From d70d21864c1808dc24f07dcefbfa4d6aeaa40039 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 14:49:59 -0400 Subject: [PATCH 01/27] Support hosted Pipenv patches safely Preserve Pipenv categories and source identity when applying patches. Handle legacy hosted references and vendored extras, reject unsupported installers, and restore lock entries safely during rollback. Assisted-by: Codex:gpt-6-astra --- README.md | 21 + .../src/commands/repair_vendor.rs | 2 + .../src/commands/scan/hosted.rs | 19 +- .../socket-patch-cli/src/commands/vendor.rs | 20 +- .../src/patch/redirect/mod.rs | 19 + .../src/patch/redirect/pipenv.rs | 488 ++++++++++++++++++ .../src/patch/redirect/replay.rs | 148 +++++- crates/socket-patch-core/src/utils/mod.rs | 1 + crates/socket-patch-core/src/utils/pipenv.rs | 34 ++ crates/socket-patch-core/src/vendor/pypi.rs | 56 +- .../src/vendor/pypi_pipenv.rs | 178 +++++-- 11 files changed, 899 insertions(+), 87 deletions(-) create mode 100644 crates/socket-patch-core/src/patch/redirect/pipenv.rs create mode 100644 crates/socket-patch-core/src/utils/pipenv.rs diff --git a/README.md b/README.md index 093b07dc..34a51bcc 100644 --- a/README.md +++ b/README.md @@ -254,6 +254,27 @@ Mode support varies by ecosystem — e.g. Go can't do hosted, Rush monorepos can vendored. See the full **[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)** for details and per-ecosystem caveats. +### Pipenv compatibility + +Hosted mode rewrites every matching `Pipfile.lock` category and preserves the +Pipfile, its content hash, markers, extras, and unrelated lock entries. Socket +Patch checks the installed Pipenv version: releases 7–11 need hosted `path` +references, while releases from 2018 onward use `file` references. Hosted +references include the SHA-256 URL fragment so pip verifies downloaded bytes. +Old lock formats before `pipfile-spec: 6` are refused without changing the lock. + +Vendored mode requires Pipenv 2018 or later. Wheels with extras use `path` +references to avoid Pipenv 2022's local-file URL parsing bug. Native Pipenv does +not consistently enforce hashes on local wheels; commit the wheel and run +`socket-patch verify`. Re-run Socket Patch after re-locking dependencies. + +The compatibility backtest covers the last stable release of every published +Pipenv major, including unsupported versions to verify explicit refusal. It +checks actual installed patch bytes, repeat scans, hash corruption, normal +installs, lock-only installs, and `sync` where available. Parser/rewriter tests +also cover categories, source/version conflicts, malformed locks, CRLF, +rotating grants, and rollback with unrelated edits or drift. + ## Common tasks ### Patch everything that can be patched diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs index be72ca41..0582a0f9 100644 --- a/crates/socket-patch-cli/src/commands/repair_vendor.rs +++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs @@ -1119,6 +1119,7 @@ pub(crate) async fn repair_vendored_artifacts( // ── Rebuild via the normal backends ────────────────────────────────── let vendored_at = now_rfc3339(); + let pipenv_version = tokio::sync::OnceCell::new(); for c in candidates { if unrebuildable.contains(&c.purl) { continue; @@ -1181,6 +1182,7 @@ pub(crate) async fn repair_vendored_artifacts( false, // Repair rebuilds locally from the recorded patch — no service. None, + &pipenv_version, ) .await; match outcome { diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 2060cac0..5ae83341 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -27,6 +27,7 @@ const REDIRECT_CANDIDATE_FILES: &[&str] = &[ "bun.lock", "requirements.txt", "uv.lock", + "Pipfile.lock", "pyproject.toml", "Cargo.toml", "Cargo.lock", @@ -798,7 +799,7 @@ pub(crate) async fn run_redirect_selected( ) -> i32 { use socket_patch_core::manifest::schema::PatchRecord; use socket_patch_core::patch::redirect::{ - rewrite_registry_redirect_with_python_metadata, DepOverride, RedirectState, + rewrite_registry_redirect_with_pipenv_version, DepOverride, RedirectState, }; let mut skipped: Vec = Vec::new(); @@ -1391,8 +1392,17 @@ pub(crate) async fn run_redirect_selected( } } overrides.retain(|dep| !unavailable_python_artifacts.contains(&dep.artifact_url)); - let mut rewrite = - rewrite_registry_redirect_with_python_metadata(&files, &overrides, &python_metadata); + let pipenv_major = if files.contains_key("Pipfile.lock") { + socket_patch_core::utils::pipenv::installed_major(&common.cwd).await + } else { + None + }; + let mut rewrite = rewrite_registry_redirect_with_pipenv_version( + &files, + &overrides, + &python_metadata, + pipenv_major, + ); // The lockb→text migration is only KEPT when the rewrite actually landed // in the migrated bun.lock. Otherwise nothing was redirected there and the @@ -1675,6 +1685,9 @@ pub(crate) async fn run_redirect_selected( .iter() .filter( |(purl, uuid, artifact_url, index_url, suffixed_version, go_module_path)| { + if rewrite.refused_pipenv_uuids.contains(uuid) { + return false; + } if rewrite.refused_pnpm_uuids.contains(uuid) { return false; } diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs index 7c896751..3725b81b 100644 --- a/crates/socket-patch-cli/src/commands/vendor.rs +++ b/crates/socket-patch-cli/src/commands/vendor.rs @@ -105,6 +105,7 @@ pub(crate) async fn dispatch_vendor_one( // --vendor` / repair. Per-ecosystem backends consume it as they gain a // service path. service: Option<&VendorServiceConfig>, + pipenv_version: &tokio::sync::OnceCell>, ) -> Option { let eco = ecosystem_dir_for_purl(purl)?; @@ -155,7 +156,21 @@ pub(crate) async fn dispatch_vendor_one( // The flavor router probes the project's lockfile (package-lock / // yarn / pnpm / bun) and dispatches or refuses per flavor. "npm" => vend!(vendor::npm_flavor::vendor_npm_any), - "pypi" => vend!(vendor::pypi::vendor_pypi), + "pypi" => { + vendor::pypi::vendor_pypi_with_pipenv_version( + purl, + pkg_path, + project_root, + record, + sources, + vendored_at, + dry_run, + force, + service, + pipenv_version, + ) + .await + } "gem" => vend!(vendor::gem::vendor_gem), "cargo" => vend!(vendor::cargo::vendor_cargo_crate), "golang" => vend!(vendor::golang::vendor_go_module), @@ -958,6 +973,7 @@ pub(crate) async fn vendor_records( Err(corrupt) => (None, Some(corrupt)), }; + let pipenv_version = tokio::sync::OnceCell::new(); for (purl, pkg_path) in &all_packages { let is_variant_eco = Ecosystem::from_purl(purl).is_some_and(|e| e.supports_release_variants()); @@ -1151,6 +1167,7 @@ pub(crate) async fn vendor_records( common.dry_run, force, service, + &pipenv_version, ) .await; @@ -1809,6 +1826,7 @@ mod dispatch_tests { false, false, Some(&service), + &tokio::sync::OnceCell::new(), ) .await; // The backend itself may refuse (nothing is installed in the diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs index d291c7b9..71a7b2d7 100644 --- a/crates/socket-patch-core/src/patch/redirect/mod.rs +++ b/crates/socket-patch-core/src/patch/redirect/mod.rs @@ -24,6 +24,7 @@ use crate::crawlers::composer_crawler::normalize_version; use crate::vendor::yarn_berry_lock::yarnrc_compression_level; pub mod golang_local; +mod pipenv; mod pnpm; mod replay; mod requirements; @@ -171,6 +172,8 @@ pub struct RewriteResult { /// presence in rewritten files (a `[registries.…]` config block alone /// pins nothing). pub confirmed_cargo_uuids: std::collections::BTreeSet, + pub confirmed_pipenv_uuids: std::collections::BTreeSet, + pub refused_pipenv_uuids: std::collections::BTreeSet, /// An incomplete pnpm rewrite must not be confirmed by finding its URL /// in another instance, a comment, or another lockfile. pub refused_pnpm_uuids: std::collections::BTreeSet, @@ -206,8 +209,24 @@ pub fn rewrite_registry_redirect_with_python_metadata( files: &BTreeMap, overrides: &[DepOverride], python_metadata: &BTreeMap, +) -> RewriteResult { + rewrite_registry_redirect_with_pipenv_version(files, overrides, python_metadata, None) +} + +pub fn rewrite_registry_redirect_with_pipenv_version( + files: &BTreeMap, + overrides: &[DepOverride], + python_metadata: &BTreeMap, + pipenv_major: Option, ) -> RewriteResult { let mut result = RewriteResult::default(); + pipenv::rewrite(files, overrides, pipenv_major, &mut result); + let overrides: Vec<_> = overrides + .iter() + .filter(|dep| !result.refused_pipenv_uuids.contains(&dep.patch_uuid)) + .cloned() + .collect(); + let overrides = overrides.as_slice(); rewrite_npm_lock(files, overrides, &mut result); rewrite_pnpm_lock(files, overrides, &mut result); rewrite_yarn_classic(files, overrides, &mut result); diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs new file mode 100644 index 00000000..def43c62 --- /dev/null +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -0,0 +1,488 @@ +use std::collections::{BTreeMap, BTreeSet}; +use std::ops::Range; + +use serde::Serialize; +use serde_json::{json, Value}; + +use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning}; +use crate::crawlers::python_crawler::canonicalize_pypi_name; + +struct Property { + name: String, + range: Range, + value: Value, +} + +fn properties(text: &str, offset: usize) -> Result, String> { + let mut index = offset + 1; + let mut names = BTreeSet::new(); + let mut result = Vec::new(); + loop { + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + if text.as_bytes().get(index) == Some(&b'}') { + return Ok(result); + } + let mut keys = serde_json::Deserializer::from_str(&text[index..]).into_iter::(); + let name = keys + .next() + .ok_or("missing JSON key")? + .map_err(|e| e.to_string())?; + if !names.insert(name.clone()) { + return Err("duplicate JSON key".into()); + } + index += keys.byte_offset(); + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + if text.as_bytes().get(index) != Some(&b':') { + return Err("missing JSON colon".into()); + } + index += 1; + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + let start = index; + let mut values = serde_json::Deserializer::from_str(&text[index..]).into_iter::(); + let value = values + .next() + .ok_or("missing JSON value")? + .map_err(|e| e.to_string())?; + index += values.byte_offset(); + result.push(Property { + name, + range: start..index, + value, + }); + while text + .as_bytes() + .get(index) + .is_some_and(u8::is_ascii_whitespace) + { + index += 1; + } + match text.as_bytes().get(index) { + Some(b',') => index += 1, + Some(b'}') => return Ok(result), + _ => return Err("invalid JSON object".into()), + } + } +} + +fn entries(text: &str) -> Result, String> { + let value: Value = serde_json::from_str(text).map_err(|e| e.to_string())?; + if !value.is_object() { + return Err("Pipfile.lock is not an object".into()); + } + if value.pointer("/_meta/pipfile-spec").and_then(Value::as_u64) != Some(6) { + return Err("only pipfile-spec 6 supports patch file references".into()); + } + let mut result = Vec::new(); + for section in properties(text, text.find('{').ok_or("missing root")?)? { + if section.name == "_meta" { + continue; + } + if !section.value.is_object() { + return Err(format!("{} is not a category object", section.name)); + } + for entry in properties(text, section.range.start)? { + if entry.value.is_object() { + properties(text, entry.range.start)?; + } + result.push((section.name.clone(), entry)); + } + } + Ok(result) +} + +fn format_entry(value: &Value, text: &str, start: usize) -> Result { + let mut bytes = Vec::new(); + let formatter = serde_json::ser::PrettyFormatter::with_indent(b" "); + value + .serialize(&mut serde_json::Serializer::with_formatter( + &mut bytes, formatter, + )) + .map_err(|e| e.to_string())?; + let formatted = String::from_utf8(bytes).map_err(|e| e.to_string())?; + let line_start = text[..start].rfind('\n').map_or(0, |i| i + 1); + let indent: String = text[line_start..start] + .chars() + .take_while(|c| *c == ' ' || *c == '\t') + .collect(); + let ending = if text.contains("\r\n") { "\r\n" } else { "\n" }; + Ok(formatted.replace('\n', &format!("{ending}{indent}"))) +} + +pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { + if edit.path != "Pipfile.lock" { + return Err("Pipenv edit must target Pipfile.lock".into()); + } + let [section, name]: [String; 2] = + serde_json::from_str(edit.key.as_deref().ok_or("missing Pipenv key")?) + .map_err(|e| e.to_string())?; + let original = edit + .original + .as_ref() + .and_then(Value::as_str) + .ok_or("missing Pipenv original")?; + let new = edit + .new + .as_ref() + .and_then(Value::as_str) + .ok_or("missing Pipenv replacement")?; + let (_, entry) = entries(text)? + .into_iter() + .find(|(category, entry)| category == §ion && entry.name == name) + .ok_or("Pipenv entry missing")?; + let live = &text[entry.range.clone()]; + if live == original { + return Ok(text.into()); + } + if live != new { + return Err(format!