 1)? + .trim_start_matches('v') + .trim_matches(|c: char| matches!(c, ',' | '(' | ')' | ';')); + let (major, rest) = token.split_once('.')?; + rest.chars().next().filter(char::is_ascii_digit)?; + major.parse().ok() +} + +/// The `pipenv` executable, searched on ABSOLUTE `PATH` entries only: the +/// probe runs with the project as its working directory, so a relative entry +/// (`.`, an empty component) would execute a `pipenv` planted in the +/// repository being scanned. On Windows every `PATHEXT` extension is tried, +/// so `pipenv.exe` and the `pipenv.bat` / `pipenv.cmd` shims (pyenv-win, +/// hand-written wrappers) are both found. +fn resolve_on_path(var: &impl Fn(&str) -> Option) -> Option { + let path = var("PATH")?; + let extensions: Vec = if cfg!(windows) { + var("PATHEXT") + .map(|value| { + value + .to_string_lossy() + .split(';') + .filter(|ext| !ext.is_empty()) + .map(|ext| ext.to_ascii_lowercase()) + .collect::>() + }) + .filter(|list| !list.is_empty()) + .unwrap_or_else(|| vec![".exe".into(), ".bat".into(), ".cmd".into()]) + } else { + vec![String::new()] + }; + for dir in std::env::split_paths(&path) { + if !dir.is_absolute() { + continue; + } + for ext in &extensions { + let candidate = dir.join(format!("pipenv{ext}")); + if candidate.is_file() && is_executable(&candidate) { + return Some(candidate); + } + } + } + None +} + +/// A plain file that cannot be executed (a stray `pipenv` data file on PATH) +/// is skipped in favour of the next entry, like execvp does; Windows has no +/// mode bits, PATHEXT is the executability rule there. +fn is_executable(path: &Path) -> bool { + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + std::fs::metadata(path).is_ok_and(|m| m.permissions().mode() & 0o111 != 0) + } + #[cfg(not(unix))] + { + let _ = path; + true + } +} + +fn is_batch_shim(program: &Path) -> bool { + cfg!(windows) + && program.extension().is_some_and(|ext| { + let ext = ext.to_string_lossy().to_ascii_lowercase(); + ext == "bat" || ext == "cmd" + }) +} + +/// The major of the `pipenv` on PATH (`11`, `2018`, `2026`, …), or `None` +/// when none is found, it does not answer within 10 s, exits non-zero or +/// prints something unrecognizable. [`MAJOR_OVERRIDE_ENV`] short-circuits +/// the probe. +pub async fn installed_major(root: &Path) -> Option { + if let Some(forced) = std::env::var(MAJOR_OVERRIDE_ENV) + .ok() + .and_then(|value| parse_override(&value)) + { + return Some(forced); + } + let program = resolve_on_path(&|name| std::env::var_os(name))?; + let mut command = if is_batch_shim(&program) { + let mut command = tokio::process::Command::new("cmd.exe"); + command.arg("/C").arg(&program); + command + } else { + tokio::process::Command::new(&program) + }; + // The version banner does not depend on a project, so the probe runs in a + // NEUTRAL directory: with the scanned repository as cwd, Pipenv would read + // its `.env`, `Pipfile` and `.venv` pointer — committed, attacker-shaped + // inputs that must not influence (or slow down) a version check. + let _ = root; + command + .arg("--version") + .current_dir(std::env::temp_dir()) + .env("PIPENV_DONT_LOAD_ENV", "1") + .env("PIPENV_NOSPIN", "1") + .env("PIPENV_IGNORE_VIRTUALENVS", "1") + .kill_on_drop(true); + let output = tokio::time::timeout(std::time::Duration::from_secs(10), command.output()) + .await + .ok()? + .ok()?; + if !output.status.success() { + return None; + } + parse_major(&String::from_utf8_lossy(&output.stdout)) +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn installer_version_output() { + assert_eq!(parse_major("pipenv, version 11.10.4\n"), Some(11)); + assert_eq!(parse_major("pipenv, version 2026.8.0\n"), Some(2026)); + assert_eq!(parse_major("pipenv, version 0.2.8\n"), Some(0)); + assert_eq!(parse_major("unavailable"), None); + // Extra lines before the banner (a courtesy notice, a `.env` load + // message routed to stdout by a wrapper) do not confuse it… + assert_eq!( + parse_major( + "Courtesy Notice: Pipenv found itself running within a virtual environment 3.12\npipenv, version 2023.12.1\n" + ), + Some(2023) + ); + assert_eq!(parse_major("Loading .env environment variables...\npipenv, version 2022.12.19"), Some(2022)); + // …and a dotted number that is NOT the pipenv version is never taken. + assert_eq!(parse_major("Python 3.12.0"), None); + assert_eq!(parse_major("version"), None); + assert_eq!(parse_major("version x.1"), None); + assert_eq!(parse_major("pipenv version 2024\n"), None, "no minor: not a version banner"); + } + + #[test] + fn resolve_on_path_skips_relative_entries_and_finds_absolute_ones() { + let tmp = tempfile::tempdir().unwrap(); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&bin).unwrap(); + let leaf = if cfg!(windows) { "pipenv.exe" } else { "pipenv" }; + std::fs::write(bin.join(leaf), b"").unwrap(); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + std::fs::set_permissions(bin.join(leaf), std::fs::Permissions::from_mode(0o755)).unwrap(); + } + // A repo-planted `pipenv` under a RELATIVE entry must never win. + let planted = tmp.path().join("planted"); + std::fs::create_dir_all(&planted).unwrap(); + std::fs::write(planted.join(leaf), b"").unwrap(); + let joined = std::env::join_paths([ + std::path::PathBuf::from("."), + std::path::PathBuf::from(""), + std::path::PathBuf::from("planted"), + bin.clone(), + ]) + .unwrap(); + let var = |name: &str| (name == "PATH").then(|| joined.clone()); + assert_eq!(resolve_on_path(&var), Some(bin.join(leaf))); + + let only_relative = std::env::join_paths([std::path::PathBuf::from("."), std::path::PathBuf::from("planted")]).unwrap(); + let var = |name: &str| (name == "PATH").then(|| only_relative.clone()); + assert_eq!(resolve_on_path(&var), None); + let none = |_: &str| None::; + assert_eq!(resolve_on_path(&none), None); + } + + #[cfg(unix)] + #[test] + fn resolve_on_path_skips_non_executable_files() { + use std::os::unix::fs::PermissionsExt; + let tmp = tempfile::tempdir().unwrap(); + let data = tmp.path().join("data"); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&data).unwrap(); + std::fs::create_dir_all(&bin).unwrap(); + std::fs::write(data.join("pipenv"), b"not a program").unwrap(); + std::fs::set_permissions(data.join("pipenv"), std::fs::Permissions::from_mode(0o644)).unwrap(); + std::fs::write(bin.join("pipenv"), b"").unwrap(); + std::fs::set_permissions(bin.join("pipenv"), std::fs::Permissions::from_mode(0o755)).unwrap(); + let joined = std::env::join_paths([data.clone(), bin.clone()]).unwrap(); + let var = |name: &str| (name == "PATH").then(|| joined.clone()); + assert_eq!(resolve_on_path(&var), Some(bin.join("pipenv"))); + } + + #[test] + fn override_accepts_a_major_or_a_full_release() { + assert_eq!(parse_override("11"), Some(11)); + assert_eq!(parse_override(" 2026 "), Some(2026)); + assert_eq!(parse_override("11.10.4"), Some(11)); + assert_eq!(parse_override("v2018.11.26"), Some(2018)); + assert_eq!(parse_override("eleven"), None); + assert_eq!(parse_override(""), None); + assert_eq!(parse_override("-11"), None); + } + + #[cfg(windows)] + #[test] + fn resolve_on_path_honours_pathext_shims() { + let tmp = tempfile::tempdir().unwrap(); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&bin).unwrap(); + std::fs::write(bin.join("pipenv.bat"), b"@echo pipenv, version 2024.4.1").unwrap(); + let joined = std::env::join_paths([bin.clone()]).unwrap(); + let var = |name: &str| match name { + "PATH" => Some(joined.clone()), + "PATHEXT" => Some(OsString::from(".COM;.EXE;.BAT;.CMD")), + _ => None, + }; + let found = resolve_on_path(&var).unwrap(); + assert_eq!(found, bin.join("pipenv.bat")); + assert!(is_batch_shim(&found)); + } +} diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 5ba45798..786453a4 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -51,6 +51,11 @@ pub enum LockIntegrity { /// Hex sha256 of the artifact (Cargo.lock `checksum`, pypi file hashes, /// Gemfile.lock `CHECKSUMS`). Sha256Hex(String), + /// One of several hex sha256 digests: the lock records every release + /// file's digest without saying which file is which (Pipfile.lock + /// `hashes`), so the fetcher picks the pure-Python wheel whose PyPI + /// digest is in the set and verifies the download against that digest. + Sha256AnyOf(Vec), /// go.sum module-zip dirhash (`h1:`). GoH1(String), /// The lock records no content verifier. @@ -1089,7 +1094,9 @@ fn parse_gem_spec_line(line: &str) -> Option<(String, String)> { /// (URL + sha256 of a pure `py3-none-any` wheel) comes from `uv.lock`; /// `poetry.lock` and `--hash`-pinned `requirements.txt` contribute /// DISCOVERY-only entries (no recorded URL; platform-independent wheel -/// choice is not derivable offline). Pipenv/pdm locks: not yet read. +/// choice is not derivable offline). Pipfile.lock contributes +/// entries whose integrity is its digest SET (see `inventory_pipfile_lock`); +/// pdm.lock: not yet read. async fn inventory_pypi_locks(project_root: &Path) -> Option> { let mut out = Vec::new(); let mut found = false; @@ -1123,9 +1130,21 @@ async fn inventory_pypi_locks(project_root: &Path) -> Option> if let Some(entries) = inventory_poetry_lock(project_root).await { found = true; out.extend(entries); - } else if let Some(entries) = inventory_requirements_txt(project_root).await { - found = true; - out.extend(entries); + } else { + // Pipfile.lock and requirements.txt are read TOGETHER: Pipenv + // projects routinely ship both (`pipenv requirements` exports the + // same pins — deduplicated below), and a stale Pipfile.lock left in + // a requirements project must not hide the pins the project + // actually installs from (the hosted rewriter judges each file on + // its own). + if let Some(entries) = inventory_pipfile_lock(project_root).await { + found = true; + out.extend(entries); + } + if let Some(entries) = inventory_requirements_txt(project_root).await { + found = true; + out.extend(entries); + } } } found.then(|| dedup_prefer_integrity(out)) @@ -1355,6 +1374,173 @@ async fn inventory_poetry_lock(project_root: &Path) -> Option Some(dedup_prefer_integrity(out)) } +/// `https://pypi.org/simple`, `https://pypi.python.org/simple`, +/// `https://files.pythonhosted.org/…`: the public index PyPI's JSON API +/// describes. +fn is_public_pypi_url(url: &str) -> bool { + let host = url + .split("://") + .nth(1) + .and_then(|rest| rest.split(['/', '?', '#']).next()) + .unwrap_or("") + .to_ascii_lowercase(); + let host = host.rsplit('@').next().unwrap_or(&host); + matches!( + host, + "pypi.org" | "www.pypi.org" | "pypi.python.org" | "files.pythonhosted.org" + ) +} + +/// The `(canonical name, version)` a Socket-written Pipfile.lock reference +/// stands for: a hosted URL +/// `https:///patch/pypi/////[#…]` +/// (coordinates from the path) or a vendored path +/// `[./].socket/vendor/pypi//--…whl` (coordinates from +/// the wheel filename). `None` for a user's own file/path reference. +fn socket_reference_coords(reference: &str) -> Option<(String, String)> { + let reference = reference.split('#').next().unwrap_or(reference); + if let Some(rest) = reference.strip_prefix("https://") { + let path = rest.split_once('/')?.1; + let parts: Vec<&str> = path.split('/').collect(); + if parts.len() == 7 && parts[0] == "patch" && parts[1] == "pypi" && parts[6].ends_with(".whl") { + return Some((canonicalize_pypi_name(parts[2]), parts[3].to_string())); + } + return None; + } + let rel = reference.trim_start_matches("./"); + let rest = rel.strip_prefix(".socket/vendor/pypi/")?; + let (_uuid, wheel) = rest.split_once('/')?; + let stem = wheel.strip_suffix(".whl")?; + let mut fields = stem.split('-'); + let name = fields.next()?; + let version = fields.next()?; + if name.is_empty() || version.is_empty() || !version.starts_with(|c: char| c.is_ascii_digit()) { + return None; + } + Some((canonicalize_pypi_name(name), version.to_string())) +} + +/// Pipfile.lock (pipfile-spec 6): every category other than `_meta` holds +/// `name: {"version": "==X", "hashes": ["sha256:", …], …}` entries. +/// Registry pins (`==` version) become entries whose integrity is the SET of +/// recorded digests — Pipenv lists every release file's hash without +/// filenames, so the pure-Python wheel is selected by digest at fetch time +/// ([`LockIntegrity::Sha256AnyOf`]). VCS / path / file / editable sources and +/// range pins are skipped (nothing registry-shaped to vendor over), as are +/// our own already-wired file references. An unparseable lock contributes +/// nothing, so the caller falls through to requirements.txt like an absent +/// lock would. +async fn inventory_pipfile_lock(project_root: &Path) -> Option> { + let text = read_regular_to_string(&project_root.join("Pipfile.lock")) + .await + .ok()?; + let value: serde_json::Value = serde_json::from_str(text.trim_start_matches('\u{feff}')).ok()?; + let root = value.as_object()?; + // Digests are only fetchable through PyPI's JSON API when the lock + // resolves from PyPI: a lock whose `_meta.sources` name only private + // indexes must not leak its package names to pypi.org (and would not find + // its files there anyway) — its entries stay discovery-only. + let public_index = root + .get("_meta") + .and_then(|m| m.get("sources")) + .and_then(serde_json::Value::as_array) + .is_none_or(|sources| { + sources.is_empty() + || sources.iter().any(|source| { + source + .get("url") + .and_then(serde_json::Value::as_str) + .is_some_and(is_public_pypi_url) + }) + }); + let mut out = Vec::new(); + for (section, entries) in root { + if section == "_meta" { + continue; + } + let Some(entries) = entries.as_object() else { + continue; + }; + for (name, entry) in entries { + let Some(entry) = entry.as_object() else { + continue; + }; + // Socket's own references (a hosted `file` URL, a vendored + // `./.socket/vendor/pypi//` path) stay DISCOVERABLE + // as the package they replace, so a re-scan of an already + // redirected lock-only checkout still lists (and re-confirms / + // attests) it instead of reporting zero packages. + if let Some(reference) = entry + .get("file") + .or_else(|| entry.get("path")) + .and_then(serde_json::Value::as_str) + { + if let Some((n, v)) = socket_reference_coords(reference) { + if path_safety::is_safe_single_segment(&n) + && path_safety::is_safe_single_segment(&v) + { + out.push(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{n}@{v}"), + name: n, + version: v, + resolved: None, + integrity: LockIntegrity::None, + }); + } + } + continue; + } + if ["git", "hg", "svn", "bzr", "editable"] + .iter() + .any(|key| entry.contains_key(*key)) + { + continue; + } + let Some(version) = entry + .get("version") + .and_then(serde_json::Value::as_str) + .and_then(|v| v.strip_prefix("==")) + .map(str::trim) + .filter(|v| !v.is_empty()) + else { + continue; + }; + let n = canonicalize_pypi_name(name); + if !path_safety::is_safe_single_segment(&n) + || !path_safety::is_safe_single_segment(version) + { + continue; + } + let hashes: Vec = entry + .get("hashes") + .and_then(serde_json::Value::as_array) + .into_iter() + .flatten() + .filter_map(serde_json::Value::as_str) + .filter_map(|h| h.strip_prefix("sha256:")) + .filter(|h| is_hex_of_len(h, 64)) + .map(|h| h.to_ascii_lowercase()) + .collect(); + let integrity = if hashes.is_empty() || !public_index { + LockIntegrity::None + } else { + LockIntegrity::Sha256AnyOf(hashes) + }; + out.push(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{n}@{version}"), + name: n, + version: version.to_string(), + resolved: None, + integrity, + }); + } + } + Some(out) +} + + /// requirements.txt with exact `==` pins — discovery only. async fn inventory_requirements_txt(project_root: &Path) -> Option> { let text = read_regular_to_string(&project_root.join("requirements.txt")) @@ -1583,6 +1769,38 @@ pub async fn recover_lock_entry( const NO_URL: &str = "the pre-vendor pypi lock fragment records the wheel hash but \ no fetchable registry URL (only uv.lock and pdm `static_urls` locks carry wheel \ URLs); reinstall the package so repair can rebuild from the installed copy"; + // Pipenv's pre-vendor entry is a JSON object carrying every + // release file's sha256 (`"hashes": ["sha256:…", …]`): fetchable + // by digest through PyPI's JSON API like a fresh Pipfile.lock + // inventory entry, so a lock-only checkout of an already-vendored + // project re-scans green instead of `package_not_installed`. + if let Some(object) = fragment.as_object() { + let digests: Vec = object + .get("hashes") + .and_then(serde_json::Value::as_array) + .into_iter() + .flatten() + .filter_map(serde_json::Value::as_str) + .filter_map(|h| h.strip_prefix("sha256:")) + .filter(|h| is_hex_of_len(h, 64)) + .map(|h| h.to_ascii_lowercase()) + .collect(); + if digests.is_empty() { + return Err( + "the pre-vendor Pipfile.lock entry records no sha256 digests; reinstall the \ + package so repair can rebuild from the installed copy" + .to_string(), + ); + } + return Ok(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{name}@{version}"), + name, + version, + resolved: None, + integrity: LockIntegrity::Sha256AnyOf(digests), + }); + } let unit = fragment.as_str().ok_or_else(|| NO_URL.to_string())?; let (url, sha) = pure_wheel_from_uv_unit(unit).ok_or_else(|| NO_URL.to_string())?; Ok(LockfileEntry { @@ -3282,6 +3500,131 @@ source = { editable = "." } assert_eq!(entries[0].purl, "pkg:pypi/requests@2.28.0"); } + /// Pipfile.lock: every category is read, registry pins carry the lock's + /// digest SET (lowercased), non-registry sources / range pins / a user's + /// file references are skipped while our own vendored reference stays + /// discoverable, the same package in two categories yields one entry, + /// requirements.txt is read alongside it, and a parseable uv.lock + /// outranks both. + #[tokio::test] + async fn pipfile_lock_inventory_reads_every_category_with_its_digest_set() { + let wheel = "a".repeat(64); + let sdist = "B".repeat(64); + let lock = format!( + r#"{{ + "_meta": {{"hash": {{"sha256": "x"}}, "pipfile-spec": 6, "requires": {{}}, "sources": []}}, + "default": {{ + "URLlib3": {{"hashes": ["sha256:{wheel}", "sha256:{sdist}"], "index": "pypi", "version": "==1.26.18", "markers": "python_version < '4'"}}, + "requests": {{"git": "https://example.org/requests", "ref": "abc", "version": "==2.31.0"}}, + "loose": {{"version": "*"}}, + "wired": {{"file": "./.socket/vendor/pypi/00000000-0000-4000-8000-000000000000/wired-1.0-py3-none-any.whl", "hashes": ["sha256:{wheel}"]}} + }}, + "develop": {{ + "Six": {{"hashes": ["sha256:{sdist}"], "version": "==1.16.0"}} + }}, + "tests": {{ + "urllib3": {{"hashes": ["sha256:{wheel}"], "version": "==1.26.18"}} + }} +}} +"# + ); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &lock).await; + write(tmp.path(), "requirements.txt", "flask==3.0.0\n").await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + let mut names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect(); + names.sort_unstable(); + // requirements.txt is read alongside the Pipfile.lock, not hidden by + // it; our own vendored reference stays discoverable (discovery-only). + assert_eq!(names, vec!["flask", "six", "urllib3", "wired"], "{entries:?}"); + assert_eq!(entry(&entries, "wired").integrity, LockIntegrity::None); + assert_eq!(entry(&entries, "wired").purl, "pkg:pypi/wired@1.0"); + let urllib3 = entry(&entries, "urllib3"); + assert_eq!(urllib3.purl, "pkg:pypi/urllib3@1.26.18"); + assert_eq!