("Pipenv entry {section}.{name} drifted")); + } + let mut result = text.to_owned(); + result.replace_range(entry.range, original); + Ok(result) +} + +pub(super) fn rewrite( + files: &BTreeMap, + overrides: &[DepOverride], + pipenv_major: Option, + result: &mut RewriteResult, +) { + let Some(original) = files.get("Pipfile.lock") else { + return; + }; + let mut text = original.clone(); + for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") { + let planned = plan(&text, dep, pipenv_major); + match planned { + Ok((rewritten, edits)) => { + result.confirmed_pipenv_uuids.insert(dep.patch_uuid.clone()); + text = rewritten; + result.edits.extend(edits); + } + Err(detail) => { + result.refused_pipenv_uuids.insert(dep.patch_uuid.clone()); + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_refused".into(), + detail, + }); + } + } + } + if &text != original { + result.files.insert("Pipfile.lock".into(), text); + } +} + +fn owned_url(value: &str, dep: &DepOverride) -> bool { + let Ok(url) = reqwest::Url::parse(value) else { + return false; + }; + let parts: Vec<_> = url.path().split('/').collect(); + url.scheme() == "https" + && url.host_str() == Some("patch.socket.dev") + && url.username().is_empty() + && url.password().is_none() + && url.port().is_none() + && url.query().is_none() + && parts.len() == 8 + && parts[1] == "patch" + && parts[2] == "pypi" + && canonicalize_pypi_name(parts[3]) == canonicalize_pypi_name(&dep.name) + && parts[4] == dep.version + && !parts[5].is_empty() + && !parts[6].is_empty() + && parts[7].ends_with(".whl") + && parts[7] + .split('-') + .next() + .is_some_and(|name| canonicalize_pypi_name(name) == canonicalize_pypi_name(&dep.name)) + && parts[7].split('-').nth(1) == Some(dep.version.as_str()) +} + +fn plan( + text: &str, + dep: &DepOverride, + pipenv_major: Option, +) -> Result<(String, Vec), String> { + let sha = dep + .integrity + .sha256 + .as_deref() + .filter(|hash| hash.len() == 64 && hash.bytes().all(|byte| byte.is_ascii_hexdigit())) + .ok_or("Pipenv patch requires a SHA-256 digest")?; + let url = format!( + "{}#sha256={sha}", + dep.artifact_url + .split('#') + .next() + .ok_or("missing artifact URL")? + ); + let targets: Vec<_> = entries(text)? + .into_iter() + .filter(|(_, entry)| { + canonicalize_pypi_name(&entry.name) == canonicalize_pypi_name(&dep.name) + }) + .collect(); + if targets.is_empty() { + return Err(format!("Pipfile.lock has no entry for {}", dep.name)); + } + let source_key = if pipenv_major.is_some_and(|major| (7..2018).contains(&major)) { + "path" + } else { + "file" + }; + let mut changes = Vec::new(); + for (section, entry) in targets { + let object = entry + .value + .as_object() + .ok_or("Pipenv dependency is not an object")?; + if ["git", "hg", "svn", "bzr", "editable"] + .iter() + .any(|key| object.contains_key(*key)) + || (object.contains_key("file") && object.contains_key("path")) + { + return Err(format!( + "Pipenv source for {} is not a registry package", + dep.name + )); + } + if let Some(file) = object.get("file").or_else(|| object.get("path")) { + if !file.as_str().is_some_and(|value| owned_url(value, dep)) + || object.contains_key("version") + || object.contains_key("index") + { + return Err(format!("Pipenv source for {} already exists", dep.name)); + } + if object.get(source_key).and_then(Value::as_str) == Some(&url) + && object.get("hashes") == Some(&json!([format!("sha256:{sha}")])) + { + continue; + } + } else if object.get("version").and_then(Value::as_str) + != Some(format!("=={}", dep.version).as_str()) + { + return Err(format!( + "Pipenv version for {} does not match {}", + dep.name, dep.version + )); + } + let mut new = object.clone(); + new.remove("version"); + new.remove("index"); + new.remove("file"); + new.remove("path"); + new.insert(source_key.into(), Value::String(url.clone())); + new.insert("hashes".into(), json!([format!("sha256:{sha}")])); + let mut new = Value::Object(new); + new.sort_all_objects(); + let replacement = format_entry(&new, text, entry.range.start)?; + let edit = FileEdit { + path: "Pipfile.lock".into(), + kind: "redirect_pipenv_entry".into(), + action: "rewritten".into(), + key: Some(json!([section, entry.name]).to_string()), + original: Some(Value::String(text[entry.range.clone()].into())), + new: Some(Value::String(replacement.clone())), + }; + changes.push((entry.range, replacement, edit)); + } + let mut rewritten = text.to_owned(); + let mut edits = Vec::new(); + for (range, replacement, edit) in changes.into_iter().rev() { + rewritten.replace_range(range, &replacement); + edits.push(edit); + } + Ok((rewritten, edits)) +} + +#[cfg(test)] +mod tests { + use super::*; + + pub(super) fn dependency(name: &str, version: &str, uuid: &str) -> DepOverride { + serde_json::from_value(json!({ + "ecosystem":"pypi", "name":name, "version":version, + "patchUuid":uuid,"token":"token", + "artifactUrl":format!("https://patch.socket.dev/patch/pypi/{name}/{version}/token/{uuid}/{name}-{version}-py3-none-any.whl"), + "integrity":{"sha256":"a".repeat(64)} + })).unwrap() + } + + pub(super) fn lock() -> String { + let mut value = json!({"_meta":{"pipfile-spec":6,"hash":{"sha256":"unchanged"}},"default":{"urllib3":{"version":"==1.26.18","index":"pypi","hashes":["old"],"extras":["socks"],"markers":"python_version < '4'"}},"develop":{},"tests":{"urllib3":{"version":"==1.26.18"}}}); + value.sort_all_objects(); + format_entry(&value, "{", 0).unwrap() + "\n" + } + + #[test] + fn all_categories_preserve_extras_markers_metadata_and_repeat_bytes() { + for ending in ["\n", "\r\n"] { + let original = lock().replace('\n', ending); + let dep = dependency("URLLib3", "1.26.18", "patch-one"); + let (text, edits) = plan(&original, &dep, None).unwrap(); + assert_eq!(edits.len(), 2); + let value: Value = serde_json::from_str(&text).unwrap(); + let before: Value = serde_json::from_str(&original).unwrap(); + assert_eq!(value["_meta"], before["_meta"]); + for field in ["extras", "markers"] { + assert_eq!( + value["default"]["urllib3"][field], + before["default"]["urllib3"][field] + ); + } + assert_eq!(plan(&text, &dep, None).unwrap(), (text.clone(), Vec::new())); + let mut restored = text; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + } + } + + #[test] + fn refusal_is_atomic_across_categories() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + for bad in [ + json!({"version":"==2.0"}), + json!({"version":"*"}), + json!({"file":"https://example.org/fork.whl"}), + json!({"version":"==1.26.18","git":"https://example.org/fork"}), + json!({"version":"==1.26.18","editable":false}), + json!(null), + json!({"version":"==1.26.18","path":"./fork"}), + ] { + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + value["tests"]["urllib3"] = bad; + let original = serde_json::to_string(&value).unwrap(); + let files = BTreeMap::from([("Pipfile.lock".into(), original)]); + let mut result = RewriteResult::default(); + rewrite(&files, std::slice::from_ref(&dep), None, &mut result); + assert!(result.files.is_empty()); + assert!(result.edits.is_empty()); + assert!(result.confirmed_pipenv_uuids.is_empty()); + assert_eq!(result.warnings.len(), 1); + } + } + + #[test] + fn malformed_duplicate_and_unsupported_locks_refuse() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + for text in [ + "null".to_owned(), + "[]".into(), + "{".into(), + lock().replace("\"pipfile-spec\": 6", "\"pipfile-spec\": 5"), + lock().replace("\"default\": {", "\"default\": {}, \"default\": {"), + lock().replace( + "\"version\": \"==1.26.18\"", + "\"version\": \"==2.0\", \"version\": \"==1.26.18\"", + ), + ] { + assert!(plan(&text, &dep, None).is_err(), "{text}"); + } + let mut missing_hash = dep.clone(); + missing_hash.integrity.sha256 = None; + assert!(plan(&lock(), &missing_hash, None).is_err()); + } + + #[test] + fn rollback_is_per_entry_preserves_unrelated_edits_and_refuses_drift() { + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + value["default"]["six"] = json!({"version":"==1.16.0"}); + let original = serde_json::to_string_pretty(&value).unwrap(); + let first = dependency("urllib3", "1.26.18", "patch-one"); + let second = dependency("six", "1.16.0", "patch-two"); + let (one, first_edits) = plan(&original, &first, None).unwrap(); + let (two, second_edits) = plan(&one, &second, None).unwrap(); + for first_removed in [true, false] { + let mut current = two.replace("unchanged", "unrelated-edit"); + let edits = if first_removed { + first_edits + .iter() + .chain(second_edits.iter()) + .collect::>() + } else { + second_edits.iter().chain(first_edits.iter()).collect() + }; + for edit in edits { + current = restore(¤t, edit).unwrap(); + } + assert_eq!(current, original.replace("unchanged", "unrelated-edit")); + } + for edit in &first_edits { + let replacement = edit.new.as_ref().unwrap().as_str().unwrap(); + let drift = two.replacen( + replacement, + &replacement.replace("sha256:", &format!("sha256:{}", "0")), + 1, + ); + assert!(restore(&drift, edit).is_err()); + let mut unsafe_edit = edit.clone(); + unsafe_edit.path = "../Pipfile.lock".into(); + assert!(restore(&two, &unsafe_edit).is_err()); + } + } +} + +#[cfg(test)] +mod compatibility_tests { + use super::*; + #[test] + fn rotates_owned_grants_and_preserves_rollback_chain() { + let mut dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + for major in [Some(7), Some(11), Some(2018), Some(2026), None] { + let original = super::tests::lock(); + let (first, edits) = plan(&original, &dep, major).unwrap(); + let parsed: Value = serde_json::from_str(&first).unwrap(); + let field = if major.is_some_and(|value| value < 2018) { + "path" + } else { + "file" + }; + assert!(parsed["default"]["urllib3"][field].is_string()); + dep.artifact_url = dep.artifact_url.replace("/token/", "/rotated/"); + let (second, rotation) = plan(&first, &dep, major).unwrap(); + let mut restored = second; + for edit in rotation.iter().chain(edits.iter()) { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + dep.artifact_url = dep.artifact_url.replace("/rotated/", "/token/"); + } + } + + #[test] + fn conflicting_pipenv_pin_cannot_partially_redirect_requirements() { + let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + let files = BTreeMap::from([ + ( + "Pipfile.lock".into(), + super::tests::lock().replace("==1.26.18", "==2.0"), + ), + ("requirements.txt".into(), "urllib3==1.26.18\n".into()), + ]); + let result = super::super::rewrite_registry_redirect(&files, &[dep]); + assert!(result.files.is_empty()); + assert!(result.edits.is_empty()); + assert!(result.refused_pipenv_uuids.contains("patch-one")); + } +} diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs index af29f644..00a0724d 100644 --- a/crates/socket-patch-core/src/patch/redirect/replay.rs +++ b/crates/socket-patch-core/src/patch/redirect/replay.rs @@ -52,6 +52,7 @@ enum Inverse { /// writers record an `original` that is a substring of `new` (the /// Cargo.toml insert variant, the maven version suffix). ReplaceFragment, + PipenvEntry, /// action `added` with only `new` recorded: the redirect inserted the /// fragment into a pre-existing file, so the inverse removes it once /// (an absent fragment is the desired end state — no-op). @@ -86,9 +87,14 @@ enum Inverse { /// Gemfile.lock) revert together or not at all. fn classify(kind: &str, action: &str) -> (&'static str, Inverse) { match kind { - "redirect_requirements_line" | "redirect_uv_lock_wheel" => ("pypi", Inverse::ReplaceFragment), + "redirect_pipenv_entry" => ("pypi", Inverse::PipenvEntry), + "redirect_requirements_line" | "redirect_uv_lock_wheel" => { + ("pypi", Inverse::ReplaceFragment) + } "redirect_composer_dist" => ("composer", Inverse::ReplaceFragment), - "redirect_cargo_toml_dep" | "redirect_cargo_lock_entry" => ("cargo", Inverse::ReplaceFragment), + "redirect_cargo_toml_dep" | "redirect_cargo_lock_entry" => { + ("cargo", Inverse::ReplaceFragment) + } "redirect_cargo_registry" => ( "cargo", if action == "added" { @@ -406,6 +412,24 @@ pub async fn revert_remaining_redirect_edits( refused_groups.insert(group); continue 'group; } + Inverse::PipenvEntry => { + let restored = match staged_read(&staged, project_root, &edit.path).await { + Ok(Some(content)) => super::pipenv::restore(&content, &edit), + Ok(None) => Err(format!("{} no longer exists", edit.path)), + Err(error) => Err(error), + }; + match restored { + Ok(content) => { + staged.insert(edit.path.clone(), Some(content)); + group_drops.insert(idx); + } + Err(error) => { + refuse(error, &mut outcome); + refused_groups.insert(group); + continue 'group; + } + } + } Inverse::ReplaceFragment => { let (Some(original), Some(new)) = (str_payload(&edit.original), str_payload(&edit.new)) @@ -420,10 +444,7 @@ pub async fn revert_remaining_redirect_edits( let content = match staged_read(&staged, project_root, &edit.path).await { Ok(Some(c)) => c, Ok(None) => { - refuse( - format!("{} no longer exists", edit.path), - &mut outcome, - ); + refuse(format!("{} no longer exists", edit.path), &mut outcome); refused_groups.insert(group); continue 'group; } @@ -448,10 +469,7 @@ pub async fn revert_remaining_redirect_edits( refused_groups.insert(group); continue 'group; } - staged.insert( - edit.path.clone(), - Some(content.replacen(new, original, 1)), - ); + staged.insert(edit.path.clone(), Some(content.replacen(new, original, 1))); group_drops.insert(idx); } else if content.contains(original) && !new.contains(original) { // Already at the pre-edit state (an interrupted @@ -686,7 +704,13 @@ mod tests { use serde_json::json; use tempfile::TempDir; - fn edit(path: &str, kind: &str, action: &str, original: Option<&str>, new: Option<&str>) -> FileEdit { + fn edit( + path: &str, + kind: &str, + action: &str, + original: Option<&str>, + new: Option<&str>, + ) -> FileEdit { FileEdit { path: path.into(), kind: kind.into(), @@ -711,7 +735,8 @@ mod tests { description: String::new(), license: String::new(), tier: "free".into(), - }); + }, + ); } state } @@ -733,7 +758,12 @@ mod tests { #[tokio::test] async fn rewritten_fragment_replays_to_original() { let dir = TempDir::new().unwrap(); - write(dir.path(), "requirements.txt", "left-pad @ https://patch.example/x.whl\n").await; + write( + dir.path(), + "requirements.txt", + "left-pad @ https://patch.example/x.whl\n", + ) + .await; let mut state = state_with( vec![edit( "requirements.txt", @@ -756,7 +786,12 @@ mod tests { async fn substring_original_checks_new_first() { // The maven version-suffix shape: original is a substring of new. let dir = TempDir::new().unwrap(); - write(dir.path(), "pom.xml", "2.17.1-socket-abc\n").await; + write( + dir.path(), + "pom.xml", + "2.17.1-socket-abc\n", + ) + .await; let mut state = state_with( vec![edit( "pom.xml", @@ -868,7 +903,12 @@ mod tests { #[tokio::test] async fn chained_reredirect_unwinds_newest_first_to_pristine() { let dir = TempDir::new().unwrap(); - write(dir.path(), "go.mod", "module m\n\nreplace x => gopatch.socket.dev/x v2\n").await; + write( + dir.path(), + "go.mod", + "module m\n\nreplace x => gopatch.socket.dev/x v2\n", + ) + .await; let mut state = state_with( vec![ edit( @@ -1159,7 +1199,13 @@ mod tests { async fn unknown_kind_fails_closed() { let dir = TempDir::new().unwrap(); let mut state = state_with( - vec![edit("f", "redirect_future_thing", "rewritten", Some("a"), Some("b"))], + vec![edit( + "f", + "redirect_future_thing", + "rewritten", + Some("a"), + Some("b"), + )], &[], ); let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; @@ -1172,7 +1218,12 @@ mod tests { async fn leftover_npm_json_edit_refuses_and_holds_every_npm_family_record() { let dir = TempDir::new().unwrap(); write(dir.path(), "package-lock.json", "{}\n").await; - write(dir.path(), "bun.lock", "\"pkg\": [\"https://patch.example/t.tgz\"]\n").await; + write( + dir.path(), + "bun.lock", + "\"pkg\": [\"https://patch.example/t.tgz\"]\n", + ) + .await; let mut state = state_with( vec![ FileEdit { @@ -1355,7 +1406,12 @@ mod tests { #[tokio::test] async fn dry_run_reports_without_touching_disk_or_ledger() { let dir = TempDir::new().unwrap(); - write(dir.path(), "requirements.txt", "left-pad @ https://patch.example/x.whl\n").await; + write( + dir.path(), + "requirements.txt", + "left-pad @ https://patch.example/x.whl\n", + ) + .await; let mut state = state_with( vec![edit( "requirements.txt", @@ -1384,7 +1440,13 @@ mod tests { let dir = TempDir::new().unwrap(); for bad in ["/etc/passwd", "../outside", "a/../../b", "c:\\windows\\x"] { let mut state = state_with( - vec![edit(bad, "redirect_requirements_line", "rewritten", Some("a"), Some("b"))], + vec![edit( + bad, + "redirect_requirements_line", + "rewritten", + Some("a"), + Some("b"), + )], &[], ); let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; @@ -1836,7 +1898,12 @@ mod tests { #[tokio::test] async fn trust_line_already_absent_leaves_the_file_untouched() { let dir = TempDir::new().unwrap(); - write(dir.path(), "pnpm-workspace.yaml", "packages:\n - 'apps/*'\n").await; + write( + dir.path(), + "pnpm-workspace.yaml", + "packages:\n - 'apps/*'\n", + ) + .await; let mut state = state_with( vec![FileEdit { path: "pnpm-workspace.yaml".into(), @@ -1993,7 +2060,13 @@ mod tests { Some("a"), Some("b"), ), - edit("f", "redirect_future_thing", "rewritten", Some("a"), Some("b")), + edit( + "f", + "redirect_future_thing", + "rewritten", + Some("a"), + Some("b"), + ), ], &["pkg:nuget/A@1", "pkg:hex/x@1"], ); @@ -2027,4 +2100,37 @@ mod tests { assert_eq!(remove_fragment_once("F\n", "F"), ""); assert_eq!(remove_fragment_once("\nF\n", "F"), ""); } + #[tokio::test] + async fn pipenv_replay_restores_categories_and_refuses_drift_atomically() { + use crate::patch::redirect::{rewrite_registry_redirect, DepOverride}; + let dep: DepOverride=serde_json::from_value(serde_json::json!({"ecosystem":"pypi","name":"urllib3","version":"1.26.18","patchUuid":"one","token":"token","artifactUrl":"https://patch.socket.dev/patch/pypi/urllib3/1.26.18/token/one/urllib3-1.26.18-py3-none-any.whl","integrity":{"sha256":"a".repeat(64)}})).unwrap(); + let original="{\"_meta\":{\"pipfile-spec\":6},\"default\":{\"urllib3\":{\"version\":\"==1.26.18\"}},\"tests\":{\"urllib3\":{\"version\":\"==1.26.18\"}}}"; + let result = rewrite_registry_redirect( + &BTreeMap::from([("Pipfile.lock".into(), original.into())]), + &[dep], + ); + for drift in [false, true] { + let dir = TempDir::new().unwrap(); + let text = result.files["Pipfile.lock"].clone(); + let live = if drift { + text.replacen("sha256:", "sha256:0", 1) + } else { + text + }; + write(dir.path(), "Pipfile.lock", &live).await; + let mut state = state_with(result.edits.clone(), &["pkg:pypi/urllib3@1.26.18"]); + let before = state.edits.len(); + let preview = revert_remaining_redirect_edits(dir.path(), &mut state, true).await; + assert_eq!(preview.fully_reverted(), !drift); + assert_eq!(read(dir.path(), "Pipfile.lock").await, live); + assert_eq!(state.edits.len(), before); + let outcome = revert_remaining_redirect_edits(dir.path(), &mut state, false).await; + assert_eq!(outcome.fully_reverted(), !drift); + assert_eq!( + read(dir.path(), "Pipfile.lock").await, + if drift { live.as_str() } else { original } + ); + assert_eq!(state.edits.is_empty(), !drift); + } + } } diff --git a/crates/socket-patch-core/src/utils/mod.rs b/crates/socket-patch-core/src/utils/mod.rs index d50be2dd..374eade3 100644 --- a/crates/socket-patch-core/src/utils/mod.rs +++ b/crates/socket-patch-core/src/utils/mod.rs @@ -1,6 +1,7 @@ pub mod env_compat; pub mod fs; pub(crate) mod http; +pub mod pipenv; pub mod process; pub mod purl; pub mod python_lock; diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs new file mode 100644 index 00000000..50b86440 --- /dev/null +++ b/crates/socket-patch-core/src/utils/pipenv.rs @@ -0,0 +1,34 @@ +use std::path::Path; + +fn parse_major(output: &str) -> Option { + output + .split_whitespace() + .find_map(|part| part.trim_start_matches('v').split('.').next()?.parse().ok()) +} + +pub async fn installed_major(root: &Path) -> Option { + let mut command = tokio::process::Command::new("pipenv"); + command + .arg("--version") + .current_dir(root) + .kill_on_drop(true); + let output = tokio::time::timeout(std::time::Duration::from_secs(10), command.output()) + .await + .ok()? + .ok()?; + if !output.status.success() { + return None; + } + parse_major(&String::from_utf8_lossy(&output.stdout)) +} + +#[cfg(test)] +mod tests { + use super::*; + #[test] + fn installer_version_output() { + assert_eq!(parse_major("pipenv, version 11.10.4\n"), Some(11)); + assert_eq!(parse_major("pipenv, version 2026.8.0\n"), Some(2026)); + assert_eq!(parse_major("unavailable"), None); + } +} diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index d6c1c8f5..0d898a34 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -399,7 +399,11 @@ fn pipenv_wired_pin(lock: &serde_json::Value, uuid_dir_rel: &str) -> Option<(Str continue; }; for entry in map.values() { - let Some(file) = entry.get("file").and_then(serde_json::Value::as_str) else { + let Some(file) = entry + .get("file") + .or_else(|| entry.get("path")) + .and_then(serde_json::Value::as_str) + else { continue; }; let bare = file.strip_prefix("./").unwrap_or(file); @@ -435,6 +439,34 @@ pub async fn vendor_pypi( dry_run: bool, force: bool, service: Option<&VendorServiceConfig>, +) -> VendorOutcome { + vendor_pypi_with_pipenv_version( + purl, + site_packages, + project_root, + record, + sources, + vendored_at, + dry_run, + force, + service, + &tokio::sync::OnceCell::new(), + ) + .await +} + +#[allow(clippy::too_many_arguments)] +pub async fn vendor_pypi_with_pipenv_version( + purl: &str, + site_packages: &Path, + project_root: &Path, + record: &PatchRecord, + sources: &PatchSources<'_>, + vendored_at: &str, + dry_run: bool, + force: bool, + service: Option<&VendorServiceConfig>, + pipenv_version: &tokio::sync::OnceCell>, ) -> VendorOutcome { // The purl may carry `?artifact_id=` variant qualifiers; everything here // keys off the qualifier-free base. @@ -572,7 +604,19 @@ pub async fn vendor_pypi( Ok(p) => p, Err((code, detail)) => return refused(code, detail), }; - match super::pypi_pipenv::check_target_guards(&project, &canon_name, &record.uuid) { + if pipenv_version + .get_or_init(|| crate::utils::pipenv::installed_major(project_root)) + .await + .is_some_and(|major| major < 2018) + { + return refused("pypi_pipenv_installer_unsupported", "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode"); + } + match super::pypi_pipenv::check_target_guards( + &project, + &canon_name, + &record.uuid, + version, + ) { Ok(PipenvTarget::InSync) => { wired_pin = pipenv_wired_pin(&project.lock, &uuid_dir_rel); WiringPlan::InSync @@ -1082,13 +1126,9 @@ pub async fn revert_pypi_opts( super::pypi_lock::revert_python_locks(entry, project_root, dry_run).await } Some("requirements") => revert_requirements(entry, project_root, dry_run).await, - Some("poetry") => { - super::pypi_poetry::revert_poetry(entry, project_root, dry_run).await - } + Some("poetry") => super::pypi_poetry::revert_poetry(entry, project_root, dry_run).await, Some("pdm") => super::pypi_pdm::revert_pdm(entry, project_root, dry_run).await, - Some("pipenv") => { - super::pypi_pipenv::revert_pipenv(entry, project_root, dry_run).await - } + Some("pipenv") => super::pypi_pipenv::revert_pipenv(entry, project_root, dry_run).await, other => { return RevertOutcome::failed(format!( "unknown pypi vendor flavor {other:?}; cannot revert" diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index f9df65b2..b730bac5 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -1,27 +1,6 @@ -//! pipenv wiring: a lock-ONLY `default`/`develop` entry rewrite of -//! `Pipfile.lock` (pipfile-spec 6). -//! -//! `pipenv verify` / `install --deploy` compare only `_meta.hash` (derived -//! from the Pipfile), so replacing a section entry with the V1/V2-captured -//! file-ref shape — `{"file": "./", "hashes": -//! ["sha256:"], "markers": }`, `index`/`version` dropped, -//! `_meta` untouched — survives `pipenv sync`, `install --deploy`, `verify` -//! and bare `pipenv install` byte-stably from a fresh checkout (spike -//! V2/V3). The serializer is pinned to pipenv's own -//! `json.dumps(obj, indent=4, sort_keys=True) + "\n"` (spike V7) so the lock -//! never churns. See `spikes/pipenv/` and the pipenv section of -//! `spikes/PHASE0-V2-FINDINGS.txt`. -//! -//! INTEGRITY caveat (spike V4, REFUTED claim): pipenv installs file-ref -//! entries through a separate pip phase with no `--hash`/`--require-hashes`, -//! so the recorded hash is NEVER enforced by pipenv itself — every vendor -//! run pushes a `vendor_integrity_unverified` warning and the committed -//! wheel bytes are the only tamper evidence (the hash we write becomes -//! enforced for free if pipenv ever fixes that phase). -//! -//! Drift caveat (spike V6): `pipenv lock` regenerates the entry to registry -//! shape and `pipenv update ` additionally rewrites the user's Pipfile -//! pin to `*` — both silent unpatch events; bare `pipenv install` is safe. +//! Pipenv lock-only wheel references preserve manifest hashes and categories. +//! Vendoring requires Pipenv 2018 or later; earlier installers cannot consume +//! portable relative wheel paths with integrity hashes. use std::path::Path; @@ -42,7 +21,14 @@ const LOCK_FILE: &str = "Pipfile.lock"; const KIND_LOCK_ENTRY: &str = "pipenv_lock_entry"; /// The Pipfile.lock sections searched/wired, in application order. -const SECTIONS: [&str; 2] = ["default", "develop"]; +fn category_names(lock: &Value) -> Vec { + lock.as_object() + .into_iter() + .flat_map(|map| map.keys()) + .filter(|key| key.as_str() != "_meta") + .cloned() + .collect() +} /// Guarded read shared in shape with the sibling backend twins: /// `open_regular_file` opens with `O_NONBLOCK` and rejects non-regular @@ -133,11 +119,20 @@ pub(super) async fn load_pipenv_project( )); } + for section in category_names(&lock) { + if section.contains(':') || !lock[§ion].is_object() { + return Err(( + "pypi_pipenv_lock_parse_failed", + format!