(urllib3.resolved, None); + assert_eq!( + urllib3.integrity, + LockIntegrity::Sha256AnyOf(vec![wheel.clone(), sdist.to_ascii_lowercase()]), + "every recorded digest, lowercased, first category wins" + ); + assert_eq!( + entry(&entries, "six").integrity, + LockIntegrity::Sha256AnyOf(vec![sdist.to_ascii_lowercase()]) + ); + + // A parseable uv.lock stays the exclusive inventory. + write( + tmp.path(), + "uv.lock", + "version = 1\n\n[[package]]\nname = \"other\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\n", + ) + .await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert!(entries.iter().all(|e| e.name == "other"), "{entries:?}"); + + // Unparseable lock → nothing from it, requirements.txt read instead. + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", "{ not json").await; + write(tmp.path(), "requirements.txt", "flask==3.0.0\n").await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entries.len(), 1); + assert_eq!(entries[0].name, "flask"); + + // No hashes at all → discovery-only entry. + let tmp = tempfile::tempdir().unwrap(); + write( + tmp.path(), + "Pipfile.lock", + r#"{"_meta": {"pipfile-spec": 6}, "default": {"urllib3": {"version": "==1.26.18"}}}"#, + ) + .await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None); + } + + /// Socket's own references in a Pipfile.lock (a hosted URL, a vendored + /// path) keep the package discoverable on a lock-only re-scan; a lock + /// whose sources are private indexes only never carries a fetchable + /// digest set (no pypi.org lookups for it). + #[tokio::test] + async fn pipfile_lock_inventory_keeps_socket_references_discoverable_and_respects_private_indexes() { + let hosted = r#"{"_meta": {"pipfile-spec": 6, "sources": [{"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]}, +"default": { + "urllib3": {"file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/grant/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=cc", "hashes": ["sha256:cc"], "markers": "x"}, + "Six": {"file": "./.socket/vendor/pypi/00000000-0000-4000-8000-000000000000/six-1.16.0-py2.py3-none-any.whl", "hashes": ["sha256:dd"]}, + "fork": {"file": "./forks/fork-1.0-py3-none-any.whl"}, + "requests": {"version": "==2.31.0", "hashes": ["sha256:%s"]} +}}"#.replace("%s", &"a".repeat(64)); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &hosted).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + let mut names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect(); + names.sort_unstable(); + assert_eq!(names, vec!["requests", "six", "urllib3"], "{entries:?}"); + assert_eq!(entry(&entries, "urllib3").purl, "pkg:pypi/urllib3@1.26.18"); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None, "a hosted reference is discovery-only"); + assert_eq!(entry(&entries, "six").purl, "pkg:pypi/six@1.16.0"); + assert_eq!(entry(&entries, "six").integrity, LockIntegrity::None); + assert!(matches!(entry(&entries, "requests").integrity, LockIntegrity::Sha256AnyOf(_))); + + // Private index only → the registry pin is discovery-only. + let private = hosted.replace("https://pypi.org/simple", "https://pypi.internal.example/simple"); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &private).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "requests").integrity, LockIntegrity::None, "no pypi.org lookup for a private-index lock"); + // A mirror listed next to PyPI keeps the digest set. + let mixed = hosted.replace(r#"[{"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]"#, r#"[{"name": "mirror", "url": "https://mirror.example/simple", "verify_ssl": true}, {"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]"#); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &mixed).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert!(matches!(entry(&entries, "requests").integrity, LockIntegrity::Sha256AnyOf(_))); + assert!(is_public_pypi_url("https://user:tok@pypi.org/simple")); + assert!(!is_public_pypi_url("https://pypi.org.evil.example/simple")); + assert_eq!(socket_reference_coords("./forks/fork-1.0-py3-none-any.whl"), None); + assert_eq!(socket_reference_coords("https://example.org/patch/pypi/a/1/g/u/a-1-py3-none-any.whl"), Some(("a".into(), "1".into()))); + } + /// A lock that lists a pure-Python wheel carries its sha256 (lock 2.x /// `files`, lock 1.x `[metadata.files]`), so a lock-only checkout can /// vendor like uv does; platform wheels only, or 0.12's bare @@ -4258,20 +4601,36 @@ mod recover_tests { assert!(!err.contains("uv.lock fragment recorded"), "{kind}: {err}"); } - // pipenv records a JSON object (hashes + version), not a string unit. + // pipenv records a JSON object (hashes + version), not a string unit: + // its digest set IS fetchable (PyPI JSON API lookup by digest), so a + // lock-only checkout of an already-vendored project recovers. let pipenv = entry( "pypi", "pkg:pypi/six@1.16.0", vec![rec( "pipenv_lock_entry", serde_json::json!({ - "hashes": [format!("sha256:{}", "a".repeat(64))], + "hashes": [format!("sha256:{}", "a".repeat(64)), format!("sha256:{}", "B".repeat(64))], "version": "==1.16.0", }), )], ); - let err = recover_lock_entry(tmp.path(), &pipenv).await.unwrap_err(); - assert!(err.contains("no fetchable registry URL"), "pipenv: {err}"); + let recovered = recover_lock_entry(tmp.path(), &pipenv).await.unwrap(); + assert_eq!(recovered.purl, "pkg:pypi/six@1.16.0"); + assert_eq!(recovered.resolved, None); + assert_eq!( + recovered.integrity, + LockIntegrity::Sha256AnyOf(vec!["a".repeat(64), "b".repeat(64)]), + "lowercased digest set" + ); + // …but a pipenv fragment without digests has nothing to fetch by. + let digestless = entry( + "pypi", + "pkg:pypi/six@1.16.0", + vec![rec("pipenv_lock_entry", serde_json::json!({"version": "==1.16.0"}))], + ); + let err = recover_lock_entry(tmp.path(), &digestless).await.unwrap_err(); + assert!(err.contains("no sha256 digests"), "pipenv: {err}"); // A ledger with no pypi fragment at all is still a hard error. let bare = entry("pypi", "pkg:pypi/six@1.16.0", vec![]); diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index 4bfb4d30..3cc460ef 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -413,7 +413,11 @@ fn pipenv_wired_pin(lock: &serde_json::Value, uuid_dir_rel: &str) -> Option<(Str continue; }; for entry in map.values() { - let Some(file) = entry.get("file").and_then(serde_json::Value::as_str) else { + let Some(file) = entry + .get("file") + .or_else(|| entry.get("path")) + .and_then(serde_json::Value::as_str) + else { continue; }; let bare = file.strip_prefix("./").unwrap_or(file); @@ -449,6 +453,102 @@ pub async fn vendor_pypi( dry_run: bool, force: bool, service: Option<&VendorServiceConfig>, +) -> VendorOutcome { + vendor_pypi_with_pipenv_version( + purl, + site_packages, + project_root, + record, + sources, + vendored_at, + dry_run, + force, + service, + &tokio::sync::OnceCell::new(), + ) + .await +} + +/// Pipenv never reinstalls a release that is already present — measured on +/// 11.10.4, 2018.11.26 and 2026.8.0: `pipenv install`, `install --deploy` +/// and `sync` all exit 0 and keep the installed bytes — so wiring the lock +/// while the upstream release sits in the virtualenv leaves that venv +/// vulnerable until it is reinstalled. Positive evidence only (readable +/// bytes hashing to something other than the record's afterHash); an +/// already-patched (agent-mode) install and a lock-only checkout stay silent. +async fn pipenv_stale_install_warning( + project_root: &Path, + purl: &str, + record: &PatchRecord, +) -> Option { + use crate::crawlers::python_crawler::{find_local_venv_site_packages, PythonCrawler}; + use crate::patch::apply::{verify_file_patch, VerifyStatus}; + if record.files.is_empty() { + return None; + } + // Judged over the PROJECT'S venvs (VIRTUAL_ENV, ./.venv, ./venv, Pipenv's + // WORKON_HOME venv) — never the staging dir a lock-only vendor fetched + // the pristine wheel into, and never the global interpreters. + let base = strip_purl_qualifiers(purl).to_string(); + let crawler = PythonCrawler::new(); + let mut stale_dirs: Vec = Vec::new(); + for site in find_local_venv_site_packages(project_root).await { + let found = crawler + .find_by_purls(&site, std::slice::from_ref(&base)) + .await + .unwrap_or_default(); + if !found.contains_key(&base) { + continue; + } + if crate::vex::verify::verify_patch_record(&site, record) + .await + .is_ok() + { + continue; + } + for (file, info) in &record.files { + let result = verify_file_patch(&site, file, info).await; + if matches!( + result.status, + VerifyStatus::Ready | VerifyStatus::HashMismatch + ) && result.current_hash.is_some() + { + stale_dirs.push(site.clone()); + break; + } + } + } + if stale_dirs.is_empty() { + return None; + } + let name = parse_pypi_purl(strip_purl_qualifiers(purl)) + .map(|(name, _)| name.to_string()) + .unwrap_or_else(|| purl.to_string()); + let listed = stale_dirs + .iter() + .map(|d| d.display().to_string()) + .collect::>() + .join(", "); + Some(VendorWarning::new( + "pypi_pipenv_stale_install", + format!( + "{purl}: the UNPATCHED upstream release is still installed in {listed}. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the Pipfile: `pipenv run pip uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away; then `socket-patch vex` re-verifies the installed files." + ), + )) +} + +#[allow(clippy::too_many_arguments)] +pub async fn vendor_pypi_with_pipenv_version( + purl: &str, + site_packages: &Path, + project_root: &Path, + record: &PatchRecord, + sources: &PatchSources<'_>, + vendored_at: &str, + dry_run: bool, + force: bool, + service: Option<&VendorServiceConfig>, + pipenv_version: &tokio::sync::OnceCell>, ) -> VendorOutcome { // The purl may carry `?artifact_id=` variant qualifiers; everything here // keys off the qualifier-free base. @@ -596,13 +696,48 @@ pub async fn vendor_pypi( Ok(p) => p, Err((code, detail)) => return refused(code, detail), }; - match super::pypi_pipenv::check_target_guards(&project, &canon_name, &record.uuid) { + let installer = *pipenv_version + .get_or_init(|| crate::utils::pipenv::installed_major(project_root)) + .await; + if installer.is_some_and(|major| major < 2018) { + return refused("pypi_pipenv_installer_unsupported", "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode"); + } + if installer.is_none() { + // Fail-open like hosted, but say so: the wiring assumes a + // 2018+ installer, and a Pipenv 7–11 project would not be + // able to consume it. + warnings.push(VendorWarning::new( + "pypi_pipenv_installer_unknown", + format!( + "Pipenv was not found on PATH; the vendored references assume Pipenv 2018 or later (Pipenv 7–11 cannot consume them — use hosted mode there). Set {}= to pin the installer release.", + crate::utils::pipenv::MAJOR_OVERRIDE_ENV + ), + )); + } + match super::pypi_pipenv::check_target_guards( + &project, + &canon_name, + &record.uuid, + version, + ) { Ok(PipenvTarget::InSync) => { + // A re-run over an already-wired lock keeps warning while + // the venv still holds the upstream release. + if let Some(stale) = + pipenv_stale_install_warning(project_root, purl, record).await + { + warnings.push(stale); + } wired_pin = pipenv_wired_pin(&project.lock, &uuid_dir_rel); WiringPlan::InSync } Ok(PipenvTarget::Fresh) => { warnings.extend(project.warnings.iter().cloned()); + if let Some(stale) = + pipenv_stale_install_warning(project_root, purl, record).await + { + warnings.push(stale); + } WiringPlan::Pipenv(Box::new(project)) } Err((code, detail)) => return refused(code, detail), @@ -3566,6 +3701,129 @@ wheels = [ } "#; + /// A relock regenerated the wired entry to a registry reference whose + /// hash list differs from the recorded original (Pipenv 2022.12.19 does + /// exactly this; 2026 reproduces the original and converges silently): + /// the vendored reference is gone, so the revert must RETIRE the record + /// — success, no drift-keep, artifact removed — instead of keeping the + /// uuid dir and ledger entry forever for a reference nothing points at. + /// A live entry that still carries a foreign `file` reference is drift. + #[tokio::test] + async fn pipenv_relocked_registry_entry_retires_instead_of_keeping() { + use crate::vendor::pypi_pipenv::{load_pipenv_project, wire_pipenv}; + let tmp = tempfile::tempdir().unwrap(); + let root = tmp.path(); + tokio::fs::write(root.join("Pipfile.lock"), PIPENV_REGISTRY_LOCK) + .await + .unwrap(); + let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl"); + let p = load_pipenv_project(root).await.unwrap(); + let (wiring, _meta) = wire_pipenv(&p, root, "six", &rel_wheel, &"0".repeat(64), UUID) + .await + .unwrap(); + let uuid_dir = root.join(format!(".socket/vendor/pypi/{UUID}")); + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + let wheel = uuid_dir.join("six-1.16.0-py2.py3-none-any.whl"); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + + // Simulate the relock: registry shape again, but a DIFFERENT hash + // list than the recorded original. + let text = tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(); + let mut live: serde_json::Value = serde_json::from_str(&text).unwrap(); + live["default"]["six"] = serde_json::json!({ + "hashes": ["sha256:relocked-a", "sha256:relocked-b"], + "index": "pypi", + "version": "==1.16.0" + }); + let relocked = serde_json::to_string_pretty(&live).unwrap(); + tokio::fs::write(root.join("Pipfile.lock"), &relocked) + .await + .unwrap(); + + let entry = revert_entry("pipenv", &rel_wheel, wiring.clone()); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!( + outcome + .warnings + .iter() + .any(|w| w.code == "vendor_lock_entry_relocked"), + "{:?}", + outcome.warnings + ); + assert!( + !outcome.drift_skipped() && !outcome.kept_artifact, + "a relocked entry is not drift: {:?}", + outcome.warnings + ); + assert!(!wheel.exists(), "the orphaned vendored wheel is removed"); + assert_eq!( + tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(), + relocked, + "the user's relocked entry stands" + ); + + // Pipenv 2023+ relocking an excluded-by-marker entry keeps OUR + // reference but restores the registry hashes/version next to it: + // still ours → the original is restored and the record retires. + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + let (wiring2, _meta2) = wire_pipenv( + &load_pipenv_project(root).await.unwrap_or_else(|e| panic!("{e:?}")), + root, + "six", + &rel_wheel, + &"0".repeat(64), + UUID, + ) + .await + .unwrap_or_else(|_| panic!("rewire")); + let text = tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(); + let mut hybrid: serde_json::Value = serde_json::from_str(&text).unwrap(); + hybrid["default"]["six"]["hashes"] = serde_json::json!(["sha256:upstream-a"]); + hybrid["default"]["six"]["version"] = serde_json::json!("==1.16.0"); + tokio::fs::write( + root.join("Pipfile.lock"), + serde_json::to_string_pretty(&hybrid).unwrap(), + ) + .await + .unwrap(); + let entry = revert_entry("pipenv", &rel_wheel, wiring2); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!(!outcome.drift_skipped() && !outcome.kept_artifact, "{:?}", outcome.warnings); + let restored: serde_json::Value = serde_json::from_str( + &tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(), + ) + .unwrap(); + assert!(restored["default"]["six"].get("file").is_none(), "{restored}"); + assert_eq!(restored["default"]["six"]["version"], serde_json::json!("==1.16.0")); + + // Foreign file reference → still drift, still kept. + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + live["default"]["six"] = serde_json::json!({"file": "./forks/six.whl"}); + tokio::fs::write( + root.join("Pipfile.lock"), + serde_json::to_string_pretty(&live).unwrap(), + ) + .await + .unwrap(); + let entry = revert_entry("pipenv", &rel_wheel, wiring); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!(outcome.drift_skipped() && outcome.kept_artifact, "{:?}", outcome.warnings); + assert!(wheel.is_file()); + } + /// BUG GUARD (missing drift-keep gate — the npm-family RevertOutcome /// contract, residual #131): a drift-skipped pipenv revert leaves the /// vendor-pointing entry in Pipfile.lock, so deleting the uuid dir diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index f9df65b2..0a11f015 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -1,27 +1,6 @@ -//! pipenv wiring: a lock-ONLY `default`/`develop` entry rewrite of -//! `Pipfile.lock` (pipfile-spec 6). -//! -//! `pipenv verify` / `install --deploy` compare only `_meta.hash` (derived -//! from the Pipfile), so replacing a section entry with the V1/V2-captured -//! file-ref shape — `{"file": "./", "hashes": -//! ["sha256:"], "markers": }`, `index`/`version` dropped, -//! `_meta` untouched — survives `pipenv sync`, `install --deploy`, `verify` -//! and bare `pipenv install` byte-stably from a fresh checkout (spike -//! V2/V3). The serializer is pinned to pipenv's own -//! `json.dumps(obj, indent=4, sort_keys=True) + "\n"` (spike V7) so the lock -//! never churns. See `spikes/pipenv/` and the pipenv section of -//! `spikes/PHASE0-V2-FINDINGS.txt`. -//! -//! INTEGRITY caveat (spike V4, REFUTED claim): pipenv installs file-ref -//! entries through a separate pip phase with no `--hash`/`--require-hashes`, -//! so the recorded hash is NEVER enforced by pipenv itself — every vendor -//! run pushes a `vendor_integrity_unverified` warning and the committed -//! wheel bytes are the only tamper evidence (the hash we write becomes -//! enforced for free if pipenv ever fixes that phase). -//! -//! Drift caveat (spike V6): `pipenv lock` regenerates the entry to registry -//! shape and `pipenv update ` additionally rewrites the user's Pipfile -//! pin to `*` — both silent unpatch events; bare `pipenv install` is safe. +//! Pipenv lock-only wheel references preserve manifest hashes and categories. +//! Vendoring requires Pipenv 2018 or later; earlier installers cannot consume +//! portable relative wheel paths with integrity hashes. use std::path::Path; @@ -42,7 +21,14 @@ const LOCK_FILE: &str = "Pipfile.lock"; const KIND_LOCK_ENTRY: &str = "pipenv_lock_entry"; /// The Pipfile.lock sections searched/wired, in application order. -const SECTIONS: [&str; 2] = ["default", "develop"]; +fn category_names(lock: &Value) -> Vec { + lock.as_object() + .into_iter() + .flat_map(|map| map.keys()) + .filter(|key| key.as_str() != "_meta") + .cloned() + .collect() +} /// Guarded read shared in shape with the sibling backend twins: /// `open_regular_file` opens with `O_NONBLOCK` and rejects non-regular @@ -67,6 +53,10 @@ const NON_REGISTRY_KEYS: [&str; 6] = ["path", "git", "hg", "svn", "bzr", "editab pub(super) struct PipenvProject { /// Parsed lock (the edit substrate — re-serialized canonically). pub lock: Value, + /// The lock's line ending (`\r\n` when the checkout carries CRLF — git + /// autocrlf; Pipenv itself preserves it), reapplied on every write so the + /// wired lock and the reverted lock stay byte-comparable to the original. + pub crlf: bool, /// Non-fatal advisories raised during load. ALWAYS contains the /// `vendor_integrity_unverified` warning (spike V4: pipenv never enforces /// hashes on file-ref entries) — the orchestrator must surface these. @@ -133,27 +123,40 @@ pub(super) async fn load_pipenv_project( )); } + for section in category_names(&lock) { + if section.contains(':') || !lock[§ion].is_object() { + return Err(( + "pypi_pipenv_lock_parse_failed", + format!