("invalid Pipenv category {section}"), + )); + } + } + // ALWAYS pushed (spike V4 refuted hash enforcement): the recorded hash is // self-documentation, not a pipenv-enforced check. let warnings = vec![VendorWarning::new( "vendor_integrity_unverified", - "pipenv never enforces the hashes recorded on file-ref lock entries (its file-ref \ + "Pipenv 2018 or later is required. Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (its file-ref \ install phase invokes pip without --hash/--require-hashes), so the vendored wheel is \ protected only by the committed wheel itself; `socket-patch verify` re-checks its \ sha256 against the lock entry", @@ -147,13 +142,13 @@ pub(super) async fn load_pipenv_project( /// Target-specific guards (also re-run by [`wire_pipenv`] right before /// writing). Entries match by PEP 503 canonical NAME in `default` and -/// `develop`; there is no version guard — the file-ref entry carries no -/// version key and the spike proved pipenv accepts a version pin-down -/// (V3's 1.17.0 → 1.16.0 splice installed cleanly). +/// custom categories. Registry pins and existing vendored wheel identities +/// must both match the selected patch version. pub(super) fn check_target_guards( p: &PipenvProject, canon_name: &str, record_uuid: &str, + version: &str, ) -> Result { let entries = find_entries(&p.lock, canon_name); if entries.is_empty() { @@ -173,10 +168,29 @@ pub(super) fn check_target_guards( format!("{LOCK_FILE} {section}.{key} is not a JSON object"), )); }; - if let Some(file_ref) = obj.get("file").and_then(Value::as_str) { + if let Some(file_ref) = obj + .get("file") + .or_else(|| obj.get("path")) + .and_then(Value::as_str) + { match parse_vendor_path(file_ref) { // Ours, same patch generation. - Some(parts) if parts.eco == "pypi" && parts.uuid == record_uuid => continue, + Some(parts) if parts.eco == "pypi" && parts.uuid == record_uuid => { + let filename = file_ref.rsplit('/').next().unwrap_or(""); + let mut fields = filename.split('-'); + let matches_identity = fields.next().is_some_and(|name| canonicalize_pypi_name(name) == canon_name) && fields.next() == Some(version); + let conflicting_source = NON_REGISTRY_KEYS.iter().filter(|key| **key != "path").any(|key| obj.contains_key(*key)) + || (obj.contains_key("file") && obj.contains_key("path")) + || obj.contains_key("version") || obj.contains_key("index"); + if matches_identity && !conflicting_source + { + continue; + } + return Err(( + "pypi_pipenv_source_already_exists", + "vendored wheel identity or source changed".into(), + )); + } // Ours, but a STALE patch generation: wiring over it would // lose the only recorded registry original — refuse with the // repair path (mirrors gem's stale-checksum refusal). @@ -212,6 +226,12 @@ pub(super) fn check_target_guards( ), )); } + if obj.get("version").and_then(Value::as_str) != Some(format!("=={version}").as_str()) { + return Err(( + "pypi_pipenv_version_mismatch", + format!("{LOCK_FILE} {section}.{key} does not pin {version}"), + )); + } all_in_sync = false; } Ok(if all_in_sync { @@ -235,7 +255,15 @@ pub(super) async fn wire_pipenv( wheel_sha256_hex: &str, record_uuid: &str, ) -> Result<(Vec, PipenvMeta), (&'static str, String)> { - match check_target_guards(p, canon_name, record_uuid)? { + let version = rel_wheel + .rsplit('/') + .next() + .and_then(|filename| filename.split('-').nth(1)) + .ok_or(( + "pypi_pipenv_invalid_wheel", + "missing wheel version".to_owned(), + ))?; + match check_target_guards(p, canon_name, record_uuid, version)? { // Defensive: the orchestrator short-circuits in-sync pre-flight and // never calls wire on it (we must never re-record our own edit as an // "original"). @@ -254,8 +282,8 @@ pub(super) async fn wire_pipenv( let mut lock = p.lock.clone(); let mut wiring: Vec = Vec::new(); let mut sections: Vec = Vec::new(); - for section in SECTIONS { - let Some(map) = lock.get_mut(section).and_then(Value::as_object_mut) else { + for section in category_names(&lock) { + let Some(map) = lock.get_mut(§ion).and_then(Value::as_object_mut) else { continue; }; let keys: Vec = map @@ -269,13 +297,28 @@ pub(super) async fn wire_pipenv( // verbatim; index/version dropped (transitive entries never had // an index key — V3). let mut new_entry = Map::new(); - new_entry.insert("file".to_string(), Value::String(format!("./{rel_wheel}"))); + // Pipenv 2022 misparses local file URLs carrying extras. + let source_key = if old + .get("extras") + .and_then(Value::as_array) + .is_some_and(|extras| !extras.is_empty()) + { + "path" + } else { + "file" + }; + new_entry.insert( + source_key.to_string(), + Value::String(format!("./{rel_wheel}")), + ); new_entry.insert( "hashes".to_string(), Value::Array(vec![Value::String(format!("sha256:{wheel_sha256_hex}"))]), ); - if let Some(markers) = old.get("markers") { - new_entry.insert("markers".to_string(), markers.clone()); + for field in ["markers", "extras"] { + if let Some(value) = old.get(field) { + new_entry.insert(field.to_string(), value.clone()); + } } let new_value = Value::Object(new_entry); if old == new_value { @@ -289,6 +332,7 @@ pub(super) async fn wire_pipenv( // stale uuids refuse in the guards). let was_vendored = old .get("file") + .or_else(|| old.get("path")) .and_then(Value::as_str) .and_then(parse_vendor_path) .is_some(); @@ -301,7 +345,7 @@ pub(super) async fn wire_pipenv( original: if was_vendored { None } else { Some(old) }, new: Some(new_value), }); - if !sections.iter().any(|s| s == section) { + if !sections.iter().any(|s| s == §ion) { sections.push(section.to_string()); } } @@ -386,7 +430,7 @@ pub(super) async fn revert_pipenv( warnings.push(drifted()); continue; }; - if !SECTIONS.contains(§ion) { + if section == "_meta" || section.is_empty() { warnings.push(drifted()); continue; } @@ -451,15 +495,18 @@ pub(super) async fn revert_pipenv( // ── helpers ────────────────────────────────────────────────────────────── /// Every `(section, key, entry)` whose key canonicalizes to `canon_name`. -fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'static str, String, &'a Value)> { +fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'a str, String, &'a Value)> { let mut out = Vec::new(); - for section in SECTIONS { - let Some(map) = lock.get(section).and_then(Value::as_object) else { + for (section, value) in lock.as_object().into_iter().flat_map(|map| map.iter()) { + if section == "_meta" { + continue; + } + let Some(map) = value.as_object() else { continue; }; for (key, value) in map { if canonicalize_pypi_name(key) == canon_name { - out.push((section, key.clone(), value)); + out.push((section.as_str(), key.clone(), value)); } } } @@ -611,7 +658,7 @@ mod tests { "sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81" ], "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2'", - "version": "==1.17.0" + "version": "==1.16.0" } }, "develop": {} @@ -723,7 +770,7 @@ mod tests { let tmp = write_lock(before).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh ); @@ -858,7 +905,7 @@ mod tests { // package missing from both sections let tmp = write_lock(LOCK_DIRECT_REGISTRY).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "absent-pkg", UUID).unwrap_err(); + let err = check_target_guards(&p, "absent-pkg", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_lock_package_missing"); // user-declared file reference @@ -868,7 +915,7 @@ mod tests { ); let tmp = write_lock(&user).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("user-declared"), "{}", err.1); @@ -879,7 +926,7 @@ mod tests { ); let tmp = write_lock(&git).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("git"), "{}", err.1); @@ -904,12 +951,12 @@ mod tests { let tmp = write_lock(LOCK_DIRECT_VENDORED).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::InSync ); let stale_uuid = "00000000-0000-4000-8000-000000000000"; - let err = check_target_guards(&p, "six", stale_uuid).unwrap_err(); + let err = check_target_guards(&p, "six", stale_uuid, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_source_already_exists"); assert!(err.1.contains("--revert"), "{}", err.1); assert!(err.1.contains(UUID), "names the wired uuid: {}", err.1); @@ -921,7 +968,7 @@ mod tests { async fn load_and_guards_write_nothing() { let tmp = write_lock(LOCK_DIRECT_REGISTRY).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let _ = check_target_guards(&p, "six", UUID).unwrap(); + let _ = check_target_guards(&p, "six", UUID, "1.16.0").unwrap(); assert_eq!(read_lock(tmp.path()).await, LOCK_DIRECT_REGISTRY); } @@ -1207,7 +1254,7 @@ mod tests { let tmp = write_lock(&to_canonical_json(&lock)).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); - let err = check_target_guards(&p, "six", UUID).unwrap_err(); + let err = check_target_guards(&p, "six", UUID, "1.16.0").unwrap_err(); assert_eq!(err.0, "pypi_pipenv_lock_parse_failed"); assert!( err.1.contains("default.six is not a JSON object"), @@ -1248,7 +1295,7 @@ mod tests { let tmp = write_lock(&before_text).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh, "the absent develop section is skipped, not an error" ); @@ -1281,7 +1328,7 @@ mod tests { let tmp = write_lock(&before_text).await; let p = load_pipenv_project(tmp.path()).await.unwrap(); assert_eq!( - check_target_guards(&p, "six", UUID).unwrap(), + check_target_guards(&p, "six", UUID, "1.16.0").unwrap(), PipenvTarget::Fresh, "the registry-shaped develop entry keeps the target Fresh" ); @@ -1559,4 +1606,27 @@ mod tests { "failed write leaves the wired lock intact" ); } + #[tokio::test] + async fn custom_categories_preserve_extras_and_refuse_version_conflicts() { + let mut lock: Value = serde_json::from_str(LOCK_DIRECT_REGISTRY).unwrap(); + let mut dependency = lock["default"]["six"].take(); + dependency["extras"] = serde_json::json!(["test"]); + lock["default"] = serde_json::json!({}); + lock["tests"] = serde_json::json!({"Six":dependency}); + let before = to_canonical_json(&lock); + let tmp = write_lock(&before).await; + let project = load_pipenv_project(tmp.path()).await.unwrap(); + assert!(check_target_guards(&project, "six", UUID, "1.17.0").is_err()); + let (wiring, meta) = wire_default(&project, tmp.path()).await; + let rewritten: Value = serde_json::from_str(&read_lock(tmp.path()).await).unwrap(); + assert_eq!( + rewritten["tests"]["Six"]["extras"], + serde_json::json!(["test"]) + ); + assert_eq!(meta.sections, vec!["tests"]); + let entry = entry_for(wiring, meta); + let reverted = revert_pipenv(&entry, tmp.path(), false).await; + assert!(reverted.success); + assert_eq!