("invalid Pipenv category {section}"), + )); + } + } + // ALWAYS pushed (spike V4 refuted hash enforcement): the recorded hash is // self-documentation, not a pipenv-enforced check. let warnings = vec![VendorWarning::new( "vendor_integrity_unverified", - "pipenv never enforces the hashes recorded on file-ref lock entries (its file-ref \ - install phase invokes pip without --hash/--require-hashes), so the vendored wheel is \ - protected only by the committed wheel itself; `socket-patch verify` re-checks its \ - sha256 against the lock entry", + "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries \ + (2018–2022 verify them, 2023+ install a local wheel without checking), so the vendored \ + wheel is protected only by the committed wheel itself; `socket-patch vex --product ` \ + verifies the installed files against the patch record", )]; - Ok(PipenvProject { lock, warnings }) + Ok(PipenvProject { + lock, + crlf: lock_text.contains("\r\n"), + warnings, + }) } /// Target-specific guards (also re-run by [`wire_pipenv`] right before /// writing). Entries match by PEP 503 canonical NAME in `default` and -/// `develop`; there is no version guard — the file-ref entry carries no -/// version key and the spike proved pipenv accepts a version pin-down -/// (V3's 1.17.0 → 1.16.0 splice installed cleanly). +/// custom categories. Registry pins and existing vendored wheel identities +/// must both match the selected patch version. pub(super) fn check_target_guards( p: &PipenvProject, canon_name: &str, record_uuid: &str, + version: &str, ) -> Result { let entries = find_entries(&p.lock, canon_name); if entries.is_empty() { @@ -173,10 +176,29 @@ pub(super) fn check_target_guards( format!("{LOCK_FILE} {section}.{key} is not a JSON object"), )); }; - if let Some(file_ref) = obj.get("file").and_then(Value::as_str) { + if let Some(file_ref) = obj + .get("file") + .or_else(|| obj.get("path")) + .and_then(Value::as_str) + { match parse_vendor_path(file_ref) { // Ours, same patch generation. - Some(parts) if parts.eco == "pypi" && parts.uuid == record_uuid => continue, + Some(parts) if parts.eco == "pypi" && parts.uuid == record_uuid => { + let filename = file_ref.rsplit('/').next().unwrap_or(""); + let mut fields = filename.split('-'); + let matches_identity = fields.next().is_some_and(|name| canonicalize_pypi_name(name) == canon_name) && fields.next() == Some(version); + let conflicting_source = NON_REGISTRY_KEYS.iter().filter(|key| **key != "path").any(|key| obj.contains_key(*key)) + || (obj.contains_key("file") && obj.contains_key("path")) + || obj.contains_key("version") || obj.contains_key("index"); + if matches_identity && !conflicting_source + { + continue; + } + return Err(( + "pypi_pipenv_source_already_exists", + "vendored wheel identity or source changed".into(), + )); + } // Ours, but a STALE patch generation: wiring over it would // lose the only recorded registry original — refuse with the // repair path (mirrors gem's stale-checksum refusal). @@ -191,6 +213,19 @@ pub(super) fn check_target_guards( ), )) } + // Socket's own HOSTED reference (`scan --mode hosted`): the + // two modes do not take each other over for Pipenv yet — name + // the remedy instead of calling our wiring user-declared. + _ if is_socket_hosted_reference(file_ref) => { + return Err(( + "pypi_pipenv_source_already_exists", + format!( + "{LOCK_FILE} {section}.{key} already carries a HOSTED Socket patch \ + reference; run `socket-patch rollback` to unwind it before vendoring \ + (or keep using `scan --mode hosted`)" + ), + )) + } // A user-authored local file reference. _ => { return Err(( @@ -212,6 +247,12 @@ pub(super) fn check_target_guards( ), )); } + if obj.get("version").and_then(Value::as_str) != Some(format!("=={version}").as_str()) { + return Err(( + "pypi_pipenv_version_mismatch", + format!("{LOCK_FILE} {section}.{key} does not pin {version}"), + )); + } all_in_sync = false; } Ok(if all_in_sync { @@ -235,7 +276,15 @@ pub(super) async fn wire_pipenv( wheel_sha256_hex: &str, record_uuid: &str, ) -> Result<(Vec, PipenvMeta), (&'static str, String)> { - match check_target_guards(p, canon_name, record_uuid)? { + let version = rel_wheel + .rsplit('/') + .next() + .and_then(|filename| filename.split('-').nth(1)) + .ok_or(( + "pypi_pipenv_invalid_wheel", + "missing wheel version".to_owned(), + ))?; + match check_target_guards(p, canon_name, record_uuid, version)? { // Defensive: the orchestrator short-circuits in-sync pre-flight and // never calls wire on it (we must never re-record our own edit as an // "original"). @@ -254,8 +303,8 @@ pub(super) async fn wire_pipenv( let mut lock = p.lock.clone(); let mut wiring: Vec = Vec::new(); let mut sections: Vec = Vec::new(); - for section in SECTIONS { - let Some(map) = lock.get_mut(section).and_then(Value::as_object_mut) else { + for section in category_names(&lock) { + let Some(map) = lock.get_mut(§ion).and_then(Value::as_object_mut) else { continue; }; let keys: Vec = map @@ -269,13 +318,28 @@ pub(super) async fn wire_pipenv( // verbatim; index/version dropped (transitive entries never had // an index key — V3). let mut new_entry = Map::new(); - new_entry.insert("file".to_string(), Value::String(format!("./{rel_wheel}"))); + // Pipenv 2022 misparses local file URLs carrying extras. + let source_key = if old + .get("extras") + .and_then(Value::as_array) + .is_some_and(|extras| !extras.is_empty()) + { + "path" + } else { + "file" + }; + new_entry.insert( + source_key.to_string(), + Value::String(format!("./{rel_wheel}")), + ); new_entry.insert( "hashes".to_string(), Value::Array(vec![Value::String(format!("sha256:{wheel_sha256_hex}"))]), ); - if let Some(markers) = old.get("markers") { - new_entry.insert("markers".to_string(), markers.clone()); + for field in ["markers", "extras"] { + if let Some(value) = old.get(field) { + new_entry.insert(field.to_string(), value.clone()); + } } let new_value = Value::Object(new_entry); if old == new_value { @@ -289,6 +353,7 @@ pub(super) async fn wire_pipenv( // stale uuids refuse in the guards). let was_vendored = old .get("file") + .or_else(|| old.get("path")) .and_then(Value::as_str) .and_then(parse_vendor_path) .is_some(); @@ -301,13 +366,13 @@ pub(super) async fn wire_pipenv( original: if was_vendored { None } else { Some(old) }, new: Some(new_value), }); - if !sections.iter().any(|s| s == section) { + if !sections.iter().any(|s| s == §ion) { sections.push(section.to_string()); } } } - let new_text = to_canonical_json(&lock); + let new_text = with_line_ending(to_canonical_json(&lock), p.crlf); atomic_write_bytes_preserving_mode(&root.join(LOCK_FILE), new_text.as_bytes()) .await .map_err(|e| { @@ -386,7 +451,7 @@ pub(super) async fn revert_pipenv( warnings.push(drifted()); continue; }; - if !SECTIONS.contains(§ion) { + if section == "_meta" || section.is_empty() { warnings.push(drifted()); continue; } @@ -403,11 +468,57 @@ pub(super) async fn revert_pipenv( if map.get(name) == rec.original.as_ref() { continue; } - let (Some(new_value), Some(live)) = (rec.new.as_ref(), map.get(name)) else { + let Some(new_value) = rec.new.as_ref() else { warnings.push(drifted()); continue; }; - if live != new_value { + let Some(live) = map.get(name) else { + if rec.action == WiringAction::Rewritten && rec.original.is_some() { + // A relock dropped the entry (`pipenv uninstall `, a Pipfile + // edit + `pipenv lock`): the vendored reference is gone with + // it — retire the record rather than keep the orphan forever. + warnings.push(VendorWarning::new( + "vendor_lock_entry_relocked", + format!("{LOCK_FILE} entry for {:?} was removed by a relock; the vendored reference is already gone, so the record is retired", rec.key), + )); + } else { + warnings.push(drifted()); + } + continue; + }; + // Still OUR reference (`file`/`path` string identical to what we + // wrote) with the rest re-serialized by Pipenv — 2023+ relocks an + // entry excluded by its marker keeping the reference but restoring + // the registry `hashes`/`version`: restore the original like an + // untouched entry. + let same_reference = rec.action == WiringAction::Rewritten + && rec.original.is_some() + && crate::patch::redirect::pipenv_reserialized_around_reference(live, new_value); + if live != new_value && !same_reference { + // RELOCKED (not drift): `pipenv lock` / `update` regenerated the + // entry to registry shape with a different hash list or key set + // than the recorded original (Pipenv 2022 does; 2026 reproduces + // the original byte for byte and converges above). The vendored + // reference is already gone and the user's fresh resolution + // stands, so the record retires — keeping the artifact dir and + // ledger entry forever would be the drift-keep for a reference + // nothing points at any more. A live entry that still carries a + // `file`/`path` reference we did not write IS drift. + let registry_shaped = live + .as_object() + .is_some_and(|object| !object.contains_key("file") && !object.contains_key("path")); + let rewritten_with_original = + rec.action == WiringAction::Rewritten && rec.original.is_some(); + if registry_shaped && rewritten_with_original { + warnings.push(VendorWarning::new( + "vendor_lock_entry_relocked", + format!( + "{LOCK_FILE} entry for {:?} was regenerated to a registry reference by a relock; the vendored reference is already gone, so the record is retired", + rec.key + ), + )); + continue; + } warnings.push(drifted()); continue; } @@ -430,7 +541,7 @@ pub(super) async fn revert_pipenv( // Only re-serialize when something was restored: a no-op revert must not // churn a lock whose formatting we did not produce. if changed && !dry_run { - let new_text = to_canonical_json(&lock); + let new_text = with_line_ending(to_canonical_json(&lock), lock_text.contains("\r\n")); if let Err(e) = atomic_write_bytes_preserving_mode(&lock_path, new_text.as_bytes()).await { return RevertOutcome { kept_artifact: false, @@ -451,15 +562,18 @@ pub(super) async fn revert_pipenv( // ── helpers ────────────────────────────────────────────────────────────── /// Every `(section, key, entry)` whose key canonicalizes to `canon_name`. -fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'static str, String, &'a Value)> { +fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'a str, String, &'a Value)> { let mut out = Vec::new(); - for section in SECTIONS { - let Some(map) = lock.get(section).and_then(Value::as_object) else { + for (section, value) in lock.as_object().into_iter().flat_map(|map| map.iter()) { + if section == "_meta" { + continue; + } + let Some(map) = value.as_object() else { continue; }; for (key, value) in map { if canonicalize_pypi_name(key) == canon_name { - out.push((section, key.clone(), value)); + out.push((section.as_str(), key.clone(), value)); } } } @@ -470,6 +584,27 @@ fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'static str, Str /// at every nesting level, default separators, one trailing newline — /// byte-identical to `json.dumps(obj, indent=4, sort_keys=True) + "\n"` for /// the ASCII content pipenv locks carry. +/// A hosted Socket patch reference as `scan --mode hosted` writes it: +/// `https:///patch/pypi/////[#sha256=…]`. +fn is_socket_hosted_reference(value: &str) -> bool { + let Some(rest) = value.strip_prefix("https://") else { + return false; + }; + let path = rest.split_once('/').map(|(_, path)| path).unwrap_or(""); + let path = path.split('#').next().unwrap_or(""); + let parts: Vec<&str> = path.split('/').collect(); + parts.len() == 7 && parts[0] == "patch" && parts[1] == "pypi" && parts[6].ends_with(".whl") +} + +/// Pipenv preserves a lock's CRLF line endings; so do we, on both writes. +fn with_line_ending(text: String, crlf: bool) -> String { + if crlf { + text.replace('\n', "\r\n") + } else { + text + } +} + fn to_canonical_json(value: &Value) -> String { fn sorted(value: &Value) -> Value { match value { @@ -611,7 +746,7 @@ mod tests { "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81" ], "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2'", - "version": "==1.17.0" + "version": "==1.16.0" } }, "develop": {} @@ -723,7 +858,7 @@ mod tests { let tmp = write_lock(before).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh ); @@ -858,7 +993,7 @@ mod tests { // package missing from both sections let tmp = write_lock(LOCK_DIRECT_REGISTRY).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "absent-pkg", UUID).unwrap_err(); + let err = check_target_guards(&p, "absent-pkg", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_lock_package_missing"); // user-declared file reference @@ -868,7 +1003,7 @@ mod tests { ); let tmp = write_lock(&user).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("user-declared"), "{}", err.1); @@ -879,7 +1014,7 @@ mod tests { ); let tmp = write_lock(&git).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("git"), "{}", err.1); @@ -904,12 +1039,12 @@ mod tests { let tmp = write_lock(LOCK_DIRECT_VENDORED).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::InSync ); let stale_uuid = "00000000-0000-4000-8000-000000000000"; - let err = check_target_guards(&p, "six", stale_uuid).unwrap_err(); + let err = check_target_guards(&p, "six", stale_uuid, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("--revert"), "{}", err.1); assert!(err.1.contains(UUID), "names the wired uuid: {}", err.1); @@ -921,7 +1056,7 @@ mod tests { async fn load_and_guards_write_nothing() { let tmp = write_lock(LOCK_DIRECT_REGISTRY).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let _ = check_target_guards(&p, "six", UUID).unwrap(); + let _ = check_target_guards(&p, "six", UUID, "1.16.0").unwrap(); assert_eq!(read_lock(tmp.path()).await, LOCK_DIRECT_REGISTRY); } @@ -1170,10 +1305,14 @@ mod tests { new: Some(serde_json::json!("x")), }); - // Drift: someone replaced our hash in the vendored entry. - let drifted = read_lock(tmp.path()) - .await - .replace(WHEEL_SHA, &"0".repeat(64)); + // Drift: someone hand-edited the vendored entry's marker (a hash-only + // change next to our intact reference is what a Pipenv relock does + // and is restored, not drift — see `reserialized_around_reference`). + let drifted = { + let mut live: Value = serde_json::from_str(&read_lock(tmp.path()).await).unwrap(); + live["default"]["six"]["markers"] = serde_json::json!("python_version >= '3.99'"); + to_canonical_json(&live) + }; tokio::fs::write(tmp.path().join("Pipfile.lock"), &drifted) .await .unwrap(); @@ -1207,7 +1346,7 @@ mod tests { let tmp = write_lock(&to_canonical_json(&lock)).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_lock_parse_failed"); assert!( err.1.contains("default.six is not a JSON object"), @@ -1248,7 +1387,7 @@ mod tests { let tmp = write_lock(&before_text).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh, "the absent develop section is skipped, not an error" ); @@ -1281,7 +1420,7 @@ mod tests { let tmp = write_lock(&before_text).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh, "the registry-shaped develop entry keeps the target Fresh" ); @@ -1435,10 +1574,14 @@ mod tests { let outcome = revert_pipenv(&entry_for(vec![record], meta), tmp.path(), false).await; assert!(outcome.success, "{label}: {:?}", outcome.error); assert_eq!(outcome.warnings.len(), 1, "{label}: {:?}", outcome.warnings); - assert_eq!( - outcome.warnings[0].code, "vendor_lock_entry_drifted", - "{label}" - ); + // An entry a relock REMOVED retires the record (the reference is + // gone with it); every other mismatch is drift. + let expected = if label.contains("entry removed") { + "vendor_lock_entry_relocked" + } else { + "vendor_lock_entry_drifted" + }; + assert_eq!(outcome.warnings[0].code, expected, "{label}"); assert!( outcome.warnings[0].detail.contains(key), "{label}: {}", @@ -1559,4 +1702,27 @@ mod tests { "failed write leaves the wired lock intact" ); } + #[tokio::test] + async fn custom_categories_preserve_extras_and_refuse_version_conflicts() { + let mut lock: Value = serde_json::from_str(LOCK_DIRECT_REGISTRY).unwrap(); + let mut dependency = lock["default"]["six"].take(); + dependency["extras"] = serde_json::json!(["test"]); + lock["default"] = serde_json::json!({}); + lock["tests"] = serde_json::json!({"Six":dependency}); + let before = to_canonical_json(&lock); + let tmp = write_lock(&before).await; + let project = load_pipenv_project(tmp.path()).await.unwrap(); + assert!(check_target_guards(&project, "six", UUID, "1.17.0").is_err()); + let (wiring, meta) = wire_default(&project, tmp.path()).await; + let rewritten: Value = serde_json::from_str(&read_lock(tmp.path()).await).unwrap(); + assert_eq!( + rewritten["tests"]["Six"]["extras"], + serde_json::json!(["test"]) + ); + assert_eq!(meta.sections, vec!["tests"]); + let entry = entry_for(wiring, meta); + let reverted = revert_pipenv(&entry, tmp.path(), false).await; + assert!(reverted.success); + assert_eq!(read_lock(tmp.path()).await, before); + } } diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs index c67b7048..e5d4f488 100644 --- a/crates/socket-patch-core/src/vendor/registry_fetch.rs +++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs @@ -308,9 +308,15 @@ fn pypi_json_api_base() -> String { /// The hash, not the filename, selects the file, so a lock that names a wheel /// PyPI has since re-uploaded under the same name cannot be satisfied by /// different bytes — the download is still verified against the same hash. +/// +/// `candidates` is the lock's digest set: a single digest (poetry.lock names +/// the wheel) takes the first release file carrying it; several digests +/// (Pipfile.lock lists every release file's hash) take the pure-Python +/// `-none-any.whl` whose digest is in the set — a platform wheel or sdist is +/// never chosen, because the vendored wheel must install everywhere. async fn resolve_pypi_url_by_hash( entry: &LockfileEntry, - sha256: &str, + candidates: &[String], client: &reqwest::Client, ) -> Result { let api = format!( @@ -332,23 +338,52 @@ async fn resolve_pypi_url_by_hash( let body: serde_json::Value = resp.json().await.map_err(|e| { FetchError::Failed(format!("PyPI JSON API response for {} is not JSON: {e}", entry.purl)) })?; - body.get("urls") + let digest_matches = |file: &serde_json::Value| { + file.get("digests") + .and_then(|d| d.get("sha256")) + .and_then(serde_json::Value::as_str) + .is_some_and(|d| candidates.iter().any(|c| d.eq_ignore_ascii_case(c))) + }; + let is_pure_wheel = |file: &serde_json::Value| { + file.get("filename") + .and_then(serde_json::Value::as_str) + .or_else(|| file.get("url").and_then(serde_json::Value::as_str)) + .is_some_and(|name| { + name.split(['?', '#']) + .next() + .is_some_and(|n| n.ends_with("-none-any.whl")) + }) + }; + let files: Vec<&serde_json::Value> = body + .get("urls") .and_then(serde_json::Value::as_array) .into_iter() .flatten() - .find(|file| { - file.get("digests") - .and_then(|d| d.get("sha256")) - .and_then(serde_json::Value::as_str) - .is_some_and(|d| d.eq_ignore_ascii_case(sha256)) - }) + .filter(|file| digest_matches(file)) + .collect(); + let chosen = if candidates.len() == 1 { + files.first().copied() + } else { + files.iter().copied().find(|file| is_pure_wheel(file)) + }; + chosen .and_then(|file| file.get("url").and_then(serde_json::Value::as_str)) .map(str::to_string) .ok_or_else(|| { - FetchError::Unverifiable(format!( - "no PyPI release file for {}@{} matches the lockfile's sha256 {sha256}", - entry.name, entry.version - )) + FetchError::Unverifiable(if candidates.len() == 1 { + format!( + "no PyPI release file for {}@{} matches the lockfile's sha256 {}", + entry.name, entry.version, candidates[0] + ) + } else { + format!( + "no platform-independent (`-none-any.whl`) PyPI release file for {}@{} \ + matches any of the {} sha256 digests the lockfile records", + entry.name, + entry.version, + candidates.len() + ) + }) }) } @@ -361,7 +396,13 @@ async fn fetch_pypi( // poetry.lock records the wheel's hash but no URL: look the file up // by that hash (verified again after download). (None, LockIntegrity::Sha256Hex(sha256)) => { - resolve_pypi_url_by_hash(entry, sha256, client).await? + resolve_pypi_url_by_hash(entry, std::slice::from_ref(sha256), client).await? + } + // Pipfile.lock records every release file's hash without filenames: + // pick the pure wheel whose digest is in the set (verified again + // after download against that set). + (None, LockIntegrity::Sha256AnyOf(digests)) => { + resolve_pypi_url_by_hash(entry, digests, client).await? } (None, _) => { return Err(FetchError::Unverifiable(format!( @@ -921,6 +962,17 @@ fn verify_integrity(bytes: &[u8], integrity: &LockIntegrity) -> Result<(), Fetch ))) } } + LockIntegrity::Sha256AnyOf(expected) => { + let actual = hex::encode(Sha256::digest(bytes)); + if expected.iter().any(|e| actual.eq_ignore_ascii_case(e)) { + Ok(()) + } else { + Err(FetchError::Failed(format!( + "sha256 mismatch: downloaded bytes hash to {actual}, which is none of the {} digests the lockfile records", + expected.len() + ))) + } + } LockIntegrity::BerryChecksum(_) | LockIntegrity::GoH1(_) => Err(FetchError::Unverifiable( "verifier handled by a dedicated ecosystem fetcher".to_string(), )), @@ -1885,6 +1937,103 @@ mod tests { } } + /// Pipfile.lock records EVERY release file's digest without filenames: + /// the fetcher must pick the pure-Python wheel by digest (never the sdist + /// or a platform wheel that also matches), verify the download against + /// the set, and refuse when no pure wheel's digest is recorded. + #[tokio::test] + #[serial_test::serial] + async fn pypi_digest_set_entry_picks_the_pure_wheel_by_hash() { + let wheel = make_zip(&[ + ("requests/__init__.py", b"__version__ = '2.28.0'\n"), + ("requests-2.28.0.dist-info/RECORD", b"requests/__init__.py,sha256=abc,24\n"), + ]); + let wheel_sha = hex::encode(Sha256::digest(&wheel)); + let sdist_sha = "0".repeat(64); + let platform_sha = "9".repeat(64); + let mock = MockServer::start().await; + Mock::given(method("GET")) + .and(url_path("/packages/requests-2.28.0-py3-none-any.whl")) + .respond_with(ResponseTemplate::new(200).set_body_bytes(wheel)) + .mount(&mock) + .await; + Mock::given(method("GET")) + .and(url_path("/packages/requests-2.28.0.tar.gz")) + .respond_with(ResponseTemplate::new(200).set_body_bytes(b"sdist bytes".to_vec())) + .mount(&mock) + .await; + Mock::given(method("GET")) + .and(url_path("/pypi/requests/2.28.0/json")) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "urls": [ + {"filename": "requests-2.28.0.tar.gz", "url": format!("{}/packages/requests-2.28.0.tar.gz", mock.uri()), "digests": {"sha256": sdist_sha}}, + {"filename": "requests-2.28.0-cp312-cp312-manylinux_2_17_x86_64.whl", "url": format!("{}/packages/requests-2.28.0-cp312-cp312-manylinux_2_17_x86_64.whl", mock.uri()), "digests": {"sha256": platform_sha}}, + {"filename": "requests-2.28.0-py3-none-any.whl", "url": format!("{}/packages/requests-2.28.0-py3-none-any.whl", mock.uri()), "digests": {"sha256": wheel_sha.to_uppercase()}}, + ] + }))) + .mount(&mock) + .await; + let saved = std::env::var("SOCKET_PYPI_JSON_API").ok(); + std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi/", mock.uri())); + let restore = || match &saved { + Some(v) => std::env::set_var("SOCKET_PYPI_JSON_API", v), + None => std::env::remove_var("SOCKET_PYPI_JSON_API"), + }; + let entry = LockfileEntry { + ecosystem: "pypi", + name: "requests".into(), + version: "2.28.0".into(), + purl: "pkg:pypi/requests@2.28.0".into(), + resolved: None, + // sdist first, like Pipenv writes them: the ORDER must not pick + // the sdist. + integrity: LockIntegrity::Sha256AnyOf(vec![ + sdist_sha.clone(), + platform_sha.clone(), + wheel_sha.clone(), + ]), + }; + let fetched = fetch_and_stage(&entry, &build_registry_client()).await; + // Only the sdist's and a platform wheel's digests recorded: no pure + // wheel to choose → refused before any download. + let no_pure = LockfileEntry { + integrity: LockIntegrity::Sha256AnyOf(vec![sdist_sha.clone(), platform_sha.clone()]), + ..entry.clone() + }; + let no_pure_result = fetch_and_stage(&no_pure, &build_registry_client()).await; + // Digests no release file carries → refused. + let unknown = LockfileEntry { + integrity: LockIntegrity::Sha256AnyOf(vec!["1".repeat(64), "2".repeat(64)]), + ..entry.clone() + }; + let unknown_result = fetch_and_stage(&unknown, &build_registry_client()).await; + restore(); + let fetched = fetched.unwrap(); + assert!(fetched.dir().join("requests/__init__.py").is_file()); + assert!(fetched.url.ends_with("requests-2.28.0-py3-none-any.whl"), "{}", fetched.url); + for (label, result) in [("no pure wheel", no_pure_result), ("unknown", unknown_result)] { + match result { + Err(FetchError::Unverifiable(msg)) => { + assert!(msg.contains("none-any.whl") && msg.contains("digests"), "{label}: {msg}") + } + other => panic!("{label}: expected Unverifiable, got {other:?}"), + } + } + // The verifier itself: bytes matching ANY recorded digest pass, others fail. + let set = LockIntegrity::Sha256AnyOf(vec![sdist_sha.clone(), wheel_sha.clone()]); + // "sdist bytes" is not the recorded sdist digest ("000…"), so it must fail. + assert!(verify_integrity(b"sdist bytes", &set).is_err()); + let real_sdist = LockIntegrity::Sha256AnyOf(vec![ + hex::encode(Sha256::digest(b"sdist bytes")), + wheel_sha, + ]); + assert!(verify_integrity(b"sdist bytes", &real_sdist).is_ok()); + match verify_integrity(b"other", &real_sdist) { + Err(FetchError::Failed(msg)) => assert!(msg.contains("none of the 2 digests"), "{msg}"), + other => panic!("expected Failed, got {other:?}"), + } + } + #[cfg(unix)] fn mkfifo(path: &Path) { use std::os::unix::ffi::OsStrExt; diff --git a/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile new file mode 100644 index 00000000..8a12e2fc --- /dev/null +++ b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile @@ -0,0 +1,9 @@ +[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +urllib3 = "==1.26.18" + +[dev-packages] diff --git a/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock new file mode 100644 index 00000000..d6f38a9d --- /dev/null +++ b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock @@ -0,0 +1,28 @@ +{ + "_meta": { + "hash": { + "sha256": "b6b240f36bc7ccbb0c915e475181b938fc5ceaf4808b3e1c2f1381a76c7426f8" + }, + "pipfile-spec": 6, + "requires": {}, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": { + "urllib3": { + "hashes": [ + "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07", + "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0" + ], + "index": "pypi", + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "version": "==1.26.18" + } + }, + "develop": {} +} diff --git a/docs/ecosystems.md b/docs/ecosystems.md index 2361843b..57a061d2 100644 --- a/docs/ecosystems.md +++ b/docs/ecosystems.md @@ -15,7 +15,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g. | Ecosystem | agent (`--mode agent`) | vendored (`--mode vendored`) | hosted (`--mode hosted`) | |-----------|------------------------|------------------------------|--------------------------| | npm (`npm`) — pnpm / yarn / berry / bun | ✅ any install layout; `setup` postinstall hook | ✅ six lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun `bun.lock` (binary `bun.lockb` refused with a `--save-text-lockfile` pointer). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun — pnpm, berry, and bun carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) | -| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock..toml`, poetry, pdm, pipenv (lock rewired, but pipenv doesn't hash-check file entries — `vendor_integrity_unverified` warning; the committed wheel bytes are the protection), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). **pdm / pipenv locks are not rewritten** — use vendored | +| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock..toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). **pdm locks are not rewritten** — use vendored | | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry | ✅ per-patch sparse registry (`[registries.socket-patch-]` + Cargo.lock source/checksum) | | RubyGems (`gem`) | ✅ Bundler plugin via `setup` — needs bundler ≥ 2.2 (1.x cannot load `plugin ... path:` directives; `setup` refuses below the floor and `setup --check` red-flags a wired 1.x project) | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") | | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy | diff --git a/docs/testing/hosted-production-e2e.md b/docs/testing/hosted-production-e2e.md index 53aae87b..a35da37d 100644 --- a/docs/testing/hosted-production-e2e.md +++ b/docs/testing/hosted-production-e2e.md @@ -71,7 +71,7 @@ failure instead of N confusing ones that look like CLI regressions. | Ecosystem | Hosted mode | Free patches in production | Suite coverage | |-----------|-------------|----------------------------|----------------| | npm | ✅ | ✅ many | ✅ npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun | -| PyPI | ✅ (requirements.txt + uv.lock only) | ✅ many | ✅ requirements.txt, uv.lock | +| PyPI | ✅ (requirements.txt, uv.lock, Pipfile.lock) | ✅ many | ✅ requirements.txt, uv.lock, Pipfile.lock | | RubyGems | ✅ | ✅ (this suite pins one purl/UUID: `activestorage@6.0.3`; the 2026-08-18 republish covers more versions) | ✅ full bundler install proof | | Cargo | ✅ | ❌ **none** (tier emptied 2026-08-28) | canary only | | Maven | ✅ | ❌ **none** | canary only | @@ -101,13 +101,15 @@ history of this demotion shows every piece to restore (catalog constants, preflight registration, the install-proof leg, and these tables) in both production suites. -PyPI's pdm / pipenv locks are **not** rewritten by hosted mode (see the -[matrix](../ecosystems.md#mode--ecosystem-matrix)); those flavors are vendored-mode -only, so there is no hosted leg to write for them. `poetry.lock` IS rewritten +PyPI's pdm lock is **not** rewritten by hosted mode (see the +[matrix](../ecosystems.md#mode--ecosystem-matrix)); that flavor is vendored-mode +only, so there is no hosted leg to write for it. `poetry.lock` IS rewritten (Poetry 1.0+); its live coverage is the per-release matrix in [poetry-compatibility.md](poetry-compatibility.md) (`scripts/backtest-poetry.py`), -which installs the redirected lock with every Poetry release rather than one -pinned installer, so it is not duplicated as a leg here. +and `Pipfile.lock` IS rewritten (Pipenv 7+); its live coverage is the per-release +matrix in [pipenv-compatibility.md](pipenv-compatibility.md) +(`scripts/backtest-pipenv.py`). Both install the redirected lock with every +release rather than one pinned installer, so they are not duplicated as legs here. Two supported hosted shapes are deliberately **not** covered here: diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md new file mode 100644 index 00000000..d758b72a --- /dev/null +++ b/docs/testing/pipenv-compatibility.md @@ -0,0 +1,189 @@ +# Pipenv compatibility and production backtests + +`socket-patch` supports hosted, vendored and agent-mode Python patches in +Pipenv projects. The tests use real Pipenv releases, real PyPI artifacts and +the public Socket patch service. Rewriting alone is not an installation +result: the backtest reinstalls from the rewritten `Pipfile.lock` (fresh +clone, warm venv, lock-only checkout) and compares the installed bytes with +the published patch. + +This supplements the [hosted](hosted-production-e2e.md) and +[vendored](vendored-production-e2e.md) production suites; see the +[ecosystem matrix](../ecosystems.md#mode--ecosystem-matrix) for the other +package managers and [uv compatibility](uv-compatibility.md) for the uv / +requirements.txt lanes of the same ecosystem. + +## Formats and rewrite behavior + +| Input | Hosted | Vendored | Agent | +|-------|--------|----------|-------| +| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi//`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the project's venv — in-project `.venv`, `VIRTUAL_ENV`, or Pipenv's default `$WORKON_HOME/-[-]` (discovered without running Pipenv). | +| `Pipfile.lock`, `pipfile-spec` < 6 (Pipenv 0–6) | Refused (`redirect_pipenv_skipped`), lock untouched. | Refused (`pypi_pipenv_spec_unsupported`). | Works. | +| Lock-only checkout (nothing installed) | Discovered from the lock and redirected. | Discovered from the lock; the pristine wheel is fetched by one of the lock's recorded digests (Pipenv records every release file's sha256 without filenames) through PyPI's JSON API, verified against the same digest, and the patched wheel comes from the service. | Nothing to patch (no installed distribution); the lock's pins are listed as lockfile-only packages. | + +Both hash fields are load-bearing: Pipenv 2023+ verifies the `#sha256=` URL +fragment, 2018–2022 verify the `hashes` list, Pipenv 11 accepts either. A +tampered hosted reference fails to install on every supported release. +Pipenv 2023+ does not verify the hash of a *local* wheel (vendored mode), so +the committed wheel bytes are the protection there; `socket-patch vex +--product ` re-verifies the installed files (a Pipfile names no +project, so the product purl must be passed explicitly). + +## Installer boundaries (measured) + +Measured with the last stable release of every published Pipenv major +(`releases.json` of the depscan harness, PyPI as of 2026-09-17): 0.2.8, +3.6.2, 4.1.4, 5.4.2, 6.2.9, 7.9.10, 8.3.2, 9.1.0, 10.1.2, 11.10.4, +2018.11.26, 2020.11.15, 2021.11.23, 2022.12.19, 2023.12.1, 2024.4.1, +2025.1.3, 2026.8.0. Pre-2018 releases run on Python 3.6 (they no longer +import on modern Pythons); 2018–2022 on Python 3.8; 2023+ on Python 3.12. + +- **Warm virtualenvs are never reinstalled.** With the same release already + installed, `pipenv install`, `pipenv install --deploy` and `pipenv sync` + exit 0 and keep the upstream bytes — on every major, hosted and vendored. + The rewritten lock protects fresh installs; the CLI warns + (`redirect_pypi_stale_install` / `pypi_pipenv_stale_install`) while a + venv still holds the upstream release. Verified remedies (Pipfile + byte-untouched): `pipenv run pip uninstall -y && pipenv sync`, or + `pipenv --rm && pipenv sync`. `pipenv uninstall ` is **not** a remedy: + it rewrites the Pipfile and re-locks the patch away. `PIP_FORCE_REINSTALL=1 + pipenv sync` works on 2018 but is ignored by 2026. +- **Relocking drops the reference.** `pipenv lock` (and `update`, and + `install ` on releases before 2024, where it is a full relock) + regenerates the redirected entry to its registry reference on every major, + hosted and vendored — a silent unpatch. Re-run Socket Patch afterwards; + `rollback` retires the stale record cleanly (2026 reproduces the original + entry byte for byte, 2022 writes a different hash list, `pipenv uninstall` + removes the entry — all are the desired end state, not drift). Pipenv 2023+ + keep a hosted reference on an entry excluded by its marker and re-serialize + it; that is still ours and rolls back. +- **Reference key by release.** Pipenv 7–11 install only `path` references + (`file` fails); 2018 and later install `file`. The CLI probes + `pipenv --version` on absolute `PATH` entries (every release prints + `pipenv, version X`) only when a patch targets the lock; + `SOCKET_PIPENV_MAJOR=` pins the answer for CI images without pipenv. +- **Line endings.** Pipenv preserves a CRLF lock (git autocrlf); so do both + rewriters and both rollbacks, and a checkout that converted the file + between the redirect and the rollback still restores. +- **Vendored refusal for 7–11.** Those releases cannot reliably consume + vendored wheel references; hosted mode covers them. +- **Command availability.** `--ignore-pipfile` and `--venv` arrive with + Pipenv 3, `--deploy` with 9, `pipenv sync` with 2018, `pipenv verify` with + 2020, `pipenv requirements` with 2022 (it exports the hosted URL / vendored + path). Pipenv 0.x has no `WORKON_HOME` placement to discover. +- **Out-of-tree venv naming** is unchanged from Pipenv 7 through 2026: + `sanitize()[:42]-<8 chars of urlsafe-base64(sha256())>`, plus `-` when that variable is set (the + interpreter's basename on 2026, the full string on 2018 and 11). The + crawler reproduces it (and honours the `.venv` file pointer, + `PIPENV_CUSTOM_VENV_NAME`, `PIPENV_PIPFILE`, `WORKON_HOME` and Pipenv's + case-insensitive-filesystem fallback) so a bare `scan`/`rollback` sees the + project's venv; before, it fell through to the global interpreter and + reported success while the venv stayed unpatched. +- **CLI scope.** The CLI reads `/Pipfile.lock` and discovers the + project's venv from that directory; it does not walk up to a parent + Pipfile the way Pipenv does (`PIPENV_MAX_DEPTH`) and does not follow + `PIPENV_PIPFILE` to another project's lock. Run it in the project + directory (or pass `--cwd`). + +## Running the matrix + +```sh +cargo build -p socket-patch-cli +cp target/debug/socket-patch /tmp/socket-patch-under-test +scripts/backtest-pipenv.py \ + --socket-patch /tmp/socket-patch-under-test \ + --socket-patch-revision "$(git rev-parse --short HEAD)" \ + --output /tmp/pipenv-compat \ + --modes hosted vendored agent agent-oot \ + --shapes direct dev category marker marker-excluded extras transitive crlf \ + --jobs 4 +scripts/backtest-pipenv.py --render-doc-table /tmp/pipenv-compat/summary.json +``` + +Needs network (PyPI + patch.socket.dev), `uv`, Docker for the pre-2018 +releases (they run inside `python:3.6.15-slim` through a host-side `pipenv` +wrapper, so the CLI's installer probe sees them) and no Socket token (the +fixture dependency is `urllib3 1.26.18`, which has a public free-tier +patch). Copy the binary out of `target/` first — a rebuild would swap it +under the run. Concurrent invocations must use disjoint version/shape sets. + +Per (release, shape, mode) the harness checks: the lock-only fresh checkout, +`--dry-run` parity (hosted; the vendored preview is ledger-only by design and +is recorded), an idempotent re-scan, the untouched Pipfile and `_meta`, the +expected reference key, every category rewritten with markers/extras kept, +the stale-install warning over a warm venv, whether Pipenv reinstalls a warm +venv (recorded), the lock-driven install into an emptied venv with the +installed bytes checked against the patch record's Git blob SHA-256 hashes, a +fresh clone of the committed state, `pipenv verify` / `requirements`, tamper +rejection, what `pipenv lock` does to the entry, rollback after that relock +(a registry-shaped entry is kept and only the ledger retires; the Pipenv 2023+ +hybrid that still carries our reference rolls back to the original entry), +`vex`, and a byte-exact `rollback`. Agent mode additionally checks that +repeat installs and `sync` keep the in-place patch, and the out-of-tree leg +requires the bare scan to see Pipenv's venv. + +## Results + + +### macOS — full matrix (18 majors × 8 shapes × 4 modes) + +CLI revision `e521093`: **470 cases, 470 pass** (103 expected refusals, 36 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| 0.2.8 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover) | none | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 3.6.