(read_lock(tmp.path()).await, before); + } } From fa6b27f5975ce0d884eb2649553dc9818d740472 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 15:05:33 -0400 Subject: [PATCH 02/27] Clarify Pipenv installer requirements Explain the version requirement when Pipenv is unavailable, and point local-wheel verification guidance at the existing VEX command. Assisted-by: Codex:gpt-6-astra --- README.md | 2 +- crates/socket-patch-cli/src/commands/scan/hosted.rs | 7 +++++++ crates/socket-patch-core/src/vendor/pypi_pipenv.rs | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 34a51bcc..5ecd8951 100644 --- a/README.md +++ b/README.md @@ -266,7 +266,7 @@ Old lock formats before `pipfile-spec: 6` are refused without changing the lock. Vendored mode requires Pipenv 2018 or later. Wheels with extras use `path` references to avoid Pipenv 2022's local-file URL parsing bug. Native Pipenv does not consistently enforce hashes on local wheels; commit the wheel and run -`socket-patch verify`. Re-run Socket Patch after re-locking dependencies. +`socket-patch vex`. Re-run Socket Patch after re-locking dependencies. The compatibility backtest covers the last stable release of every published Pipenv major, including unsupported versions to verify explicit refusal. It diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 5ae83341..2390d6f2 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -1404,6 +1404,13 @@ pub(crate) async fn run_redirect_selected( pipenv_major, ); + if files.contains_key("Pipfile.lock") && pipenv_major.is_none() { + rewrite.warnings.push(socket_patch_core::patch::redirect::RewriteWarning { + code: "redirect_pipenv_installer_unknown".into(), + detail: "Pipenv was not detected; these hosted references require Pipenv 2018 or later. Make legacy Pipenv available on PATH to select its native lockfile format.".into(), + }); + } + // The lockb→text migration is only KEPT when the rewrite actually landed // in the migrated bun.lock. Otherwise nothing was redirected there and the // migration was pure side effect: restore the saved bun.lockb bytes, diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index b730bac5..37f978a6 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -134,8 +134,8 @@ pub(super) async fn load_pipenv_project( "vendor_integrity_unverified", "Pipenv 2018 or later is required. Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (its file-ref \ install phase invokes pip without --hash/--require-hashes), so the vendored wheel is \ - protected only by the committed wheel itself; `socket-patch verify` re-checks its \ - sha256 against the lock entry", + protected only by the committed wheel itself; `socket-patch vex` verifies the committed wheel \ + against its recorded artifact hash", )]; Ok(PipenvProject { lock, warnings }) } From 6347d00e650797a6a93fd6a508a86bc48603ae48 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:12:03 -0400 Subject: [PATCH 03/27] fix(pypi): discover Pipenv's out-of-tree virtualenv in agent mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pipenv keeps a project's virtualenv OUTSIDE the project by default (`$WORKON_HOME/-[-]`), so after a plain `pipenv install` the crawler found no VIRTUAL_ENV / .venv / venv and — because a Pipfile is a Python project marker — fell through to the global interpreter's site-packages: a bare `scan --mode agent` patched nothing for the project's dependencies (or a different interpreter that happened to carry the same release) and reported success, and a bare `rollback` pruned the manifest while the venv stayed patched. Measured on real Pipenv 11.10.4, 2018.11.26 and 2026.8.0: the PR-head binary scanned 56 global distributions and found no patch; the fixed binary scans the 2-distribution Pipenv venv and finds urllib3 1.26.18. The crawler now reproduces Pipenv's own placement without running Pipenv: WORKON_HOME (`$VAR`/`${VAR}`/`%VAR%`/`~` expanded like expandvars + expanduser) or the `$XDG_DATA_HOME`/`~/.local/share/virtualenvs` (`~/.virtualenvs` on Windows) default, the `.venv` FILE pointer (relative path or WORKON_HOME name), PIPENV_CUSTOM_VENV_NAME, PIPENV_PIPFILE, and `Project._get_virtualenv_hash` — the sanitized directory name capped at 42 chars, a dash, the first 6 bytes of sha256(absolute Pipfile path) in URL-safe base64 — unchanged from Pipenv 7 through 2026 and pinned by known-answer vectors. Both sanitizer generations (2022+ also replaces `& ( ) [ ]`) are tried, any `-` suffix is matched, and Pipenv's case-insensitive-filesystem fallback (a recased directory hashed over the recased location) is honoured. A project-local venv still wins. Co-Authored-By: Claude Fable 5.1 --- .../src/crawlers/python_crawler.rs | 537 ++++++++++++++++++ 1 file changed, 537 insertions(+) diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs index 88384486..af1f30ab 100644 --- a/crates/socket-patch-core/src/crawlers/python_crawler.rs +++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs @@ -264,9 +264,325 @@ pub async fn find_local_venv_site_packages(cwd: &Path) -> Vec { results.extend(matches); } + // 3. Pipenv keeps its virtualenv OUTSIDE the project by default + // (`$WORKON_HOME/-`), so a plain `pipenv install` leaves + // nothing above to find and the crawl used to fall through to the global + // interpreter's site-packages — patching the wrong Python (or nothing) + // and reporting success. Measured on real Pipenv 11.10.4, 2018.11.26 and + // 2026.8.0. + if results.is_empty() { + results.extend(find_pipenv_virtualenv_site_packages(cwd).await); + } + + results +} + +/// `site-packages` of the virtualenv Pipenv would use for the project at +/// `cwd` when it is not in-project: the `.venv` FILE pointer (a path relative +/// to the project or a name under `WORKON_HOME`), `PIPENV_CUSTOM_VENV_NAME`, +/// or Pipenv's derived name `-<8-char hash>` with any +/// `-` suffix. Empty for non-Pipenv projects and whenever the +/// placement cannot be resolved. Read-only: nothing is executed, no `pipenv` +/// binary is needed. +pub async fn find_pipenv_virtualenv_site_packages(cwd: &Path) -> Vec { + let var = |name: &str| std::env::var(name).ok(); + find_pipenv_virtualenv_site_packages_with(cwd, &var).await +} + +/// [`find_pipenv_virtualenv_site_packages`] over an explicit environment +/// (tests pass a closure instead of mutating the process environment). +async fn find_pipenv_virtualenv_site_packages_with( + cwd: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec { + let is_file = |leaf: &str| cwd.join(leaf).is_file(); + if !is_file("Pipfile") && !is_file("Pipfile.lock") { + return Vec::new(); + } + let mut venvs: Vec = Vec::new(); + // A `.venv` FILE names the virtualenv (Pipenv 2018+): a path (contains a + // separator) is relative to the project, anything else is a directory + // name under WORKON_HOME; an empty file means the default placement. + let dot_venv = cwd.join(".venv"); + if dot_venv.is_file() { + if let Ok(text) = std::fs::read_to_string(&dot_venv) { + let name = text.trim(); + if !name.is_empty() { + if name.contains('/') || name.contains('\\') { + venvs.push(cwd.join(name)); + } else if let Some(home) = pipenv_workon_home(var) { + venvs.push(home.join(name)); + } + } + } + } + if venvs.is_empty() { + if let Some(home) = pipenv_workon_home(var) { + venvs.extend(pipenv_workon_home_venvs(cwd, &home, var)); + } + } + let mut results = Vec::new(); + for venv in venvs { + results.extend(find_site_packages_under(&venv, "site-packages").await); + } results } +/// Pipenv's `WORKON_HOME`: the environment variable (with `~`, `$VAR`, +/// `${VAR}` and, on Windows, `%VAR%` expanded the way Pipenv's +/// `expandvars`/`expanduser` do), else `$XDG_DATA_HOME/virtualenvs` or +/// `~/.local/share/virtualenvs` (POSIX) / `~/.virtualenvs` (Windows) — +/// unchanged from the pew era (Pipenv 7) through 2026. +fn pipenv_workon_home(var: &impl Fn(&str) -> Option) -> Option { + if let Some(raw) = var("WORKON_HOME").filter(|v| !v.trim().is_empty()) { + return Some(pipenv_expand_path(raw.trim(), var)); + } + let home = pipenv_home_dir(var)?; + if cfg!(windows) { + return Some(home.join(".virtualenvs")); + } + let data_home = var("XDG_DATA_HOME") + .filter(|v| !v.trim().is_empty()) + .map(|v| pipenv_expand_path(v.trim(), var)) + .unwrap_or_else(|| home.join(".local").join("share")); + Some(data_home.join("virtualenvs")) +} + +fn pipenv_home_dir(var: &impl Fn(&str) -> Option) -> Option { + var("HOME") + .or_else(|| var("USERPROFILE")) + .filter(|v| !v.trim().is_empty()) + .map(PathBuf::from) +} + +/// `os.path.expanduser(os.path.expandvars(raw))`: `$NAME` / `${NAME}` (and +/// `%NAME%` on Windows) from the environment — unknown names stay as written, +/// like Python — then a leading `~` from the home directory. +fn pipenv_expand_path(raw: &str, var: &impl Fn(&str) -> Option) -> PathBuf { + let chars: Vec = raw.chars().collect(); + let mut out = String::new(); + let mut i = 0; + while i < chars.len() { + let c = chars[i]; + if c == '$' { + if chars.get(i + 1) == Some(&'{') { + if let Some(end) = chars[i + 2..].iter().position(|&ch| ch == '}') { + let name: String = chars[i + 2..i + 2 + end].iter().collect(); + match var(&name) { + Some(v) => out.push_str(&v), + None => out.push_str(&format!("${{{name}}}")), + } + i += end + 3; + continue; + } + } + let start = i + 1; + let mut end = start; + while end < chars.len() && (chars[end].is_ascii_alphanumeric() || chars[end] == '_') { + end += 1; + } + if end > start { + let name: String = chars[start..end].iter().collect(); + match var(&name) { + Some(v) => out.push_str(&v), + None => { + out.push('$'); + out.push_str(&name); + } + } + i = end; + continue; + } + } else if c == '%' && cfg!(windows) { + if let Some(end) = chars[i + 1..].iter().position(|&ch| ch == '%') { + let name: String = chars[i + 1..i + 1 + end].iter().collect(); + if !name.is_empty() { + match var(&name) { + Some(v) => out.push_str(&v), + None => out.push_str(&format!("%{name}%")), + } + i += end + 2; + continue; + } + } + } + out.push(c); + i += 1; + } + if out == "~" { + if let Some(home) = pipenv_home_dir(var) { + return home; + } + } + if let Some(rest) = out.strip_prefix("~/").or_else(|| out.strip_prefix("~\\")) { + if let Some(home) = pipenv_home_dir(var) { + return home.join(rest); + } + } + PathBuf::from(out) +} + +/// `Project._sanitize`: shell-hostile characters become `_` and the name is +/// cut to 42 characters. Pipenv 2022+ also replaces `& ( ) [ ]` (`wide`); +/// both spellings are tried so a virtualenv created by either generation is +/// found. +fn pipenv_sanitize(name: &str, wide: bool) -> String { + name.chars() + .map(|c| { + let narrow = matches!( + c, + ' ' | '$' | '`' | '!' | '*' | '@' | '"' | '\\' | '\r' | '\n' | '\t' + ); + let extra = wide && matches!(c, '&' | '(' | ')' | '[' | ']'); + if narrow || extra { + '_' + } else { + c + } + }) + .take(42) + .collect() +} + +/// The 8-character virtualenv suffix — `Project._get_virtualenv_hash`: the +/// first 6 bytes of `sha256(pipfile_location)`, URL-safe base64. Stable from +/// Pipenv 7 through 2026 and pinned by known-answer vectors in the tests. +fn pipenv_venv_hash(pipfile_location: &str) -> String { + use base64::Engine as _; + use sha2::{Digest, Sha256}; + + let digest = Sha256::digest(pipfile_location.as_bytes()); + base64::engine::general_purpose::URL_SAFE.encode(&digest[..6]) +} + +/// The path string Pipenv hashes: on Windows the verbatim `\\?\` prefix is +/// dropped and the drive letter upper-cased (`normalize_drive`); elsewhere +/// the path as displayed. +fn pipenv_path_string(path: &Path) -> String { + let mut text = path.to_string_lossy().into_owned(); + if cfg!(windows) { + if let Some(rest) = text.strip_prefix(r"\\?\UNC\") { + text = format!(r"\\{rest}"); + } else if let Some(rest) = text.strip_prefix(r"\\?\") { + text = rest.to_string(); + } + let mut chars: Vec = text.chars().collect(); + if chars.len() >= 2 && chars[1] == ':' && chars[0].is_ascii_lowercase() { + chars[0] = chars[0].to_ascii_uppercase(); + text = chars.into_iter().collect(); + } + } + text +} + +/// `(project name, Pipfile location)` pairs Pipenv may have derived the +/// virtualenv name from, most likely first: `PIPENV_PIPFILE` as given (made +/// absolute), the Pipfile under the symlink-resolved project directory +/// (`find_pipfile` walks `Path.cwd().resolve()` — the physical path), then +/// the lexical absolute path. +fn pipenv_project_identities( + cwd: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec<(String, String)> { + let mut out: Vec<(String, String)> = Vec::new(); + let mut push = |pipfile: PathBuf| { + let name = pipfile + .parent() + .and_then(Path::file_name) + .map(|n| n.to_string_lossy().into_owned()); + let Some(name) = name else { + return; + }; + let location = pipenv_path_string(&pipfile); + if !out.iter().any(|(_, l)| l == &location) { + out.push((name, location)); + } + }; + if let Some(explicit) = var("PIPENV_PIPFILE").filter(|v| !v.trim().is_empty()) { + let p = PathBuf::from(explicit.trim()); + push(if p.is_absolute() { p } else { cwd.join(p) }); + } + if let Ok(real) = std::fs::canonicalize(cwd) { + push(real.join("Pipfile")); + } + let lexical = if cwd.is_absolute() { + cwd.to_path_buf() + } else { + std::path::absolute(cwd).unwrap_or_else(|_| cwd.to_path_buf()) + }; + push(lexical.join("Pipfile")); + out +} + +/// Every directory under `workon_home` that Pipenv could have created for the +/// project at `cwd`: `PIPENV_CUSTOM_VENV_NAME` verbatim, else +/// `-` optionally followed by `-` +/// (matched as a `-` suffix rather than reproduced — the suffix's spelling +/// changed across releases), plus Pipenv's case-insensitive-filesystem +/// fallback (a same-name-different-case directory whose hash was computed +/// over the recased location). Sorted; never follows the entries. +fn pipenv_workon_home_venvs( + cwd: &Path, + workon_home: &Path, + var: &impl Fn(&str) -> Option, +) -> Vec { + if let Some(custom) = var("PIPENV_CUSTOM_VENV_NAME").filter(|v| !v.trim().is_empty()) { + return vec![workon_home.join(custom.trim())]; + } + let identities = pipenv_project_identities(cwd, var); + if identities.is_empty() { + return Vec::new(); + } + let mut exact: Vec = Vec::new(); + for (name, location) in &identities { + let hash = pipenv_venv_hash(location); + for wide in [true, false] { + let candidate = format!