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 4.1.4 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 5.4.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 6.2.9 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 7.9.10 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image) | none | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 8.3.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 9.1.0 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 10.1.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 11.10.4 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 2018.11.26 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2020.11.15 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2021.11.23 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2022.12.19 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 0 / 0 | +| 2023.12.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2024.4.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2025.1.3 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2026.8.0 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | + +### Linux — release binary in a container (2018+ majors, direct shape, 4 modes) + +CLI revision `e521093`: **32 cases, 32 pass** (0 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| 2018.11.26 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2020.11.15 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2021.11.23 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2022.12.19 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 0 / 0 | +| 2023.12.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2024.4.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2025.1.3 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2026.8.0 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | + +### Invocation variants (`--cwd`, nested `--cwd`, symlinked project directory; direct shape, 4 modes) + +CLI revision `e521093`: **48 cases, 48 pass** (3 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | invocation | hosted | vendored | agent | agent-oot | +| --- | --- | --- | --- | --- | --- | +| 11.10.4 | `--cwd ` | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 11.10.4 | `--cwd` from a nested directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 11.10.4 | symlinked project directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 2018.11.26 | `--cwd ` | pass | pass | pass | pass | +| 2018.11.26 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2018.11.26 | symlinked project directory | pass | pass | pass | pass | +| 2022.12.19 | `--cwd ` | pass | pass | pass | pass | +| 2022.12.19 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2022.12.19 | symlinked project directory | pass | pass | pass | pass | +| 2026.8.0 | `--cwd ` | pass | pass | pass | pass | +| 2026.8.0 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2026.8.0 | symlinked project directory | pass | pass | pass | pass | + +Every `pass` cell verified the installed `urllib3/response.py` against the patch record's Git blob SHA-256 after a real Pipenv install. Columns: `warm venv re-installed` and `relock keeps patch` are measured Pipenv boundaries (see above), not requirements; `pipenv verify` exit 2 means the subcommand does not exist on that release. Per-case checks, notes and harness provenance: [`results.json`](pipenv-compatibility/results.json). + diff --git a/docs/testing/pipenv-compatibility/results.json b/docs/testing/pipenv-compatibility/results.json new file mode 100644 index 00000000..755e0c00 --- /dev/null +++ b/docs/testing/pipenv-compatibility/results.json @@ -0,0 +1,72046 @@ +{ + "capturedOn": "2026-09-18", + "cliRevision": "e521093", + "runs": { + "invocations": { + "errors": [], + "platform": "macOS 15 (arm64), native CLI", + "provenance": { + "capturedAt": "2026-09-18T14:21:08.543839+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "cwd-flag", + "subdir", + "symlink" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "2026.8.0", + "2022.12.19", + "2018.11.26", + "11.10.4" + ], + "shapes": [ + "direct" + ] + }, + "results": [ + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-cwd-flag/venvs/project-wAwCAktN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-subdir/venvs/app-4oK9yKve-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-symlink/venvs/project-RoaKTazg-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages stil" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still di" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-cwd-flag/venvs/project-uP3pTgYV-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-subdir/venvs/app-ABVCOMdn-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-symlink/venvs/project-Xepy222U-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.ve" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so " + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/l" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-cwd-flag/venvs/project-4nuNhCus-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-subdir/venvs/app-ePSOQNAV-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-symlink/venvs/project-q4pR13ah-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.ve" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-subdir/nested/app/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so " + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/l" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-cwd-flag/venvs/project-PAsYMkTS-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-subdir/venvs/app-bSlpRn1y-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-symlink/venvs/project-GgQxs9OK-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages st" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byt" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still " + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + } + ] + }, + "linux": { + "errors": [], + "platform": "Debian 12 (arm64) container, release CLI", + "provenance": { + "capturedAt": "2026-09-18T14:23:15.899056+00:00", + "cliRevision": "e521093", + "cliSha256": "dea3c3fdf39512216dc382aaca5f07ce88eeeef1b7cf38683068956a71c42c04", + "host": "Linux aarch64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "direct" + ] + }, + "results": [ + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2018.11.26-direct-agent-oot/venvs/project-mF2HGUnO-/out/tools/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2020.11.15-direct-agent-oot/venvs/project-69ycha_K-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2021.11.23-direct-agent-oot/venvs/project-Gx4HxHSi-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2022.12.19-direct-agent-oot/venvs/project-0g61h4-J-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///out/final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2023.12.1-direct-agent-oot/venvs/project-PVj1ALdm-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2024.4.1-direct-agent-oot/venvs/project-Q1XxEGgw-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2025.1.3-direct-agent-oot/venvs/project-ZiSwsYIx-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2026.8.0-direct-agent-oot/venvs/project-X5QLZv1w-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + } + ] + }, + "macos": { + "errors": [], + "platform": "macOS 15 (arm64), native CLI; Pipenv 0.2.8-11.10.4 inside python:3.6.15-slim", + "provenance": { + "capturedAt": "2026-09-18T14:21:06.520127+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "mergedFrom": [ + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-a/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:17.630925+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent" + ], + "pipenvVersions": [ + "0.2.8" + ], + "shapes": [ + "dev" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:31.872148+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent-oot" + ], + "pipenvVersions": [ + "5.4.2" + ], + "shapes": [ + "dev", + "direct" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:49.934581+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent-oot" + ], + "pipenvVersions": [ + "4.1.4" + ], + "shapes": [ + "transitive" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-d/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:47:07.046287+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored" + ], + "pipenvVersions": [ + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "marker-excluded" + ] + } + } + ], + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "0.2.8", + "3.6.2", + "4.1.4", + "5.4.2", + "6.2.9", + "7.9.10", + "8.3.2", + "9.1.0", + "10.1.2", + "11.10.4", + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "direct", + "dev", + "category", + "marker", + "marker-excluded", + "extras", + "transitive", + "crlf" + ] + }, + "results": [ + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-dev-agent-oot/venvs/project-le2Kar3x", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-direct-agent-oot/venvs/project-Vi8Y6k5P", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-extras-agent-oot/venvs/project-Hdy1kYbO", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-marker-agent-oot/venvs/project-mSh7SIOh", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-transitive-agent-oot/venvs/project-bkGR-pKq", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-dev-agent-oot/venvs/project-EuBgobiP-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-direct-agent-oot/venvs/project-p4uodGuH-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-extras-agent-oot/venvs/project-c6zJSbVZ-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-marker-agent-oot/venvs/project-TLOj7X4t-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-transitive-agent-oot/venvs/project-TPz-ubcN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-dev-agent-oot/venvs/project-rvumQJR7-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-direct-agent-oot/venvs/project-rRD3ZqKE-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-extras-agent-oot/venvs/project-oO1dqUUx-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-marker-agent-oot/venvs/project-p-7NMJlC-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-transitive-agent-oot/venvs/project-uDoo2NrU-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-dev-agent-oot/venvs/project-WBeaWwaZ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-direct-agent-oot/venvs/project-_BmhyZkL-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-extras-agent-oot/venvs/project-usOBprOu-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-marker-agent-oot/venvs/project-P5aQHRYw-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-transitive-agent-oot/venvs/project-RHhZLWm9-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-dev-agent-oot/venvs/project-jotSn62P-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-direct-agent-oot/venvs/project-7YJlTv1q-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-extras-agent-oot/venvs/project-O9SEazj5-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-marker-agent-oot/venvs/project-hximekEn-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-transitive-agent-oot/venvs/project-avsbOHLg-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-agent-oot/venvs/project-VPPSdrXF-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-agent-oot/venvs/project-Oe79nwd5-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-agent-oot/venvs/project-xrFY7ef0-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-extras-agent-oot/venvs/project-fj5TX4um-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 1, + "lockBytesUnchanged": true, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3#egg=urllib3[socks]" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl[socks]" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-agent-oot/venvs/project-3kF_SAjR-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-excluded-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-agent-oot/venvs/project-4b8AKKsv-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-category-agent-oot/venvs/project-xEc6rJSO-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-dev-agent-oot/venvs/project-PtTzFqFB-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-direct-agent-oot/venvs/project-0UeNFdlr-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-extras-agent-oot/venvs/project-xkdemobK-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-marker-agent-oot/venvs/project-DDR4ZCp_-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-transitive-agent-oot/venvs/project-7-es0NIB-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-category-agent-oot/venvs/project--fnruCrf-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-dev-agent-oot/venvs/project-xsC0u6dL-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-direct-agent-oot/venvs/project-Nlq3YoNQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-extras-agent-oot/venvs/project-Jsn3tijM-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-marker-agent-oot/venvs/project-Vj1hhlg6-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-transitive-agent-oot/venvs/project-yDGP0fUF-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-category-agent-oot/venvs/project-yAeGV-DD-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-dev-agent-oot/venvs/project-Fdze9eCY-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-direct-agent-oot/venvs/project-UDidtARQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-extras-agent-oot/venvs/project-wKfQ5P1A-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-marker-agent-oot/venvs/project-Ua-x4uOM-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-transitive-agent-oot/venvs/project-sqNtW4tO-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-category-agent-oot/venvs/project-jp5oYRPn-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-dev-agent-oot/venvs/project-XetQvjsN-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-direct-agent-oot/venvs/project-QZo5Ld-I-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-extras-agent-oot/venvs/project-Pb7pwpA2-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-marker-agent-oot/venvs/project-Z_FGngEQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-transitive-agent-oot/venvs/project-tFo0iv7w-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-dev-agent-oot/venvs/project-H7fL1xTY", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-direct-agent-oot/venvs/project-SjHJBH5g", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-transitive-agent-oot/venvs/project-R9KbIlov", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-dev-agent-oot/venvs/project-156NY79G", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-direct-agent-oot/venvs/project-S8Z-YEC3", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/captures/4.1.4-transitive-agent-oot/venvs/project-hOJKMBk9", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-dev-agent-oot/venvs/project-HHSeGvEK", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-direct-agent-oot/venvs/project-75euv67j", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/5.4.2-transitive-agent-oot/venvs/project-PWzNFRQ1", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-dev-agent-oot/venvs/project-WccTvFLA", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-direct-agent-oot/venvs/project-96LD91ty", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-transitive-agent-oot/venvs/project-NnL-gs-7", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-dev-agent-oot/venvs/project-Iq5OMDdg", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-direct-agent-oot/venvs/project-RW6cQyoM", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-extras-agent-oot/venvs/project-qCX_4SXE", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-marker-agent-oot/venvs/project-tk6-Ud0l", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-transitive-agent-oot/venvs/project-iGJfHZ9t", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-dev-agent-oot/venvs/project-9NPbAK7d", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-direct-agent-oot/venvs/project-zwilhVJE", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-extras-agent-oot/venvs/project-VoTeUWTM", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-marker-agent-oot/venvs/project-KTlWVSq1", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-transitive-agent-oot/venvs/project-xNX_V925", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + } + ] + } + } +} diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py new file mode 100755 index 00000000..a6620686 --- /dev/null +++ b/scripts/backtest-pipenv.py @@ -0,0 +1,1248 @@ +#!/usr/bin/env python3 +"""Drive the real socket-patch CLI and real Pipenv releases through hosted, +vendored and agent mode on native Pipfile.lock generations. + +For the last stable release of every published Pipenv major the harness +bootstraps that exact release (uv venv for 2018+, a `python:3.6.15-slim` +Docker venv for the pre-2018 majors that no longer run on modern Pythons), +generates a native lock for a one-dependency project (urllib3 1.26.18, which +has a public free-tier Socket patch), then for each mode: + + hosted scan --mode hosted -> pipenv install -> installed bytes == patch + vendored scan --mode vendored -> pipenv install -> installed bytes == patch + agent pipenv install -> scan --mode agent -> installed bytes == patch + agent-oot same as agent, but with Pipenv's DEFAULT out-of-tree virtualenv + (WORKON_HOME) instead of an in-project .venv + +and checks --dry-run parity, idempotent re-scans, an untouched Pipfile, the +lock-driven install of a FRESH clone of the committed state, whether a WARM +venv (upstream urllib3 already installed) gets the patched wheel, tampered +hashes, `pipenv verify`, what `pipenv lock` does to the patched entry, `vex`, +and `rollback` restoring every byte. Pre-2018 releases are expected to be +REFUSED (old lock spec for 0–6, vendored for 7–11) without touching the lock. + +Shapes mirror the depscan capture harness: direct, dev, category (2022+), +marker, marker-excluded, extras, transitive, crlf. Invocations vary how the +CLI is pointed at the project: in-dir (cwd = project, no --cwd), cwd-flag +(run from the output root with --cwd), subdir (project nested two levels down, +--cwd relative), symlink (cwd = a symlink to the project). + +Needs network (PyPI + patch.socket.dev), uv, Docker (pre-2018 majors only) and +no Socket token. + + scripts/backtest-pipenv.py --socket-patch target/debug/socket-patch \ + --socket-patch-revision $(git rev-parse --short HEAD) --output /tmp/pipenv-compat + scripts/backtest-pipenv.py --render-doc-table /tmp/pipenv-compat/summary.json +""" + +import argparse +import concurrent.futures +import hashlib +import json +import os +import re +import shlex +import shutil +import signal +import subprocess +import sys +import threading +import time +import traceback +import uuid as uuid_mod +from datetime import datetime, timezone +from pathlib import Path + +VERSIONS = [ + "0.2.8", + "3.6.2", + "4.1.4", + "5.4.2", + "6.2.9", + "7.9.10", + "8.3.2", + "9.1.0", + "10.1.2", + "11.10.4", + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0", +] +MODES = ["hosted", "vendored", "agent", "agent-oot"] +SHAPES = ["direct", "dev", "category", "marker", "marker-excluded", "extras", "transitive", "crlf"] +INVOCATIONS = ["in-dir", "cwd-flag", "subdir", "symlink"] +LEGACY_IMAGE = "python:3.6.15-slim" + +PROJECT = """[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +urllib3 = "==1.26.18" + +[dev-packages] +""" +# Pins for the transitive shape (urllib3 reached through requests). +TRANSITIVE_MODERN = { + "requests": "2.31.0", + "charset-normalizer": "3.3.2", + "idna": "3.6", + "certifi": "2024.2.2", + "urllib3": "1.26.18", +} +TRANSITIVE_LEGACY = { + "requests": "2.27.1", + "charset-normalizer": "2.0.12", + "idna": "3.6", + "certifi": "2024.2.2", + "urllib3": "1.26.18", +} +ORACLE = """import hashlib,json,pathlib,sys,sysconfig +root=pathlib.Path(sysconfig.get_paths()['purelib']) +out={} +for name in json.loads(sys.argv[1]): + p=root/name + if p.is_file(): + d=p.read_bytes(); out[name]=hashlib.sha256(('blob %d\\0'%len(d)).encode()+d).hexdigest() + else: + out[name]=None +print(json.dumps(out)) +""" +ABSENT = "import importlib.util,sys; sys.exit(0 if importlib.util.find_spec('urllib3') is None else 1)" +PATCH_UUID = "e828efa5-5c6d-43f3-9909-03f5ac232b98" +PURL_BASE = "pkg:pypi/urllib3@1.26.18" + +LEGACY_TOOL_PACKAGES = [ + "pip==9.0.3", + "pip-tools==1.11.0", + "setuptools==44.1.1", + "wheel==0.37.1", + "virtualenv==16.7.12", + "click==6.7", + "requests==2.27.1", + "pexpect==4.2.1", + "delegator.py==0.0.14", +] +LEGACY_VENV_PACKAGES = ["pip==9.0.3", "setuptools==44.1.1", "wheel==0.37.1"] + + +def major_of(version): + return int(version.split(".")[0]) + + +def vtuple(v): + return tuple(int(x) for x in v.split(".")) + + +def is_legacy(version): + return major_of(version) < 2018 + + +def save(path, data): + path.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n") + + +DEFAULT_TIMEOUT = int(os.environ.get("BACKTEST_TIMEOUT", "900")) + + +class Run: + """Run a command in its own process group, capture output, write a log. + + A timeout kills the whole group (Docker clients, pip subprocesses, …). + """ + + def __init__(self, cmd, cwd, env, log, timeout=None, container=None): + timeout = timeout or DEFAULT_TIMEOUT + self.cmd = [str(c) for c in cmd] + try: + with subprocess.Popen( + self.cmd, + cwd=str(cwd), + env=env, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + start_new_session=True, + ) as p: + try: + self.out, self.err = p.communicate(timeout=timeout) + self.rc = p.returncode + except subprocess.TimeoutExpired: + try: + os.killpg(p.pid, signal.SIGKILL) + except ProcessLookupError: + pass + out, err = p.communicate() + self.rc, self.out, self.err = 124, out or "", (err or "") + f"\nTIMEOUT after {timeout}s" + except OSError as e: + self.rc, self.out, self.err = 127, "", str(e) + finally: + if container: + subprocess.run(["docker", "rm", "-f", container], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=60) + Path(log).write_text( + "$ " + " ".join(shlex.quote(c) for c in self.cmd) + f"\n# cwd {cwd}\n# exit {self.rc}\n--- stdout\n{self.out}\n--- stderr\n{self.err}" + ) + + def ok(self): + return self.rc == 0 + + def json(self): + i = self.out.find("{") + if i < 0: + raise RuntimeError("no JSON in output: " + (self.out + self.err)[-2000:]) + return json.loads(self.out[i:]) + + def json_or_empty(self): + try: + return self.json() + except Exception: + return {} + + def tail(self, n=400): + return (self.out + self.err)[-n:] + + +def urllib3_entries(lock_bytes): + """Every category's urllib3 entry of a Pipfile.lock, parsed, for a + semantic (key-order- and whitespace-insensitive) comparison.""" + data = json.loads(lock_bytes.decode("utf-8-sig")) + return {cat: entries["urllib3"] for cat, entries in data.items() if cat != "_meta" and isinstance(entries, dict) and "urllib3" in entries} + + +def require(r, what): + if not r.ok(): + raise RuntimeError(f"{what} failed (exit {r.rc}):\n{(r.out + r.err)[-4000:]}") + return r + + +def base_env(): + env = { + k: v + for k, v in os.environ.items() + if not k.startswith(("PYTHON", "PIP_", "PIPENV_", "SOCKET_", "UV_", "WORKON_HOME")) and k != "VIRTUAL_ENV" + } + env.update( + SOCKET_NO_CONFIG="1", + SOCKET_NO_UPDATE_CHECK="1", + SOCKET_TELEMETRY_DISABLED="1", + PIP_CONFIG_FILE=os.devnull, + PIP_DISABLE_PIP_VERSION_CHECK="1", + PIPENV_YES="1", + PIPENV_NOSPIN="1", + PIPENV_IGNORE_VIRTUALENVS="1", + PYTHONDONTWRITEBYTECODE="1", + ) + return env + + +def main(): + ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("--socket-patch", type=Path, help="socket-patch CLI binary") + ap.add_argument("--socket-patch-revision", help="git revision the binary was built from (recorded)") + ap.add_argument("--output", type=Path) + ap.add_argument("--tools-root", type=Path, help="where Pipenv releases are (or get) bootstrapped; default /tools-root") + ap.add_argument("--versions", nargs="+", default=VERSIONS) + ap.add_argument("--modes", nargs="+", default=MODES, choices=MODES) + ap.add_argument("--shapes", nargs="+", default=["direct"], choices=SHAPES) + ap.add_argument("--invocations", default="in-dir", help="comma-separated subset of " + ",".join(INVOCATIONS) + " (direct shape only)") + ap.add_argument("--jobs", type=int, default=4) + ap.add_argument("--render-doc-table", type=Path, metavar="SUMMARY_JSON") + args = ap.parse_args() + if args.render_doc_table: + summary = json.loads(args.render_doc_table.read_text()) + print(render_doc_table(summary)) + print() + print(render_table(summary)) + return + if not (args.socket_patch and args.socket_patch_revision and args.output): + ap.error("--socket-patch, --socket-patch-revision and --output are required") + invocations = [i.strip() for i in args.invocations.split(",") if i.strip()] + for inv in invocations: + if inv not in INVOCATIONS: + ap.error(f"unknown invocation {inv!r}") + + root = args.output.resolve() + root.mkdir(parents=True, exist_ok=True) + tools_root = (args.tools_root or (root / "tools-root")).resolve() + tools_root.mkdir(parents=True, exist_ok=True) + cli_path = args.socket_patch.resolve() + env = base_env() + provenance = { + "capturedAt": datetime.now(timezone.utc).isoformat(), + "cliRevision": args.socket_patch_revision, + "cliSha256": hashlib.sha256(cli_path.read_bytes()).hexdigest(), + "pipenvVersions": args.versions, + "modes": args.modes, + "shapes": args.shapes, + "invocations": invocations, + "host": os.uname().sysname + " " + os.uname().machine, + "legacyImage": LEGACY_IMAGE, + } + save(root / "provenance.json", provenance) + + log_lock = threading.Lock() + + def say(*a): + with log_lock: + print(*a, flush=True) + + # ------------------------------------------------------------------ docker + def docker_cmd(cwd, extra_env, workdir=None, name=None): + """`docker run` prefix that mirrors ROOTs + cwd at identical paths.""" + mounts = [] + seen = set() + for path in [tools_root, root, Path(cwd)]: + p = str(path) + if not any(p == s or p.startswith(s.rstrip("/") + "/") for s in seen): + mounts += ["-v", f"{p}:{p}"] + seen.add(p) + cmd = ["docker", "run", "--rm", "--name", name or ("pipenv-bt-" + uuid_mod.uuid4().hex[:12]), *mounts, "-w", str(workdir or cwd)] + for k, v in extra_env.items(): + cmd += ["-e", f"{k}={v}"] + cmd.append(LEGACY_IMAGE) + return cmd + + def legacy_run(cmd, cwd, extra_env, log, timeout=None, workdir=None): + name = "pipenv-bt-" + uuid_mod.uuid4().hex[:12] + full = docker_cmd(cwd, extra_env, workdir=workdir, name=name) + [str(c) for c in cmd] + return Run(full, cwd, env, log, timeout=timeout, container=name) + + # ------------------------------------------------------------------ tools + def tool_dir(version): + return tools_root / ("legacy-tools" if is_legacy(version) else "tools") / version + + def wrapper_dir(version): + return root / "legacy-bin" / version + + def prepare_tool(version): + tool = tool_dir(version) + legacy = is_legacy(version) + logs = root / "bootstrap-logs" + logs.mkdir(exist_ok=True) + if legacy: + # Host-side `pipenv` that runs the legacy release inside Docker with + # the tool root, the output root and the caller's cwd bind-mounted at + # identical paths — the CLI's `pipenv --version` probe and the + # harness's own pipenv invocations both go through it. + wd = wrapper_dir(version) + wd.mkdir(parents=True, exist_ok=True) + mounts = " ".join(f"-v {shlex.quote(str(p))}:{shlex.quote(str(p))}" for p in [tools_root, root]) + (wd / "pipenv").write_text( + "#!/bin/sh\n" + f"# Pipenv {version} inside {LEGACY_IMAGE}; tool root, output root and $PWD bind-mounted\n" + f'exec docker run --rm -i {mounts} -v "$PWD":"$PWD" -w "$PWD" \\\n' + f" -e PATH={shlex.quote(str(tool / 'bin'))}:/usr/local/bin:/usr/bin:/bin \\\n" + " -e PIPENV_VENV_IN_PROJECT -e PIPENV_YES=1 -e PIPENV_NOSPIN=1 -e PIP_DISABLE_PIP_VERSION_CHECK=1 -e WORKON_HOME -e PIPENV_PYTHON \\\n" + f" {LEGACY_IMAGE} {shlex.quote(str(tool / 'bin/pipenv'))} \"$@\"\n" + ) + (wd / "pipenv").chmod(0o755) + if not (tool / "bin/pipenv").exists(): + tool.parent.mkdir(parents=True, exist_ok=True) + require(legacy_run(["python", "-m", "venv", tool], tools_root, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, logs / f"{version}-venv.log"), f"legacy venv {version}") + require( + legacy_run([tool / "bin/python", "-m", "pip", "install", f"pipenv=={version}", *LEGACY_TOOL_PACKAGES], tools_root, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, logs / f"{version}-install.log"), + f"legacy pipenv {version} install", + ) + elif not (tool / "bin/pipenv").exists(): + major = major_of(version) + py = os.environ.get("BACKTEST_PY38", "3.8.20") if major <= 2022 else os.environ.get("BACKTEST_PY312", "3.12.13") + require(Run(["uv", "venv", "-q", "--python", py, tool], root, env, logs / f"{version}-venv.log"), "uv venv") + pkgs = [f"pipenv=={version}", "pip==24.0", "setuptools==69.5.1" if major >= 2023 else "setuptools==57.5.0"] + require(Run(["uv", "pip", "install", "-q", "--python", tool / "bin/python", *pkgs], root, env, logs / f"{version}-install.log"), "pipenv bootstrap") + return tool + + # ------------------------------------------------------------- pipenv env + def pipenv_shim_dir(version, tool): + """A PATH entry exposing only `pipenv` (a user's PATH has pipenv, not the + tool venv's python3 — the CLI's global fallback must not crawl that venv).""" + if is_legacy(version): + return wrapper_dir(version) + d = root / "pipenv-bin" / version + d.mkdir(parents=True, exist_ok=True) + link = d / "pipenv" + if not link.exists(): + link.symlink_to(tool / "bin/pipenv") + return d + + def pipenv_env(version, tool, in_project=True, workon_home=None): + e = dict(env) + e["PATH"] = str(pipenv_shim_dir(version, tool)) + os.pathsep + e.get("PATH", "") + e["PIPENV_PYTHON"] = str(tool / "bin/python") + if in_project: + e["PIPENV_VENV_IN_PROJECT"] = "1" + if workon_home is not None: + e["WORKON_HOME"] = str(workon_home) + return e + + def pipenv_bin(version, tool): + return (wrapper_dir(version) / "pipenv") if is_legacy(version) else (tool / "bin/pipenv") + + def run_pipenv(version, tool, args_, cwd, penv, log, timeout=None): + """Run `pipenv ` for `version` in `cwd` (Docker for legacy).""" + if is_legacy(version): + extra = {k: v for k, v in penv.items() if k.startswith(("PIP", "WORKON_HOME"))} + extra["PATH"] = f"{tool / 'bin'}:/usr/local/bin:/usr/bin:/bin" + return legacy_run([tool / "bin/pipenv", *args_], cwd, extra, log, timeout=timeout) + return Run([tool / "bin/pipenv", *args_], cwd, penv, log, timeout=timeout) + + def run_python(version, python, args_, cwd, penv, log, timeout=None): + """Run the PROJECT interpreter (Docker for legacy: linux venv).""" + if is_legacy(version): + extra = {k: v for k, v in penv.items() if k.startswith(("PIP", "WORKON_HOME"))} + return legacy_run([python, *args_], cwd, extra, log, timeout=timeout) + return Run([python, *args_], cwd, penv, log, timeout=timeout) + + def make_venv(version, tool, venv, cwd, log, packages=(), native=False): + """Create the project venv. + + Modern: uv venv on the tool's interpreter + pip 24 (+ packages). + Legacy: `native=True` builds the Docker (linux, python 3.6) venv that + Pipenv itself installs into; otherwise a host uv venv (python 3.8) so + the CLI can crawl an installed urllib3 the way the depscan captures did. + """ + if venv.exists(): + shutil.rmtree(venv) + if is_legacy(version) and native: + venv.mkdir(parents=True) + require(legacy_run(["/usr/local/bin/python", "-m", "venv", venv], cwd, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, log), "docker venv") + require(legacy_run([venv / "bin/python", "-m", "pip", "install", *LEGACY_VENV_PACKAGES, *packages], cwd, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, str(log) + ".pip"), "docker venv bootstrap") + return + py = os.environ.get("BACKTEST_PY38", "3.8.20") if is_legacy(version) else tool / "bin/python" + require(Run(["uv", "venv", "-q", "--python", py, venv], cwd, env, log), "uv venv") + pkgs = ["pip==24.0", "setuptools==69.5.1", *packages] + require(Run(["uv", "pip", "install", "-q", "--python", venv / "bin/python", *pkgs], cwd, env, str(log) + ".pip"), "venv bootstrap") + + def uninstall_urllib3(version, python, cwd, penv, log): + if is_legacy(version): + r = run_python(version, python, ["-m", "pip", "uninstall", "-y", "urllib3"], cwd, penv, log) + else: + r = Run(["uv", "pip", "uninstall", "-q", "--python", python, "urllib3"], cwd, env, log) + if not r.ok(): + # Tolerate "not installed" as long as the package is truly absent. + require(run_python(version, python, ["-c", ABSENT], cwd, penv, str(log) + ".absent"), "urllib3 uninstall") + + def oracle(version, python, names, cwd, penv, log): + # For the pre-2018 releases the oracle runs in a fresh container over a + # bind mount the host CLI just wrote through (stage + rename): Docker + # Desktop's shared file cache occasionally shows the directory without + # the renamed entry for a moment, so a missing file is re-read a few + # times before it counts (a real absence stays absent). + attempts = 4 if is_legacy(version) else 1 + result = {} + for attempt in range(attempts): + r = run_python(version, python, ["-c", ORACLE, json.dumps(list(names))], cwd, penv, log) + result = json.loads(r.out.strip().splitlines()[-1]) if r.ok() and r.out.strip() else {} + if result and all(v is not None for v in result.values()): + return result + if attempt + 1 < attempts: + time.sleep(1.5) + return result + + def urllib3_absent(version, python, cwd, penv, log): + return run_python(version, python, ["-c", ABSENT], cwd, penv, log).ok() + + def install_args(version, shape, deploy=True): + # `--ignore-pipfile` arrives with Pipenv 3; `--deploy` with Pipenv 9. + a = ["install"] + (["--ignore-pipfile"] if major_of(version) >= 3 else []) + if deploy and major_of(version) >= 9: + a.append("--deploy") + if shape == "dev": + a.append("--dev") + if shape == "category": + a += ["--categories", "tests"] + return a + + def sync_args(version, shape): + if major_of(version) < 2018: + return None + a = ["sync"] + if shape == "dev": + a.append("--dev") + if shape == "category": + a += ["--categories", "tests"] + return a + + # ------------------------------------------------------------ fixtures + def pipfile_text(version, shape): + text = PROJECT + if shape == "dev": + text = PROJECT.replace('urllib3 = "==1.26.18"\n', "").replace("[dev-packages]", '[dev-packages]\nurllib3 = "==1.26.18"') + elif shape == "category": + text = PROJECT.replace("[packages]", "[tests]") + elif shape in ("marker", "marker-excluded", "extras"): + field = 'extras = ["socks"]' if shape == "extras" else 'markers = "python_version ' + (">" if shape == "marker-excluded" else "<") + " '4'\"" + text = PROJECT.replace('"==1.26.18"', '{version="==1.26.18", ' + field + "}") + elif shape == "transitive": + pins = TRANSITIVE_LEGACY if is_legacy(version) else TRANSITIVE_MODERN + text = PROJECT.split("[packages]")[0] + "[packages]\n" + "".join(f'{n} = "=={v}"\n' for n, v in pins.items()) + "\n[dev-packages]\n" + return text + + def content_hash(version, tool, project, penv, log): + code = ( + "import pipenv,pipfile; print(pipfile.load('Pipfile').hash)" + if is_legacy(version) + else "from pipenv.project import Project; p=Project(); print(p.calculate_pipfile_hash() if hasattr(p,'calculate_pipfile_hash') else p.pipfile.calculate_hash())" + ) + r = require(run_python(version, tool / "bin/python", ["-c", code], project, penv, log), "content hash") + return r.out.strip().splitlines()[-1] + + def native_lock(version, tool, shape): + """Generate (once) the native Pipfile.lock for version/shape.""" + original = root / "original" / version / shape + if (original / "Pipfile.lock").exists(): + return original + original.mkdir(parents=True, exist_ok=True) + (original / "Pipfile").write_text(pipfile_text(version, shape)) + penv = pipenv_env(version, tool) + # Legacy Pipenv resolves through the project venv's pip-tools; give it one. + make_venv(version, tool, original / ".venv", original, original / "venv.log", native=True) + require(run_pipenv(version, tool, ["lock"], original, penv, original / "generation.log"), f"pipenv {version} lock ({shape})") + if shape == "transitive": + # Lock with every pin (so urllib3 is pinned to 1.26.18), then shrink + # the Pipfile to `requests` only and stamp its content hash so + # `--deploy` still accepts the lock. + pins = TRANSITIVE_LEGACY if is_legacy(version) else TRANSITIVE_MODERN + (original / "Pipfile").write_text(PROJECT.replace('urllib3 = "==1.26.18"', 'requests = "==' + pins["requests"] + '"')) + hashed = content_hash(version, tool, original, penv, original / "content-hash.log") + lock = json.loads((original / "Pipfile.lock").read_text()) + lock["_meta"]["hash"]["sha256"] = hashed + (original / "Pipfile.lock").write_text(json.dumps(lock, indent=4, sort_keys=True) + "\n") + if shape == "crlf": + for name in ["Pipfile", "Pipfile.lock"]: + p = original / name + p.write_bytes(p.read_text().replace("\r\n", "\n").replace("\n", "\r\n").encode()) + shutil.rmtree(original / ".venv", ignore_errors=True) + return original + + # --------------------------------------------------------------- the CLI + def cli_invocation(case, project, invocation): + """(cwd, extra args) for pointing the CLI at `project`.""" + if invocation == "in-dir": + return project, [] + if invocation == "cwd-flag": + return root, ["--cwd", str(project)] + if invocation == "subdir": + # project lives at /nested/app; run from /nested + return project.parent, ["--cwd", project.name] + if invocation == "symlink": + link = case / "link" + if not link.is_symlink(): + link.symlink_to(project, target_is_directory=True) + return link, ["--cwd", str(link)] + raise ValueError(invocation) + + def applied_count(mode, envelope): + if mode == "hosted": + return envelope.get("redirect", {}).get("redirected", 0) + if mode == "vendored": + return envelope.get("vendor", {}).get("summary", {}).get("applied", 0) + return envelope.get("apply", {}).get("applied", 0) + + def planned_count(mode, envelope): + """What a --dry-run envelope says WOULD happen (no summary is written).""" + if mode == "hosted": + return envelope.get("redirect", {}).get("redirected", 0) + if mode == "vendored": + v = envelope.get("vendor", {}) + if v.get("dryRun"): + return sum(1 for p in v.get("patches", []) if p.get("action") == "would_vendor") + return v.get("summary", {}).get("applied", 