("{}-{hash}", pipenv_sanitize(name, wide)); + if !exact.contains(&candidate) { + exact.push(candidate); + } + } + } + let Ok(entries) = std::fs::read_dir(workon_home) else { + return Vec::new(); + }; + let mut found: Vec = Vec::new(); + for entry in entries.flatten() { + let file_name = entry.file_name(); + let Some(leaf) = file_name.to_str() else { + continue; + }; + let direct = exact + .iter() + .any(|c| leaf == c || leaf.strip_prefix(c.as_str()).is_some_and(|rest| rest.starts_with('-'))); + if direct { + found.push(entry.path()); + continue; + } + // Case-insensitive fallback: `-` where the hash was + // computed over the location with the recased name spliced in. + let Some((env_name, hash)) = leaf.rsplit_once('-') else { + continue; + }; + if hash.len() != 8 { + continue; + } + for (name, location) in &identities { + let sanitized = pipenv_sanitize(name, true); + if env_name.eq_ignore_ascii_case(&sanitized) + && env_name != sanitized + && pipenv_venv_hash(&location.replace(name.as_str(), env_name)) == hash + { + found.push(entry.path()); + break; + } + } + } + found.sort(); + found.dedup(); + found +} + /// Get global/system Python `site-packages` directories. /// /// Queries `python3` for site-packages paths, then checks well-known system @@ -739,6 +1055,227 @@ mod tests { use super::*; use crate::utils::purl::parse_pypi_purl; + // ── Pipenv out-of-tree virtualenv discovery ───────────────────────────── + + /// Known-answer vectors computed with Pipenv's own algorithm + /// (`base64.urlsafe_b64encode(hashlib.sha256(location.encode()).digest()[:6])`). + #[test] + fn pipenv_venv_hash_matches_pipenv_get_virtualenv_hash() { + assert_eq!(pipenv_venv_hash("/tmp/proj/Pipfile"), "9zRXrcHj"); + assert_eq!(pipenv_venv_hash("/Users/dev/My App/Pipfile"), "OhBEiq15"); + assert_eq!(pipenv_venv_hash(r"C:\Users\dev\app\Pipfile"), "6E88tlV3"); + } + + #[test] + fn pipenv_sanitize_replaces_shell_hostile_characters_and_caps_at_42() { + assert_eq!(pipenv_sanitize("My App", true), "My_App"); + assert_eq!(pipenv_sanitize("a(b)[c]&d", true), "a_b__c__d"); + assert_eq!(pipenv_sanitize("a(b)[c]&d", false), "a(b)[c]&d"); + assert_eq!(pipenv_sanitize("we$ird`na!me*@\"x\\", false), "we_ird_na_me___x_"); + let long = "p".repeat(60); + assert_eq!(pipenv_sanitize(&long, true).chars().count(), 42); + // Case is preserved (Pipenv does not lowercase the project name). + assert_eq!(pipenv_sanitize("MixedCase", true), "MixedCase"); + } + + #[test] + fn pipenv_expand_path_expands_variables_and_home_like_python() { + let var = |name: &str| match name { + "HOME" => Some("/home/u".to_string()), + "X" => Some("/x".to_string()), + _ => None, + }; + assert_eq!(pipenv_expand_path("$X/venvs", &var), PathBuf::from("/x/venvs")); + assert_eq!(pipenv_expand_path("${X}/v", &var), PathBuf::from("/x/v")); + assert_eq!(pipenv_expand_path("~/w", &var), PathBuf::from("/home/u/w")); + assert_eq!(pipenv_expand_path("~", &var), PathBuf::from("/home/u")); + assert_eq!( + pipenv_expand_path("$UNSET/v", &var), + PathBuf::from("$UNSET/v"), + "unknown names stay as written" + ); + assert_eq!(pipenv_expand_path("/plain", &var), PathBuf::from("/plain")); + } + + #[test] + fn pipenv_workon_home_honours_env_then_xdg_then_default() { + let with = |workon: Option<&str>, xdg: Option<&str>| { + let workon = workon.map(str::to_string); + let xdg = xdg.map(str::to_string); + let var = move |name: &str| match name { + "HOME" | "USERPROFILE" => Some("/home/u".to_string()), + "WORKON_HOME" => workon.clone(), + "XDG_DATA_HOME" => xdg.clone(), + _ => None, + }; + pipenv_workon_home(&var) + }; + assert_eq!(with(Some("~/envs"), None), Some(PathBuf::from("/home/u/envs"))); + if cfg!(windows) { + assert_eq!(with(None, None), Some(PathBuf::from("/home/u").join(".virtualenvs"))); + } else { + assert_eq!( + with(None, None), + Some(PathBuf::from("/home/u/.local/share/virtualenvs")) + ); + assert_eq!(with(None, Some("/data")), Some(PathBuf::from("/data/virtualenvs"))); + } + assert_eq!(with(Some(" "), None).is_some(), true, "blank WORKON_HOME falls through"); + let no_home = |_: &str| None::; + assert_eq!(pipenv_workon_home(&no_home), None); + } + + /// Lay a fake virtualenv at `workon_home/` and return its + /// site-packages (platform layout). + fn fake_venv(workon_home: &Path, leaf: &str) -> PathBuf { + let site = if cfg!(windows) { + workon_home.join(leaf).join("Lib").join("site-packages") + } else { + workon_home + .join(leaf) + .join("lib") + .join("python3.12") + .join("site-packages") + }; + std::fs::create_dir_all(&site).unwrap(); + site + } + + /// The end-to-end shape: a Pipenv project with NO in-project venv and + /// Pipenv's default out-of-tree placement under WORKON_HOME is found by + /// name+hash (with and without the `-` suffix), while a + /// sibling with another hash, a non-Pipenv project, and a project whose + /// WORKON_HOME is empty all stay invisible. + #[tokio::test] + async fn pipenv_out_of_tree_virtualenv_is_discovered_by_name_and_hash() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("My App"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + "HOME" | "USERPROFILE" => Some("/nonexistent-home".to_string()), + _ => None, + }; + + // Pipenv hashes the Pipfile under the RESOLVED project directory. + let real = std::fs::canonicalize(&project).unwrap(); + let hash = pipenv_venv_hash(&pipenv_path_string(&real.join("Pipfile"))); + let plain = fake_venv(&workon, &format!("My_App-{hash}")); + let suffixed = fake_venv(&workon, &format!("My_App-{hash}-python3.12")); + let _other = fake_venv(&workon, "My_App-AAAAAAAA"); + let _unrelated = fake_venv(&workon, "other-BBBBBBBB"); + + let mut found = find_pipenv_virtualenv_site_packages_with(&project, &var).await; + found.sort(); + let mut want = vec![plain.clone(), suffixed.clone()]; + want.sort(); + assert_eq!(found, want, "name+hash (and the PIPENV_PYTHON-suffixed twin) only"); + + // Not a Pipenv project → nothing, even with a matching directory. + let plain_dir = tmp.path().join("plain"); + std::fs::create_dir_all(&plain_dir).unwrap(); + assert!(find_pipenv_virtualenv_site_packages_with(&plain_dir, &var) + .await + .is_empty()); + + // The lock alone marks a Pipenv project (fresh checkouts often + // commit both, but a lock-only clone must still resolve). + std::fs::remove_file(project.join("Pipfile")).unwrap(); + std::fs::write(project.join("Pipfile.lock"), "{}").unwrap(); + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var) + .await + .len(), + 2 + ); + + // Unresolvable WORKON_HOME (no env, no home) → nothing. + let no_env = |_: &str| None::; + assert!(find_pipenv_virtualenv_site_packages_with(&project, &no_env) + .await + .is_empty()); + } + + /// The crawler's public entry point wires step 3 in: with no VIRTUAL_ENV + /// and no in-project venv, `find_local_venv_site_packages` returns the + /// out-of-tree Pipenv venv instead of nothing (which used to trigger the + /// global fallback). + #[tokio::test] + async fn pipenv_custom_name_and_dot_venv_file_pointer_are_honoured() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("svc"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let workon_str = workon.to_string_lossy().into_owned(); + + // PIPENV_CUSTOM_VENV_NAME wins over the derived name. + let custom = fake_venv(&workon, "my-custom-env"); + let w = workon_str.clone(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(w.clone()), + "PIPENV_CUSTOM_VENV_NAME" => Some("my-custom-env".to_string()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![custom] + ); + + // A `.venv` FILE naming a WORKON_HOME directory. + let named = fake_venv(&workon, "named-env"); + std::fs::write(project.join(".venv"), "named-env\n").unwrap(); + let w = workon_str.clone(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(w.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![named] + ); + + // A `.venv` FILE holding a project-relative path. + let rel = fake_venv(&project, "envs/here"); + std::fs::write(project.join(".venv"), "envs/here").unwrap(); + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![rel] + ); + } + + #[tokio::test] + async fn pipenv_case_insensitive_fallback_matches_recased_directory() { + // Pipenv on a case-insensitive filesystem reuses `-` + // where the hash was computed over the location with the recased + // name spliced in (`_get_virtualenv_hash`'s fallback loop). + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("proj"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let real = std::fs::canonicalize(&project).unwrap(); + let location = pipenv_path_string(&real.join("Pipfile")); + let recased_hash = pipenv_venv_hash(&location.replace("proj", "Proj")); + let recased = fake_venv(&workon, &format!("Proj-{recased_hash}")); + let _wrong = fake_venv(&workon, "Proj-CCCCCCCC"); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![recased] + ); + } + #[test] fn test_canonicalize_pypi_name_basic() { assert_eq!(canonicalize_pypi_name("Requests"), "requests"); From ff82d8e8196e9231e4cec5c5c59552a49f9361f4 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 14:36:00 -0400 Subject: [PATCH 04/27] fix(pypi): vendor Poetry projects from a lock-only checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `scan --mode vendored` on a fresh clone (pyproject + poetry.lock, nothing installed) was skipped with `vendor_fetch_unverifiable` + `package_not_installed` although the lock records the wheel's sha256 — the poetry.lock inventory was discovery-only (`LockIntegrity::None`), so the fetch gate refused before the vendor engine ever ran, while the identical uv.lock scenario vendored fine. That broke the CI story for Poetry: the machine that vendors had to have the package installed. The inventory now carries the pure-Python (`-none-any.whl`) wheel's sha256 from `files` (lock 2.x) or `[metadata.files]` (lock 1.0/1.1), lowercased, and the pypi fetcher resolves a hash-only entry through PyPI's JSON API (`urls[].digests.sha256`, `SOCKET_PYPI_JSON_API` overrides the endpoint) and verifies the download against the same digest, exactly like uv's lock-only path. Poetry 0.12's bare `[metadata.hashes]` names no wheel, and platform-only wheels offer no platform-independent choice, so those stay discovery-only. Measured on the fixed CLI: lock-only vendoring now applies on Poetry 1.0 (populated lock), 1.2, 1.8 and 2.4 fixtures (`vendor_fetched_missing` + `vendor_prebuilt_downloaded`), and the resulting checkout installs the patched wheel with every release. Co-Authored-By: Claude Fable 5.1 --- .../src/vendor/lock_inventory.rs | 100 +++++++++++- .../src/vendor/registry_fetch.rs | 150 ++++++++++++++++-- 2 files changed, 236 insertions(+), 14 deletions(-) diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 8ee9a9d0..5ba45798 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -1249,12 +1249,65 @@ fn python_lock_inventory(text: &str) -> Option> { Some(out) } -/// poetry.lock: `[[package]]` blocks with `name`/`version` — discovery -/// only (file hashes exist but carry no URLs and no platform choice). +/// The sha256 of each package's pure-Python (`-none-any.whl`) wheel as the +/// lock records it — `files = [...]