0) + a = envelope.get("apply", {}) + return a.get("added", 0) + a.get("updated", 0) if a.get("dryRun") else a.get("applied", 0) + + def envelope_warnings(mode, envelope): + if mode == "hosted": + return envelope.get("redirect", {}).get("warnings", []) + if mode == "vendored": + return envelope.get("vendor", {}).get("events", []) + return envelope.get("apply", {}).get("patches", []) + + def record_hashes(project, mode): + if mode == "hosted": + recs = json.loads((project / ".socket/vendor/redirect-state.json").read_text())["records"] + else: + recs = json.loads((project / ".socket/manifest.json").read_text())["patches"] + rec = next(iter(recs.values())) + return ( + {n: i["afterHash"] for n, i in rec["files"].items()}, + {n: i["beforeHash"] for n, i in rec["files"].items() if i.get("beforeHash")}, + rec.get("uuid"), + ) + + def lock_entries(text): + """Every (section, key, entry) for urllib3 in a Pipfile.lock text.""" + try: + lock = json.loads(text) + except Exception: + return [] + out = [] + for section, entries in lock.items(): + if section == "_meta" or not isinstance(entries, dict): + continue + for key, entry in entries.items(): + if key.lower().replace("_", "-") == "urllib3": + out.append((section, key, entry)) + return out + + def source_keys(text): + return sorted({k for _, _, e in lock_entries(text) if isinstance(e, dict) for k in ("file", "path") if k in e}) + + # -------------------------------------------------------------- one case + def backtest(job): + """Run one case; persist its row (or error) as /result.json.""" + version, shape, mode, invocation = job + suffix = "" if invocation == "in-dir" else "-" + invocation + case = root / "captures" / f"{version}-{shape}-{mode}{suffix}" + try: + row = backtest_case(job) + except Exception as e: + case.mkdir(parents=True, exist_ok=True) + save(case / "result.json", {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "passed": False, "error": str(e)[-3000:], "trace": traceback.format_exc()[-2000:]}) + raise + save(case / "result.json", row) + return row + + def backtest_case(job): + version, shape, mode, invocation = job + legacy = is_legacy(version) + major = major_of(version) + tool = tool_dir(version) + suffix = "" if invocation == "in-dir" else "-" + invocation + case = root / "captures" / f"{version}-{shape}-{mode}{suffix}" + if case.exists(): + shutil.rmtree(case) + case.mkdir(parents=True) + if major < 3 and shape == "transitive": + # Pipenv 0.x has no `pipfile` module to stamp the Pipfile content + # hash with, so the transitive Pipfile cannot be paired with the + # generated lock (`pipenv install` would re-lock on the mismatch). + return {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "pipfileSpec": None, "supported": False, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", "checks": {}, "info": {}, "passed": True} + original = native_lock(version, tool, shape) + project = (case / "nested" / "app") if invocation == "subdir" else (case / "project") + project.mkdir(parents=True) + for name in ["Pipfile", "Pipfile.lock"]: + shutil.copyfile(original / name, project / name) + pristine_lock = (project / "Pipfile.lock").read_bytes() + pristine_pipfile = (project / "Pipfile").read_bytes() + spec = json.loads(pristine_lock.decode()).get("_meta", {}).get("pipfile-spec") + row = {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "pipfileSpec": spec, "supported": None, "expected": None, "checks": {}, "info": {}, "passed": None} + checks, info = row["checks"], row["info"] + + def check(name, value, note=None): + checks[name] = bool(value) + if note is not None: + info[name] = note + return bool(value) + + cwd, cli_args = cli_invocation(case, project, invocation) + + def cli_run(penv_, *rest, log): + return Run([cli_bin, *rest, *cli_args, "--json", "--yes", "--no-telemetry"], cwd, penv_, case / log) + + cli_bin = cli_path + venv = project / ".venv" + python = venv / "bin/python" + penv = pipenv_env(version, tool) + + # Pipenv 0.x installs plain string pins only: inline-table entries with + # markers / extras are not understood, so nothing gets installed for + # agent mode to patch — nothing to measure there. + if mode in ("agent", "agent-oot") and major < 7 and shape in ("marker", "marker-excluded", "extras"): + # Pipenv 0.x–6.x install plain string pins only: inline-table + # entries are mis-handled (markers ignored, extras fail to + # install), so there is nothing meaningful for agent mode to + # measure; hosted/vendored rows for these releases are refusals + # judged before any install. + row["supported"] = False + row["expected"] = "skipped: Pipenv 0.x–6.x mishandle inline-table (markers/extras) Pipfile entries" + row["passed"] = True + return row + + # --------------------------------------------------------- agent-oot + if mode == "agent-oot": + if major == 7: + # Pipenv 7 creates its out-of-tree venv through pew + virtualenv + # 16, whose seeding fails inside the python:3.6.15-slim harness + # image ("Can not use any platform or abi specific options"); + # its in-project agent leg and the 8–11 out-of-tree legs cover + # the crawler on the legacy layout. + row["supported"] = False + row["expected"] = "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image" + row["passed"] = True + return row + if major < 3: + row["supported"] = False + row["expected"] = "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover" + row["passed"] = True + return row + workon = case / "venvs" + workon.mkdir() + oenv = pipenv_env(version, tool, in_project=False, workon_home=workon) + # Pipenv creates the venv itself here; pin its interpreter explicitly + # (2022.12.19 ignored PIPENV_PYTHON and picked the newest python3 on + # PATH, whose pkgutil no longer suits its vendored pip). + first = install_args(version, shape) + ([] if legacy else ["--python", str(tool / "bin/python")]) + require(run_pipenv(version, tool, first, project, oenv, case / "install-upstream.log"), "pipenv install (out-of-tree)") + vp = run_pipenv(version, tool, ["--venv"], project, oenv, case / "venv-path.log") + candidates = [Path(line.strip()) for line in vp.out.splitlines() if line.strip().startswith("/")] + oot_venv = next((c for c in candidates if (c / "bin/python").exists()), None) + if oot_venv is None: + found = [d for d in workon.iterdir() if (d / "bin/python").exists()] + oot_venv = found[0] if found else None + info["ootVenv"] = str(oot_venv) + info["ootVenvNameMatchesWorkon"] = bool(oot_venv) and oot_venv.parent == workon + if not oot_venv: + raise RuntimeError("could not locate Pipenv's out-of-tree venv: " + vp.out + vp.err) + opython = oot_venv / "bin/python" + # 1. BARE scan: the CLI inherits Pipenv's configuration (WORKON_HOME) + # but not an activation (VIRTUAL_ENV) — exactly what `pipenv run` adds. + bare_env = dict(env) + bare_env["WORKON_HOME"] = str(workon) + bare_env["PATH"] = oenv["PATH"] + r1 = cli_run(bare_env, "scan", "--mode", "agent", "--dry-run", log="scan-bare-dryrun.log") + e1 = r1.json_or_empty() + pkgs = e1.get("packages") or [] + u3 = [p for p in pkgs if "urllib3" in (p.get("purl") or "")] + found = e1.get("apply", {}).get("found", 0) + # The envelope names packages but not where they live. A crawler that + # found the out-of-tree venv scans exactly its distributions; the + # project-marker fallback scans `python3`-on-PATH instead (here the + # Pipenv tool venv, which may itself carry an urllib3 1.26.18). + cnt = run_python(version, opython, ["-c", "import os,sysconfig; print(sum(1 for d in os.listdir(sysconfig.get_paths()['purelib']) if d.endswith(('.dist-info', '.egg-info'))))"], project, oenv, case / "venv-dist-count.log") + venv_dists = int(cnt.out.strip().splitlines()[-1]) if cnt.ok() and cnt.out.strip() else None + scanned = e1.get("scannedPackages") + sees = bool(u3) and found >= 1 and venv_dists is not None and scanned is not None and abs(scanned - venv_dists) <= 2 + info["bareScan"] = {"exit": r1.rc, "scannedPackages": scanned, "venvDistributions": venv_dists, "found": found, "paths": (e1.get("paths") or [])[:10], "urllib3Listed": bool(u3), "foreignInterpreterHit": bool(u3) and found >= 1 and not sees} + check("bareScanSeesPipenvVenv", sees, info["bareScan"]) + # 2. apply: bare when the crawler saw the venv, else the way a user + # would — `pipenv run` (modern; exports VIRTUAL_ENV) or an explicit + # VIRTUAL_ENV (legacy: the CLI is a host binary, pipenv lives in Docker). + bare = bool(sees) + if bare: + info["applyPath"] = "bare" + r2 = cli_run(bare_env, "scan", "--mode", "agent", log="scan-apply.log") + elif legacy: + info["applyPath"] = "VIRTUAL_ENV" + venv_env = dict(bare_env, VIRTUAL_ENV=str(oot_venv)) + r2 = cli_run(venv_env, "scan", "--mode", "agent", log="scan-apply.log") + else: + info["applyPath"] = "pipenv run" + r2 = Run([tool / "bin/pipenv", "run", cli_bin, "scan", "--mode", "agent", *cli_args, "--json", "--yes", "--no-telemetry"], cwd, oenv, case / "scan-apply.log") + e2 = r2.json_or_empty() + check("scanApplied", applied_count("agent", e2) == 1, {"exit": r2.rc, "applied": applied_count("agent", e2), "path": info["applyPath"], "tail": r2.tail(300) if not r2.ok() else None}) + if not checks["scanApplied"]: + row["passed"] = False + return row + after, before, _ = record_hashes(project, "agent") + res = oracle(version, opython, after, project, oenv, case / "oracle-1.log") + check("installedBytesPatched", bool(after) and all(res.get(n) == h for n, h in after.items()), res) + # 3. a repeat install / sync must not revert the in-place patch + ri = run_pipenv(version, tool, install_args(version, shape), project, oenv, case / "install-again.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-2.log") + check("survivesRepeatInstall", ri.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": ri.rc, "oracle": res}) + sa = sync_args(version, shape) + if sa: + rs = run_pipenv(version, tool, sa, project, oenv, case / "sync.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-3.log") + check("survivesSync", rs.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": rs.rc, "oracle": res}) + # 4. rollback the same way the patch was applied + if bare: + rb = cli_run(bare_env, "rollback", log="rollback.log") + elif legacy: + rb = cli_run(dict(bare_env, VIRTUAL_ENV=str(oot_venv)), "rollback", log="rollback.log") + else: + rb = Run([tool / "bin/pipenv", "run", cli_bin, "rollback", *cli_args, "--json", "--yes", "--no-telemetry"], cwd, oenv, case / "rollback.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-rollback.log") + check("rollbackRestoresUpstream", rb.ok() and bool(before) and all(res.get(n) == h for n, h in before.items()), {"exit": rb.rc, "oracle": res}) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + row["supported"] = True + row["passed"] = all(checks.values()) + return row + + # ------------------------------------------------------------- agent + if mode == "agent": + make_venv(version, tool, venv, project, case / "venv.log", native=True) + require(run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install-upstream.log"), "pipenv install (upstream)") + if shape == "marker-excluded": + check("excludedStaysAbsent", urllib3_absent(version, python, project, penv, case / "absence.log")) + r = cli_run(penv, "scan", "--mode", "agent", log="scan.log") + e = r.json_or_empty() + save(case / "cli-output.json", e) + check("nothingApplied", applied_count("agent", e) == 0, {"exit": r.rc, "applied": applied_count("agent", e)}) + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock) + row["supported"] = True + row["expected"] = "marker excludes urllib3: nothing installed, nothing to patch" + row["passed"] = all(checks.values()) + return row + r = cli_run(penv, "scan", "--mode", "agent", log="scan.log") + info["scanExit"] = r.rc + envelope = r.json() + save(case / "cli-output.json", envelope) + applied = applied_count("agent", envelope) + check("appliedExactlyOne", applied == 1, {"applied": applied, "status": envelope.get("status"), "patches": envelope_warnings("agent", envelope)[:4]}) + if not checks["appliedExactlyOne"]: + row["passed"] = False + return row + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + after, before, uuid = record_hashes(project, "agent") + info["uuid"] = uuid + res = oracle(version, python, after, project, penv, case / "oracle-1.log") + check("installedBytesPatched", bool(after) and all(res.get(n) == h for n, h in after.items()), res) + r2 = cli_run(penv, "scan", "--mode", "agent", log="rescan.log") + e2 = r2.json_or_empty() + res = oracle(version, python, after, project, penv, case / "oracle-rescan.log") + check("rescanIdempotent", r2.ok() and all(res.get(n) == h for n, h in after.items()) and (project / "Pipfile.lock").read_bytes() == pristine_lock, {"exit": r2.rc, "applied": applied_count("agent", e2), "status": e2.get("status")}) + ri = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install-again.log") + res = oracle(version, python, after, project, penv, case / "oracle-2.log") + check("survivesRepeatInstall", ri.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": ri.rc, "oracle": res, "tail": ri.tail(300) if not ri.ok() else None}) + sa = sync_args(version, shape) + if sa: + rs = run_pipenv(version, tool, sa, project, penv, case / "sync.log") + res = oracle(version, python, after, project, penv, case / "oracle-3.log") + check("survivesSync", rs.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": rs.rc, "oracle": res, "tail": rs.tail(300) if not rs.ok() else None}) + vx = Run([cli_bin, "vex", "--product", "pkg:pypi/pipenv-backtest-fixture@0.1.0", *cli_args, "--no-telemetry"], cwd, penv, case / "vex.log") + info["vex"] = vex_info(vx) + rb = cli_run(penv, "rollback", log="rollback.log") + erb = rb.json_or_empty() + res = oracle(version, python, after, project, penv, case / "oracle-rollback.log") + check("rollbackExit0", rb.ok(), rb.tail(600) if not rb.ok() else None) + check("rollbackRestoresUpstreamBytes", bool(before) and all(res.get(n) == h for n, h in before.items()), res) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + check("rollbackKeepsLock", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + info["rollbackEnvelope"] = {k: erb.get(k) for k in ("status", "rolledBack", "failed", "hosted", "vendoredReverted", "manifest") if k in erb} + row["supported"] = True + row["passed"] = all(checks.values()) + return row + + # ------------------------------------------------- hosted / vendored + # Fresh-clone scenario first: nothing installed, lock only. An EMPTY + # in-project venv keeps the crawl hermetic (the project-marker fallback + # would otherwise walk this machine's global interpreters). + make_venv(version, tool, venv, project, case / "venv-empty.log") + r0 = cli_run(penv, "scan", "--mode", mode, log="scan-lockonly.log") + e0 = r0.json_or_empty() + codes0 = sorted({(w.get("code") or w.get("errorCode")) for w in envelope_warnings(mode, e0) if (w.get("code") or w.get("errorCode"))}) + info["lockOnly"] = {"exit": r0.rc, "applied": applied_count(mode, e0), "lockfileOnlyPackages": e0.get("lockfileOnlyPackages"), "codes": codes0} + check("lockOnlyApplies", applied_count(mode, e0) == 1, info["lockOnly"]) + if applied_count(mode, e0) == 1: + # The CI re-run shape: the checkout already carries the committed + # reference and nothing is installed — the re-scan must stay green + # (hosted re-confirms; vendored reports already_vendored), not + # `package_not_installed`, and the lock must not change. + lock1 = (project / "Pipfile.lock").read_bytes() + r1 = cli_run(penv, "scan", "--mode", mode, log="scan-lockonly-rescan.log") + e1 = r1.json_or_empty() + codes1 = sorted({(w.get("code") or w.get("errorCode")) for w in envelope_warnings(mode, e1) if (w.get("code") or w.get("errorCode"))}) + ok1 = r1.ok() and e1.get("status") == "success" and (project / "Pipfile.lock").read_bytes() == lock1 and "package_not_installed" not in codes1 + check("lockOnlyRescanGreen", ok1, {"exit": r1.rc, "status": e1.get("status"), "codes": codes1}) + shutil.rmtree(project / ".socket", ignore_errors=True) + shutil.rmtree(venv, ignore_errors=True) + (project / "Pipfile.lock").write_bytes(pristine_lock) + (project / "Pipfile").write_bytes(pristine_pipfile) + + # The CLI phase runs against a venv with upstream urllib3 installed + # (vendored needs an installed package; hosted does not care). + make_venv(version, tool, venv, project, case / "venv.log", packages=["urllib3==1.26.18"]) + + # --dry-run first: must report the same count and leave everything untouched. + rd = cli_run(penv, "scan", "--mode", mode, "--dry-run", log="scan-dryrun.log") + ed = rd.json_or_empty() + dry_applied = planned_count(mode, ed) + dry_clean = (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile and not (project / ".socket").exists() + info["dryRun"] = {"exit": rd.rc, "applied": dry_applied, "untouched": dry_clean} + + r = cli_run(penv, "scan", "--mode", mode, log="scan.log") + info["scanExit"] = r.rc + try: + envelope = r.json() + except Exception as e: + raise RuntimeError(f"scan produced no JSON: {e}\n{r.tail(2000)}") + save(case / "cli-output.json", envelope) + applied = applied_count(mode, envelope) + info["applied"] = applied + warnings = envelope_warnings(mode, envelope) + info["warnings"] = warnings[:8] + lock_after = (project / "Pipfile.lock").read_bytes() + check("pipfileUnchanged", (project / "Pipfile").read_bytes() == pristine_pipfile) + # Hosted --dry-run computes the rewrite; vendored --dry-run is a + # ledger-only preview (`would_vendor`) that runs no backend guard, so + # its parity is recorded, not required. + check("dryRunParity", dry_applied == applied and dry_clean, info["dryRun"]) + + # ---- expected refusals (pre-2018 majors) + refusal = None + if spec != 6: + # Hosted: an old lock says nothing about the project's other install + # files, so it is a SKIP (not a veto) — `redirect_pipenv_skipped`. + refusal = ("unsupported-lock-spec", "redirect_pipenv_skipped" if mode == "hosted" else "pypi_pipenv_spec_unsupported") + elif legacy and mode == "vendored": + refusal = ("unsupported-vendored-installer", "pypi_pipenv_installer_unsupported") + if refusal: + reason, code = refusal + row["supported"] = False + row["expected"] = f"refused: {reason} ({code})" + codes = sorted({(w.get("code") or w.get("errorCode")) for w in warnings if (w.get("code") or w.get("errorCode"))}) + check("refusedWithCode", applied == 0 and code in codes, {"applied": applied, "codes": codes, "exit": r.rc}) + check("lockUnchanged", lock_after == pristine_lock) + check("noLedger", not (project / ".socket/vendor/redirect-state.json").exists() and not (project / ".socket/vendor/state.json").exists()) + rb = cli_run(penv, "rollback", log="rollback.log") + check("rollbackHarmless", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile, {"exit": rb.rc}) + row["passed"] = all(val for k, val in checks.items() if k not in ("lockOnlyApplies", "dryRunParity")) + return row + + row["supported"] = True + check("appliedExactlyOne", applied == 1, {"applied": applied, "status": envelope.get("status"), "warnings": warnings[:4], "exit": r.rc}) + if not checks["appliedExactlyOne"]: + row["passed"] = False + return row + # The scan ran against a venv holding the UPSTREAM release: Pipenv will + # not reinstall it, so the CLI must say so (positive-evidence probe). + stale_code = "redirect_pypi_stale_install" if mode == "hosted" else "pypi_pipenv_stale_install" + stale = [w for w in warnings if (w.get("code") or w.get("errorCode")) == stale_code] + stale_text = (stale[0].get("detail") or stale[0].get("reason") or "") if stale else "" + check("staleInstallWarned", bool(stale) and "pipenv run pip uninstall" in stale_text, {"codes": sorted({(w.get("code") or w.get("errorCode")) for w in warnings if (w.get("code") or w.get("errorCode"))}), "detail": stale_text[:300] or None}) + check("lockRewritten", lock_after != pristine_lock) + if shape == "crlf": + check("crlfPreserved", b"\n" not in lock_after.replace(b"\r\n", b"")) + else: + check("noCrlfIntroduced", b"\r\n" not in lock_after) + check("lockStillJson", json.loads(lock_after.decode()) is not None) + check("metaUnchanged", json.loads(lock_after.decode()).get("_meta") == json.loads(pristine_lock.decode()).get("_meta")) + keys = source_keys(lock_after.decode()) + info["sourceKeys"] = keys + entries = lock_entries(lock_after.decode()) + info["rewrittenEntries"] = [{"section": s, "key": k, "entry": e} for s, k, e in entries][:4] + if mode == "hosted": + expected_key = "path" if 7 <= major < 2018 else "file" + check("lockHasPatchUrl", b"patch.socket.dev" in lock_after and b"#sha256=" in lock_after) + else: + has_extras = any(isinstance(e, dict) and e.get("extras") for _, _, e in lock_entries(pristine_lock.decode())) + expected_key = "path" if has_extras else "file" + check("lockHasVendoredRef", b".socket/vendor/pypi" in lock_after) + check("expectedSourceKey", keys == [expected_key], {"expected": expected_key, "got": keys}) + pristine_entries = {(s, k): e for s, k, e in lock_entries(pristine_lock.decode())} + check("allCategoriesRewritten", entries and all(("file" in e or "path" in e) and "version" not in e and "index" not in e for _, _, e in entries) and {(s, k) for s, k, _ in entries} == set(pristine_entries), {"pristine": sorted(pristine_entries), "rewritten": sorted((s, k) for s, k, _ in entries)}) + check("markersExtrasPreserved", all(e.get("markers") == pristine_entries.get((s, k), {}).get("markers") and e.get("extras") == pristine_entries.get((s, k), {}).get("extras") for s, k, e in entries)) + after, before, uuid = record_hashes(project, mode) + info["uuid"] = uuid + check("recordHasFiles", bool(after)) + if mode == "vendored": + wheel_dir = project / ".socket/vendor/pypi" / (uuid or "") + check("vendoredWheelPresent", wheel_dir.is_dir() and any(wheel_dir.glob("*.whl"))) + + # idempotent re-scan + r2 = cli_run(penv, "scan", "--mode", mode, log="rescan.log") + e2 = r2.json_or_empty() + check("rescanIdempotent", r2.ok() and (project / "Pipfile.lock").read_bytes() == lock_after and (project / "Pipfile").read_bytes() == pristine_pipfile, {"exit": r2.rc, "applied": applied_count(mode, e2), "status": e2.get("status")}) + + # For legacy majors Pipenv installs into a Docker (linux) venv: replace + # the host venv the CLI crawled with a native one carrying upstream urllib3. + if legacy: + make_venv(version, tool, venv, project, case / "native-venv.log", native=True, packages=["urllib3==1.26.18"]) + + # WARM venv: upstream urllib3 already installed — does the redirected + # lock make Pipenv install the patched wheel? (informational) + warm_cmds = [("install", install_args(version, shape))] + if sync_args(version, shape): + warm_cmds.append(("sync", sync_args(version, shape))) + info["warmReinstalled"] = {} + for label, a in warm_cmds: + w = run_pipenv(version, tool, a, project, penv, case / f"warm-{label}.log") + wres = oracle(version, python, after, project, penv, case / f"oracle-warm-{label}.log") + info["warmReinstalled"][label] = {"exit": w.rc, "patched": bool(after) and all(wres.get(n) == h for n, h in after.items()), "tail": w.tail(300)} + # put the pristine copy back for the next warm command + uninstall_urllib3(version, python, project, penv, case / f"warm-{label}-uninstall.log") + require(run_python(version, python, ["-m", "pip", "install", "urllib3==1.26.18"], project, penv, case / f"warm-{label}-reinstall.log"), "pristine reinstall") + check("warmInstallReplacesUpstream", all(v["exit"] == 0 and v["patched"] for v in info["warmReinstalled"].values()), info["warmReinstalled"]) + + # Lock-driven install into the emptied venv. + uninstall_urllib3(version, python, project, penv, case / "uninstall.log") + inst = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install.log") + res = oracle(version, python, after, project, penv, case / "oracle-1.log") + check("pipenvInstallExit0", inst.ok(), inst.tail(600) if not inst.ok() else None) + if shape == "marker-excluded": + check("excludedStaysAbsent", urllib3_absent(version, python, project, penv, case / "absence.log") and not any(res.values()), res) + else: + check("installedBytesPatched", all(res.get(n) == h for n, h in after.items()), res) + check("lockUnchangedByInstall", (project / "Pipfile.lock").read_bytes() == lock_after) + check("pipfileUnchangedByInstall", (project / "Pipfile").read_bytes() == pristine_pipfile) + vf = run_pipenv(version, tool, ["verify"], project, penv, case / "verify.log") + info["verify"] = {"exit": vf.rc, "tail": vf.tail(200)} + if major >= 2022: + rq = run_pipenv(version, tool, ["requirements"] + (["--dev"] if shape == "dev" else []) + (["--categories", "tests"] if shape == "category" else []), project, penv, case / "requirements.log") + marker = "patch.socket.dev" if mode == "hosted" else ".socket/vendor/pypi" + info["requirementsExport"] = {"exit": rq.rc, "exportsPatchRef": marker in rq.out, "urllib3Line": next((l for l in rq.out.splitlines() if "urllib3" in l.lower()), None)} + + # Fresh clone of the committed state (Pipfile, Pipfile.lock, .socket/), new venv. + fresh = case / "fresh" + shutil.copytree(project, fresh, ignore=shutil.ignore_patterns(".venv", "__pycache__")) + make_venv(version, tool, fresh / ".venv", fresh, case / "fresh-venv.log", native=True) + finst = run_pipenv(version, tool, install_args(version, shape), fresh, penv, case / "fresh-install.log") + fres = oracle(version, fresh / ".venv/bin/python", after, fresh, penv, case / "fresh-oracle.log") + if shape == "marker-excluded": + check("freshCloneKeepsExcluded", finst.ok() and urllib3_absent(version, fresh / ".venv/bin/python", fresh, penv, case / "fresh-absence.log"), {"exit": finst.rc}) + else: + check("freshCloneInstallsPatch", finst.ok() and all(fres.get(n) == h for n, h in after.items()), {"exit": finst.rc, "oracle": fres, "tail": finst.tail(500) if not finst.ok() else None}) + check("freshCloneLockUnchanged", (fresh / "Pipfile.lock").read_bytes() == lock_after) + + # vex over the installed, redirected/vendored tree + vx = Run([cli_bin, "vex", "--product", "pkg:pypi/pipenv-backtest-fixture@0.1.0", *cli_args, "--no-telemetry"], cwd, penv, case / "vex.log") + info["vex"] = vex_info(vx) + + # Tamper: corrupt every recorded sha; the install must fail where the installer verifies. + if shape in ("direct", "crlf") and shape != "marker-excluded": + uninstall_urllib3(version, python, project, penv, case / "tamper-uninstall.log") + corrupt = re.sub(rb"sha256[:=][a-f0-9]{64}", lambda m: m[0][:7] + b"0" * 64, lock_after) + (project / "Pipfile.lock").write_bytes(corrupt) + tam = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "tamper-install.log") + tres = oracle(version, python, after, project, penv, case / "tamper-oracle.log") + (project / "Pipfile.lock").write_bytes(lock_after) + info["tamper"] = {"installExit": tam.rc, "installedPatchedAnyway": bool(after) and all(tres.get(n) == h for n, h in after.items()), "expectsReject": mode == "hosted", "tail": tam.tail(300)} + if mode == "hosted": + check("tamperRejected", tam.rc != 0, info["tamper"]) + uninstall_urllib3(version, python, project, penv, case / "tamper-uninstall2.log") + require(run_pipenv(version, tool, install_args(version, shape), project, penv, case / "reinstall.log"), "reinstall after tamper") + check("lockRestoredAfterTamper", (project / "Pipfile.lock").read_bytes() == lock_after) + + # Relock: does Pipenv's own `lock` keep the patch reference? (informational) + rl = run_pipenv(version, tool, ["lock"], project, penv, case / "relock.log", timeout=900) + relocked = (project / "Pipfile.lock").read_bytes() + marker = b"patch.socket.dev" if mode == "hosted" else b".socket/vendor/pypi" + info["relock"] = {"exit": rl.rc, "lockBytesUnchanged": relocked == lock_after, "patchSourceKept": marker in relocked, "pipfileUnchanged": (project / "Pipfile").read_bytes() == pristine_pipfile, "tail": rl.tail(300) if not rl.ok() else None} + # A relock regenerated the entry: `rollback` must retire the redirect + # cleanly (exit 0, ledger cleared) instead of refusing forever — judged + # in a copy so the main flow keeps its state. Two relock outcomes exist: + # registry shape (the reference is gone; the relocked lock is the desired + # end state and must be kept) and the Pipenv 2023+ hybrid of a + # marker-excluded entry (our reference kept, upstream hashes + version + # restored around it); that entry is still ours and must roll back to + # the original registry entry, leaving no Socket reference behind. + if rl.ok() and relocked != lock_after: + relocked_dir = case / "relocked" + shutil.copytree(project, relocked_dir, ignore=shutil.ignore_patterns(".venv", "__pycache__")) + rcwd, rargs = cli_invocation(case, relocked_dir, "in-dir") + rrb = Run([cli_bin, "rollback", *rargs, "--json", "--yes", "--no-telemetry"], rcwd, penv, case / "relocked-rollback.log") + erb2 = rrb.json_or_empty() + ledger2 = relocked_dir / ".socket/vendor/redirect-state.json" + state2 = relocked_dir / ".socket/vendor/state.json" + cleared = (not ledger2.exists() or not json.loads(ledger2.read_text()).get("records")) and (not state2.exists() or not json.loads(state2.read_text()).get("entries")) + post = (relocked_dir / "Pipfile.lock").read_bytes() + hybrid = marker in relocked + if hybrid: + lock_ok = marker not in post and urllib3_entries(post) == urllib3_entries(pristine_lock) + else: + lock_ok = post == relocked + check("rollbackAfterRelockRetires", rrb.ok() and cleared and lock_ok, {"exit": rrb.rc, "cleared": cleared, "hybridRelock": hybrid, "lockKeptRelocked": post == relocked, "lockRestoredOriginal": post == pristine_lock, "referenceLeft": marker in post, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None}) + (project / "Pipfile.lock").write_bytes(lock_after) + (project / "Pipfile").write_bytes(pristine_pipfile) + + # Rollback restores every byte and clears the ledgers. + rb = cli_run(penv, "rollback", log="rollback.log") + erb = rb.json_or_empty() + check("rollbackExit0", rb.ok(), rb.tail(600) if not rb.ok() else None) + check("rollbackRestoresLockBytes", (project / "Pipfile.lock").read_bytes() == pristine_lock) + check("rollbackKeepsPipfile", (project / "Pipfile").read_bytes() == pristine_pipfile) + if mode == "hosted": + ledger = project / ".socket/vendor/redirect-state.json" + check("rollbackClearsRedirectLedger", not ledger.exists() or not json.loads(ledger.read_text()).get("records")) + if mode == "vendored": + check("rollbackRemovesVendoredWheel", not (project / ".socket/vendor/pypi" / (uuid or "x")).exists()) + state = project / ".socket/vendor/state.json" + check("rollbackClearsVendorState", not state.exists() or not json.loads(state.read_text()).get("entries")) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + info["rollbackEnvelope"] = {k: erb.get(k) for k in ("status", "rolledBack", "failed", "hosted", "vendoredReverted", "manifest") if k in erb} + # Measured boundaries, recorded rather than required: Pipenv never + # reinstalls a present release (warmInstallReplacesUpstream — the CLI + # warns instead, see staleInstallWarned) and the vendored --dry-run + # preview runs no backend guard. + informational = {"warmInstallReplacesUpstream"} + if mode == "vendored": + # The vendored --dry-run preview is ledger-only by design; recorded. + informational.add("dryRunParity") + row["passed"] = all(val for k, val in checks.items() if k not in informational) + return row + + def vex_info(vx): + try: + vdoc = json.loads(vx.out[vx.out.find("{"):]) if vx.ok() else {} + return {"exit": vx.rc, "statements": len(vdoc.get("statements", []))} + except Exception: + return {"exit": vx.rc, "tail": vx.tail(400)} + + # ------------------------------------------------------------ schedule + prepared = {} + with concurrent.futures.ThreadPoolExecutor(max_workers=args.jobs) as pool: + futs = {pool.submit(prepare_tool, v): v for v in args.versions} + for f in concurrent.futures.as_completed(futs): + v = futs[f] + try: + prepared[v] = f.result() + say("bootstrapped pipenv", v) + except Exception as e: + say("BOOTSTRAP FAILED", v, str(e)[-800:]) + + def wanted(version, shape, mode, invocation): + if version not in prepared: + return False + if shape == "category" and major_of(version) < 2022: + return False + if invocation != "in-dir" and shape != "direct": + return False + if mode in ("agent", "agent-oot") and shape in ("crlf",): + return False + if mode == "agent-oot" and shape == "marker-excluded": + return False + return True + + # One job per (version, shape[, invocation]); modes run sequentially inside so + # the shared original// lock is generated exactly once. + groups = {} + for v in args.versions: + for s in args.shapes: + for inv in invocations: + for m in args.modes: + if wanted(v, s, m, inv): + groups.setdefault((v, s), []).append((m, inv)) + say(f"{sum(len(ms) for ms in groups.values())} cases in {len(groups)} jobs") + results, errors = [], [] + + def run_group(key): + v, s = key + out = [] + for m, inv in groups[key]: + job = (v, s, m, inv) + try: + row = backtest(job) + out.append(("row", job, row)) + except Exception as e: + out.append(("error", job, {"pipenv": v, "shape": s, "mode": m, "invocation": inv, "error": str(e)[-3000:], "trace": traceback.format_exc()[-1500:]})) + yield out[-1] + + def flush(): + save(root / "summary.json", {"provenance": provenance, "results": sorted(results, key=lambda r: (vtuple(r["pipenv"]), r["shape"], r["mode"], r["invocation"])), "errors": errors}) + + def consume(key): + for kind, job, payload in run_group(key): + with log_lock: + if kind == "row": + results.append(payload) + failed = [k for k, ok in payload["checks"].items() if not ok] + print(*job, "PASS" if payload["passed"] else "FAIL", ",".join(failed), flush=True) + else: + errors.append(payload) + print(*job, "ERROR", payload["error"][-300:].replace("\n", " "), flush=True) + flush() + + with concurrent.futures.ThreadPoolExecutor(max_workers=args.jobs) as pool: + list(pool.map(consume, list(groups))) + flush() + summary = json.loads((root / "summary.json").read_text()) + (root / "summary.md").write_text(render_table(summary)) + say(render_table(summary)) + if errors or any(not r["passed"] for r in results): + sys.exit(1) + + +def _flag(cases, key, sub=None, sub2=None): + vals = set() + for c in cases: + i = c.get("info", {}).get(key) + if isinstance(i, dict) and sub is not None: + i = i.get(sub) + if isinstance(i, dict) and sub2 is not None: + i = i.get(sub2) + if isinstance(i, (bool, int, str)): + vals.add(i) + return "/".join(sorted(str(v).lower() for v in vals)) or "n/a" + + +def render_doc_table(summary): + """Per-version compatibility table for docs/testing/pipenv-compatibility.md.""" + rows = summary["results"] + by = {} + for r in rows: + by.setdefault(r["pipenv"], []).append(r) + lines = [ + "| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) |", + "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |", + ] + + def cell(cases): + if not cases: + return "n/a" + refused = [c for c in cases if c.get("supported") is False] + if refused and len(refused) == len(cases): + ok = sum(1 for c in cases if c["passed"]) + return ("refused" if ok == len(cases) else f"refused {ok}/{len(cases)}") + " (" + refused[0]["expected"].split("(")[-1].rstrip(")") + ")" + ok = sum(1 for c in cases if c["passed"]) + shapes = ",".join(sorted({c["shape"] for c in cases})) + return ("pass" if ok == len(cases) else f"{ok}/{len(cases)}") + f" ({shapes})" + + def yes_no(cases, key, sub): + vals = {c["info"][key][sub] for c in cases if isinstance(c.get("info", {}).get(key), dict)} + if not vals: + return "n/a" + return "/".join("yes" if v else "no" for v in sorted(vals, key=lambda x: not x)) + + for version in sorted(by, key=vtuple): + cs = by[version] + m = lambda mode: [c for c in cs if c["mode"] == mode and c["invocation"] == "in-dir"] + hosted, vendored = m("hosted"), m("vendored") + dh = [c for c in hosted if c["shape"] == "direct" and c.get("supported")] + dv = [c for c in vendored if c["shape"] == "direct" and c.get("supported")] + tamper = f"{'yes' if any(c['info'].get('tamper', {}).get('installExit') not in (None, 0) for c in dh) else ('n/a' if not dh else 'no')} / {'yes' if any(c['info'].get('tamper', {}).get('installExit') not in (None, 0) for c in dv) else ('n/a' if not dv else 'no')}" + warm = f"{_flag(dh, 'warmReinstalled', 'install', 'patched')} / {_flag(dv, 'warmReinstalled', 'install', 'patched')}" + relock = f"{_flag(dh, 'relock', 'patchSourceKept')} / {_flag(dv, 'relock', 'patchSourceKept')}" + verify = f"{_flag(dh, 'verify', 'exit')} / {_flag(dv, 'verify', 'exit')}" + oot = m("agent-oot") + sees = "/".join(sorted({str(c["checks"].get("bareScanSeesPipenvVenv")).lower() for c in oot})) if oot else "n/a" + lines.append(f"| {version} | {cell(hosted)} | {cell(vendored)} | {cell(m('agent'))} | {cell(oot)} | {sees} | {tamper} | {warm} | {relock} | {verify} |") + return "\n".join(lines) + + +def render_table(summary): + rows = summary["results"] + lines = ["| Pipenv | shape | mode | invocation | passed | failed checks | notes |", "| --- | --- | --- | --- | --- | --- | --- |"] + for r in sorted(rows, key=lambda r: (vtuple(r["pipenv"]), r["shape"], r["mode"], r["invocation"])): + failed = ", ".join(k for k, ok in r["checks"].items() if not ok) + notes = [] + info = r.get("info", {}) + if r.get("expected"): + notes.append(r["expected"]) + if "sourceKeys" in info: + notes.append("source key " + ",".join(info["sourceKeys"])) + if "warmReinstalled" in info: + notes.append("warm reinstalled " + ",".join(f"{k}={v['patched']}" for k, v in info["warmReinstalled"].items())) + if "relock" in info: + notes.append(f"relock exit {info['relock'].get('exit')} keeps patch={info['relock'].get('patchSourceKept')}") + if "tamper" in info: + notes.append(f"tamper install exit {info['tamper']['installExit']}") + if "verify" in info: + notes.append(f"verify exit {info['verify']['exit']}") + if "requirementsExport" in info: + notes.append(f"requirements exports patch ref={info['requirementsExport'].get('exportsPatchRef')}") + if "lockOnly" in info: + notes.append(f"lock-only applied={info['lockOnly']['applied']} {info['lockOnly']['codes']}") + if "bareScan" in info: + notes.append(f"bare scan sees venv={r['checks'].get('bareScanSeesPipenvVenv')} apply via {info.get('applyPath')}") + if "vex" in info: + notes.append(f"vex exit {info['vex'].get('exit')} stmts={info['vex'].get('statements')}") + lines.append(f"| {r['pipenv']} | {r['shape']} | {r['mode']} | {r['invocation']} | {'PASS' if r['passed'] else 'FAIL'} | {failed} | {'; '.join(notes)} |") + for e in summary.get("errors", []): + lines.append(f"| {e.get('pipenv')} | {e.get('shape')} | {e.get('mode')} | {e.get('invocation')} | ERROR | {e['error'][-160:].replace(chr(10), ' ')} | |") + return "\n".join(lines) + + +if __name__ == "__main__": + main()