` inside `[[package]]` (lock 2.x) or the +/// `[metadata.files]` entry (lock 1.0/1.1). Poetry 0.12's `[metadata.hashes]` +/// lists bare digests without filenames, so no wheel can be chosen there. +/// Keyed by canonical name. An unparseable lock contributes nothing (the +/// line-based name/version walk below still runs). +fn poetry_pure_wheel_hashes(text: &str) -> HashMap { + fn pure_wheel_sha(files: &Item) -> Option { + let files = files.as_array()?; + files + .iter() + .filter_map(TomlValue::as_inline_table) + .find_map(|entry| { + let file = entry.get("file")?.as_str()?; + if !file.ends_with("-none-any.whl") { + return None; + } + let sha = entry.get("hash")?.as_str()?.strip_prefix("sha256:")?; + is_hex_of_len(sha, 64).then(|| sha.to_ascii_lowercase()) + }) + } + let mut out = HashMap::new(); + let Ok(document) = text.parse::() else { + return out; + }; + if let Some(packages) = document.get("package").and_then(Item::as_array_of_tables) { + for package in packages.iter() { + let Some(name) = package.get("name").and_then(Item::as_str) else { + continue; + }; + if let Some(sha) = package.get("files").and_then(pure_wheel_sha) { + out.entry(canonicalize_pypi_name(name)).or_insert(sha); + } + } + } + if let Some(files) = document + .get("metadata") + .and_then(|m| m.get("files")) + .and_then(Item::as_table_like) + { + for (name, entry) in files.iter() { + if let Some(sha) = pure_wheel_sha(entry) { + out.entry(canonicalize_pypi_name(name)).or_insert(sha); + } + } + } + out +} + +/// poetry.lock: `[[package]]` blocks with `name`/`version`. The lock records +/// file hashes but no URLs and no platform choice, so an entry carries the +/// pure-Python wheel's sha256 when the lock lists one (the pypi fetcher then +/// resolves the matching file through PyPI's JSON API) and stays +/// discovery-only otherwise. async fn inventory_poetry_lock(project_root: &Path) -> Option> { let text = read_regular_to_string(&project_root.join("poetry.lock")) .await .ok()?; + let hashes = poetry_pure_wheel_hashes(&text); let mut out = Vec::new(); let mut in_package = false; let mut name: Option = None; @@ -1280,13 +1333,17 @@ async fn inventory_poetry_lock(project_root: &Path) -> Option if path_safety::is_safe_single_segment(&n) && path_safety::is_safe_single_segment(&v) { + let integrity = hashes + .get(&n) + .map(|sha| LockIntegrity::Sha256Hex(sha.clone())) + .unwrap_or(LockIntegrity::None); out.push(LockfileEntry { ecosystem: "pypi", purl: format!("pkg:pypi/{n}@{v}"), name: n, version: v, resolved: None, - integrity: LockIntegrity::None, + integrity, }); } } @@ -3225,6 +3282,43 @@ source = { editable = "." } assert_eq!(entries[0].purl, "pkg:pypi/requests@2.28.0"); } + /// A lock that lists a pure-Python wheel carries its sha256 (lock 2.x + /// `files`, lock 1.x `[metadata.files]`), so a lock-only checkout can + /// vendor like uv does; platform wheels only, or 0.12's bare + /// `[metadata.hashes]`, stay discovery-only. + #[tokio::test] + async fn poetry_lock_carries_the_pure_wheel_sha256_when_listed() { + let sha = "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07"; + let lock2 = format!( + "[[package]]\nname = \"urllib3\"\nversion = \"1.26.18\"\nfiles = [\n {{file = \"urllib3-1.26.18.tar.gz\", hash = \"sha256:{}\"}},\n {{file = \"urllib3-1.26.18-py2.py3-none-any.whl\", hash = \"sha256:{sha}\"}},\n]\n\n[[package]]\nname = \"numpy\"\nversion = \"2.0.0\"\nfiles = [\n {{file = \"numpy-2.0.0-cp312-cp312-macosx_11_0_arm64.whl\", hash = \"sha256:{}\"}},\n]\n\n[metadata]\nlock-version = \"2.1\"\n", + "f".repeat(64), + "e".repeat(64) + ); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "poetry.lock", &lock2).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::Sha256Hex(sha.into())); + assert_eq!(entry(&entries, "urllib3").resolved, None); + assert_eq!(entry(&entries, "numpy").integrity, LockIntegrity::None); + + let lock1 = format!( + "[[package]]\nname = \"urllib3\"\nversion = \"1.26.18\"\n\n[metadata]\nlock-version = \"1.1\"\n\n[metadata.files]\nurllib3 = [\n {{file = \"urllib3-1.26.18-py2.py3-none-any.whl\", hash = \"sha256:{}\"}},\n]\n", + sha.to_uppercase() + ); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "poetry.lock", &lock1).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::Sha256Hex(sha.into()), "lowercased"); + + let lock0 = format!( + "[[package]]\nname = \"urllib3\"\nversion = \"1.26.18\"\n\n[metadata]\ncontent-hash = \"x\"\n\n[metadata.hashes]\nurllib3 = [\"{sha}\"]\n" + ); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "poetry.lock", &lock0).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None, "bare digests name no wheel"); + } + #[tokio::test] async fn pnp_layouts_propagate_the_diagnosis_instead_of_yielding_none() { // PnP marker wins over any lockfile — and the diagnosis must diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs index c87b4d22..c67b7048 100644 --- a/crates/socket-patch-core/src/vendor/registry_fetch.rs +++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs @@ -290,16 +290,85 @@ async fn fetch_gem( /// wheel IS a site-packages layout (package dirs + `.dist-info/RECORD` at /// the root), which is exactly the shape the pypi vendor backend stages /// from. +/// PyPI's JSON API base; override with `SOCKET_PYPI_JSON_API` (tests point it +/// at a mock). Used only to turn a lock's file hash into a download URL for +/// locks that record hashes without URLs (poetry.lock). +pub const DEFAULT_PYPI_JSON_API: &str = "https://pypi.org/pypi"; + +fn pypi_json_api_base() -> String { + std::env::var("SOCKET_PYPI_JSON_API") + .ok() + .map(|v| v.trim_end_matches('/').to_string()) + .filter(|v| !v.is_empty()) + .unwrap_or_else(|| DEFAULT_PYPI_JSON_API.to_string()) +} + +/// Resolve the download URL of the release file whose sha256 the lock +/// records, via `GET ///json` → `urls[].digests.sha256`. +/// The hash, not the filename, selects the file, so a lock that names a wheel +/// PyPI has since re-uploaded under the same name cannot be satisfied by +/// different bytes — the download is still verified against the same hash. +async fn resolve_pypi_url_by_hash( + entry: &LockfileEntry, + sha256: &str, + client: &reqwest::Client, +) -> Result { + let api = format!( + "{}/{}/{}/json", + pypi_json_api_base(), + entry.name, + entry.version + ); + let resp = client.get(&api).send().await.map_err(|e| { + FetchError::Failed(format!("PyPI JSON API request for {} failed: {e}", entry.purl)) + })?; + if !resp.status().is_success() { + return Err(FetchError::Failed(format!( + "PyPI JSON API returned HTTP {} for {}", + resp.status(), + entry.purl + ))); + } + let body: serde_json::Value = resp.json().await.map_err(|e| { + FetchError::Failed(format!("PyPI JSON API response for {} is not JSON: {e}", entry.purl)) + })?; + body.get("urls") + .and_then(serde_json::Value::as_array) + .into_iter() + .flatten() + .find(|file| { + file.get("digests") + .and_then(|d| d.get("sha256")) + .and_then(serde_json::Value::as_str) + .is_some_and(|d| d.eq_ignore_ascii_case(sha256)) + }) + .and_then(|file| file.get("url").and_then(serde_json::Value::as_str)) + .map(str::to_string) + .ok_or_else(|| { + FetchError::Unverifiable(format!( + "no PyPI release file for {}@{} matches the lockfile's sha256 {sha256}", + entry.name, entry.version + )) + }) +} + async fn fetch_pypi( entry: &LockfileEntry, client: &reqwest::Client, ) -> Result { - let Some(url) = entry.resolved.clone() else { - return Err(FetchError::Unverifiable(format!( - "the lockfile records no platform-independent wheel URL for {}@{} (only uv.lock \ - carries fetchable wheel resolutions today)", - entry.name, entry.version - ))); + let url = match (&entry.resolved, &entry.integrity) { + (Some(url), _) => url.clone(), + // poetry.lock records the wheel's hash but no URL: look the file up + // by that hash (verified again after download). + (None, LockIntegrity::Sha256Hex(sha256)) => { + resolve_pypi_url_by_hash(entry, sha256, client).await? + } + (None, _) => { + return Err(FetchError::Unverifiable(format!( + "the lockfile records no platform-independent wheel URL or sha256 for {}@{}", + entry.name, entry.version + ))); + } }; let bytes = download(client, &url).await.map_err(FetchError::Failed)?; verify_integrity(&bytes, &entry.integrity)?; @@ -1747,14 +1816,71 @@ mod tests { .join("requests-2.28.0.dist-info/RECORD") .is_file()); - // No recorded wheel URL (poetry/requirements) → Unverifiable. + } + + /// poetry.lock records wheel hashes but no URLs: the fetcher resolves the + /// file through PyPI's JSON API by sha256 and still verifies the bytes. + #[tokio::test] + #[serial_test::serial] + async fn pypi_hash_only_entry_is_resolved_through_the_json_api() { + let wheel = make_zip(&[ + ("requests/__init__.py", b"__version__ = '2.28.0'\n"), + ("requests-2.28.0.dist-info/RECORD", b"requests/__init__.py,sha256=abc,24\n"), + ]); + let sha = hex::encode(Sha256::digest(&wheel)); + let mock = MockServer::start().await; + Mock::given(method("GET")) + .and(url_path("/packages/requests-2.28.0-py3-none-any.whl")) + .respond_with(ResponseTemplate::new(200).set_body_bytes(wheel)) + .mount(&mock) + .await; + Mock::given(method("GET")) + .and(url_path("/pypi/requests/2.28.0/json")) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "urls": [ + {"filename": "requests-2.28.0.tar.gz", "url": format!("{}/packages/requests-2.28.0.tar.gz", mock.uri()), "digests": {"sha256": "0".repeat(64)}}, + {"filename": "requests-2.28.0-py3-none-any.whl", "url": format!("{}/packages/requests-2.28.0-py3-none-any.whl", mock.uri()), "digests": {"sha256": sha.to_uppercase()}}, + ] + }))) + .mount(&mock) + .await; + let saved = std::env::var("SOCKET_PYPI_JSON_API").ok(); + std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi/", mock.uri())); + let restore = || match &saved { + Some(v) => std::env::set_var("SOCKET_PYPI_JSON_API", v), + None => std::env::remove_var("SOCKET_PYPI_JSON_API"), + }; let entry = LockfileEntry { + ecosystem: "pypi", + name: "requests".into(), + version: "2.28.0".into(), + purl: "pkg:pypi/requests@2.28.0".into(), resolved: None, - integrity: LockIntegrity::Sha256Hex("0".repeat(64)), + integrity: LockIntegrity::Sha256Hex(sha.clone()), + }; + let fetched = fetch_and_stage(&entry, &build_registry_client()).await; + // A hash no release file carries is refused before any download. + let unknown = LockfileEntry { + integrity: LockIntegrity::Sha256Hex("1".repeat(64)), + ..entry.clone() + }; + let missing = fetch_and_stage(&unknown, &build_registry_client()).await; + // No hash at all: nothing to resolve by. + let bare = LockfileEntry { + integrity: LockIntegrity::Sri("sha512-x".into()), ..entry }; - match fetch_and_stage(&entry, &build_registry_client()).await { - Err(FetchError::Unverifiable(msg)) => assert!(msg.contains("wheel"), "{msg}"), + let bare_result = fetch_and_stage(&bare, &build_registry_client()).await; + restore(); + let fetched = fetched.unwrap(); + assert!(fetched.dir().join("requests/__init__.py").is_file()); + assert!(fetched.url.ends_with("requests-2.28.0-py3-none-any.whl")); + match missing { + Err(FetchError::Unverifiable(msg)) => assert!(msg.contains("matches"), "{msg}"), + other => panic!("expected Unverifiable, got {other:?}"), + } + match bare_result { + Err(FetchError::Unverifiable(msg)) => assert!(msg.contains("sha256"), "{msg}"), other => panic!("expected Unverifiable, got {other:?}"), } } @@ -1928,13 +2054,15 @@ mod tests { #[tokio::test] async fn pypi_no_wheel_url_message_is_single_spaced() { + // No URL and no sha256 to resolve one by (a sha256 would consult the + // PyPI JSON API — `pypi_hash_only_entry_is_resolved_through_the_json_api`). let entry = LockfileEntry { ecosystem: "pypi", name: "requests".into(), version: "2.28.0".into(), purl: "pkg:pypi/requests@2.28.0".into(), resolved: None, - integrity: LockIntegrity::Sha256Hex("0".repeat(64)), + integrity: LockIntegrity::Sri("sha512-x".into()), }; match fetch_and_stage(&entry, &build_registry_client()).await { Err(FetchError::Unverifiable(msg)) => assert!( From bbcafa6df01a3357d723c8967c609fb25506a9af Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:18:51 -0400 Subject: [PATCH 05/27] fix(pypi): inventory Pipfile.lock so lock-only Pipenv checkouts patch in every mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lock inventory never read Pipfile.lock ("Pipenv/pdm locks: not yet read"), so a fresh clone with only Pipfile + Pipfile.lock — the CI / fresh-checkout shape hosted mode exists for — discovered ZERO packages: `scan --mode hosted` redirected nothing and `scan --mode vendored` vendored nothing, both exiting 0 with no warning. Every Pipenv install proof so far pre-installed the package before scanning, which hid this. Measured on the PR head with a Pipenv 2026.8.0 lock: scannedPackages 0 / redirected 0 in all three modes; on the fix: lockfileOnlyPackages 1, hosted redirected 1, vendored applied 1, rollback byte-identical. `inventory_pipfile_lock` reads every category other than `_meta`; registry pins (`==` version) become entries and VCS/path/file/editable sources, range pins and our own wired file references are skipped. Pipenv records every release file's sha256 without filenames, so the entry carries the digest SET as the new `LockIntegrity::Sha256AnyOf`: the pypi fetcher picks the pure-Python `-none-any.whl` whose PyPI digest is in the set (never an sdist or platform wheel, whatever the list order) and verifies the download against the set. Pipfile.lock sits between poetry.lock and requirements.txt in the inventory precedence, mirroring `detect_pypi_flavor`; a parseable uv.lock stays exclusive. Co-Authored-By: Claude Fable 5.1 --- .../src/vendor/lock_inventory.rs | 167 ++++++++++++++++- .../src/vendor/registry_fetch.rs | 175 ++++++++++++++++-- 2 files changed, 328 insertions(+), 14 deletions(-) diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 5ba45798..69bda30a 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -51,6 +51,11 @@ pub enum LockIntegrity { /// Hex sha256 of the artifact (Cargo.lock `checksum`, pypi file hashes, /// Gemfile.lock `CHECKSUMS`). Sha256Hex(String), + /// One of several hex sha256 digests: the lock records every release + /// file's digest without saying which file is which (Pipfile.lock + /// `hashes`), so the fetcher picks the pure-Python wheel whose PyPI + /// digest is in the set and verifies the download against that digest. + Sha256AnyOf(Vec), /// go.sum module-zip dirhash (`h1:`). GoH1(String), /// The lock records no content verifier. @@ -1089,7 +1094,9 @@ fn parse_gem_spec_line(line: &str) -> Option<(String, String)> { /// (URL + sha256 of a pure `py3-none-any` wheel) comes from `uv.lock`; /// `poetry.lock` and `--hash`-pinned `requirements.txt` contribute /// DISCOVERY-only entries (no recorded URL; platform-independent wheel -/// choice is not derivable offline). Pipenv/pdm locks: not yet read. +/// choice is not derivable offline). Pipfile.lock contributes +/// entries whose integrity is its digest SET (see `inventory_pipfile_lock`); +/// pdm.lock: not yet read. async fn inventory_pypi_locks(project_root: &Path) -> Option> { let mut out = Vec::new(); let mut found = false; @@ -1123,6 +1130,9 @@ async fn inventory_pypi_locks(project_root: &Path) -> Option> if let Some(entries) = inventory_poetry_lock(project_root).await { found = true; out.extend(entries); + } else if let Some(entries) = inventory_pipfile_lock(project_root).await { + found = true; + out.extend(entries); } else if let Some(entries) = inventory_requirements_txt(project_root).await { found = true; out.extend(entries); @@ -1355,6 +1365,84 @@ async fn inventory_poetry_lock(project_root: &Path) -> Option Some(dedup_prefer_integrity(out)) } +/// Pipfile.lock (pipfile-spec 6): every category other than `_meta` holds +/// `name: {"version": "==X", "hashes": ["sha256:", …], …}` entries. +/// Registry pins (`==` version) become entries whose integrity is the SET of +/// recorded digests — Pipenv lists every release file's hash without +/// filenames, so the pure-Python wheel is selected by digest at fetch time +/// ([`LockIntegrity::Sha256AnyOf`]). VCS / path / file / editable sources and +/// range pins are skipped (nothing registry-shaped to vendor over), as are +/// our own already-wired file references. An unparseable lock contributes +/// nothing, so the caller falls through to requirements.txt like an absent +/// lock would. +async fn inventory_pipfile_lock(project_root: &Path) -> Option> { + let text = read_regular_to_string(&project_root.join("Pipfile.lock")) + .await + .ok()?; + let value: serde_json::Value = serde_json::from_str(&text).ok()?; + let root = value.as_object()?; + let mut out = Vec::new(); + for (section, entries) in root { + if section == "_meta" { + continue; + } + let Some(entries) = entries.as_object() else { + continue; + }; + for (name, entry) in entries { + let Some(entry) = entry.as_object() else { + continue; + }; + if ["git", "hg", "svn", "bzr", "file", "path", "editable"] + .iter() + .any(|key| entry.contains_key(*key)) + { + continue; + } + let Some(version) = entry + .get("version") + .and_then(serde_json::Value::as_str) + .and_then(|v| v.strip_prefix("==")) + .map(str::trim) + .filter(|v| !v.is_empty()) + else { + continue; + }; + let n = canonicalize_pypi_name(name); + if !path_safety::is_safe_single_segment(&n) + || !path_safety::is_safe_single_segment(version) + { + continue; + } + let hashes: Vec = entry + .get("hashes") + .and_then(serde_json::Value::as_array) + .into_iter() + .flatten() + .filter_map(serde_json::Value::as_str) + .filter_map(|h| h.strip_prefix("sha256:")) + .filter(|h| is_hex_of_len(h, 64)) + .map(|h| h.to_ascii_lowercase()) + .collect(); + let integrity = if hashes.is_empty() { + LockIntegrity::None + } else { + LockIntegrity::Sha256AnyOf(hashes) + }; + out.push(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{n}@{version}"), + name: n, + version: version.to_string(), + resolved: None, + integrity, + }); + } + } + Some(out) +} + + /// requirements.txt with exact `==` pins — discovery only. async fn inventory_requirements_txt(project_root: &Path) -> Option> { let text = read_regular_to_string(&project_root.join("requirements.txt")) @@ -3282,6 +3370,83 @@ source = { editable = "." } assert_eq!(entries[0].purl, "pkg:pypi/requests@2.28.0"); } + /// Pipfile.lock: every category is read, registry pins carry the lock's + /// digest SET (lowercased), non-registry sources / range pins / our own + /// file references are skipped, the same package in two categories + /// yields one entry, and the lock outranks requirements.txt while a + /// parseable uv.lock outranks it. + #[tokio::test] + async fn pipfile_lock_inventory_reads_every_category_with_its_digest_set() { + let wheel = "a".repeat(64); + let sdist = "B".repeat(64); + let lock = format!( + r#"{{ + "_meta": {{"hash": {{"sha256": "x"}}, "pipfile-spec": 6, "requires": {{}}, "sources": []}}, + "default": {{ + "URLlib3": {{"hashes": ["sha256:{wheel}", "sha256:{sdist}"], "index": "pypi", "version": "==1.26.18", "markers": "python_version < '4'"}}, + "requests": {{"git": "https://example.org/requests", "ref": "abc", "version": "==2.31.0"}}, + "loose": {{"version": "*"}}, + "wired": {{"file": "./.socket/vendor/pypi/00000000-0000-4000-8000-000000000000/wired-1.0-py3-none-any.whl", "hashes": ["sha256:{wheel}"]}} + }}, + "develop": {{ + "Six": {{"hashes": ["sha256:{sdist}"], "version": "==1.16.0"}} + }}, + "tests": {{ + "urllib3": {{"hashes": ["sha256:{wheel}"], "version": "==1.26.18"}} + }} +}} +"# + ); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &lock).await; + write(tmp.path(), "requirements.txt", "flask==3.0.0\n").await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + let mut names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect(); + names.sort_unstable(); + assert_eq!(names, vec!["six", "urllib3"], "{entries:?}"); + let urllib3 = entry(&entries, "urllib3"); + assert_eq!(urllib3.purl, "pkg:pypi/urllib3@1.26.18"); + assert_eq!(urllib3.resolved, None); + assert_eq!( + urllib3.integrity, + LockIntegrity::Sha256AnyOf(vec![wheel.clone(), sdist.to_ascii_lowercase()]), + "every recorded digest, lowercased, first category wins" + ); + assert_eq!( + entry(&entries, "six").integrity, + LockIntegrity::Sha256AnyOf(vec![sdist.to_ascii_lowercase()]) + ); + + // A parseable uv.lock stays the exclusive inventory. + write( + tmp.path(), + "uv.lock", + "version = 1\n\n[[package]]\nname = \"other\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\n", + ) + .await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert!(entries.iter().all(|e| e.name == "other"), "{entries:?}"); + + // Unparseable lock → nothing from it, requirements.txt read instead. + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", "{ not json").await; + write(tmp.path(), "requirements.txt", "flask==3.0.0\n").await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entries.len(), 1); + assert_eq!(entries[0].name, "flask"); + + // No hashes at all → discovery-only entry. + let tmp = tempfile::tempdir().unwrap(); + write( + tmp.path(), + "Pipfile.lock", + r#"{"_meta": {"pipfile-spec": 6}, "default": {"urllib3": {"version": "==1.26.18"}}}"#, + ) + .await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None); + } + /// A lock that lists a pure-Python wheel carries its sha256 (lock 2.x /// `files`, lock 1.x `[metadata.files]`), so a lock-only checkout can /// vendor like uv does; platform wheels only, or 0.12's bare diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs index c67b7048..e5d4f488 100644 --- a/crates/socket-patch-core/src/vendor/registry_fetch.rs +++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs @@ -308,9 +308,15 @@ fn pypi_json_api_base() -> String { /// The hash, not the filename, selects the file, so a lock that names a wheel /// PyPI has since re-uploaded under the same name cannot be satisfied by /// different bytes — the download is still verified against the same hash. +/// +/// `candidates` is the lock's digest set: a single digest (poetry.lock names +/// the wheel) takes the first release file carrying it; several digests +/// (Pipfile.lock lists every release file's hash) take the pure-Python +/// `-none-any.whl` whose digest is in the set — a platform wheel or sdist is +/// never chosen, because the vendored wheel must install everywhere. async fn resolve_pypi_url_by_hash( entry: &LockfileEntry, - sha256: &str, + candidates: &[String], client: &reqwest::Client, ) -> Result { let api = format!( @@ -332,23 +338,52 @@ async fn resolve_pypi_url_by_hash( let body: serde_json::Value = resp.json().await.map_err(|e| { FetchError::Failed(format!("PyPI JSON API response for {} is not JSON: {e}", entry.purl)) })?; - body.get("urls") + let digest_matches = |file: &serde_json::Value| { + file.get("digests") + .and_then(|d| d.get("sha256")) + .and_then(serde_json::Value::as_str) + .is_some_and(|d| candidates.iter().any(|c| d.eq_ignore_ascii_case(c))) + }; + let is_pure_wheel = |file: &serde_json::Value| { + file.get("filename") + .and_then(serde_json::Value::as_str) + .or_else(|| file.get("url").and_then(serde_json::Value::as_str)) + .is_some_and(|name| { + name.split(['?', '#']) + .next() + .is_some_and(|n| n.ends_with("-none-any.whl")) + }) + }; + let files: Vec<&serde_json::Value> = body + .get("urls") .and_then(serde_json::Value::as_array) .into_iter() .flatten() - .find(|file| { - file.get("digests") - .and_then(|d| d.get("sha256")) - .and_then(serde_json::Value::as_str) - .is_some_and(|d| d.eq_ignore_ascii_case(sha256)) - }) + .filter(|file| digest_matches(file)) + .collect(); + let chosen = if candidates.len() == 1 { + files.first().copied() + } else { + files.iter().copied().find(|file| is_pure_wheel(file)) + }; + chosen .and_then(|file| file.get("url").and_then(serde_json::Value::as_str)) .map(str::to_string) .ok_or_else(|| { - FetchError::Unverifiable(format!( - "no PyPI release file for {}@{} matches the lockfile's sha256 {sha256}", - entry.name, entry.version - )) + FetchError::Unverifiable(if candidates.len() == 1 { + format!( + "no PyPI release file for {}@{} matches the lockfile's sha256 {}", + entry.name, entry.version, candidates[0] + ) + } else { + format!( + "no platform-independent (`-none-any.whl`) PyPI release file for {}@{} \ + matches any of the {} sha256 digests the lockfile records", + entry.name, + entry.version, + candidates.len() + ) + }) }) } @@ -361,7 +396,13 @@ async fn fetch_pypi( // poetry.lock records the wheel's hash but no URL: look the file up // by that hash (verified again after download). (None, LockIntegrity::Sha256Hex(sha256)) => { - resolve_pypi_url_by_hash(entry, sha256, client).await? + resolve_pypi_url_by_hash(entry, std::slice::from_ref(sha256), client).await? + } + // Pipfile.lock records every release file's hash without filenames: + // pick the pure wheel whose digest is in the set (verified again + // after download against that set). + (None, LockIntegrity::Sha256AnyOf(digests)) => { + resolve_pypi_url_by_hash(entry, digests, client).await? } (None, _) => { return Err(FetchError::Unverifiable(format!( @@ -921,6 +962,17 @@ fn verify_integrity(bytes: &[u8], integrity: &LockIntegrity) -> Result<(), Fetch ))) } } + LockIntegrity::Sha256AnyOf(expected) => { + let actual = hex::encode(Sha256::digest(bytes)); + if expected.iter().any(|e| actual.eq_ignore_ascii_case(e)) { + Ok(()) + } else { + Err(FetchError::Failed(format!( + "sha256 mismatch: downloaded bytes hash to {actual}, which is none of the {} digests the lockfile records", + expected.len() + ))) + } + } LockIntegrity::BerryChecksum(_) | LockIntegrity::GoH1(_) => Err(FetchError::Unverifiable( "verifier handled by a dedicated ecosystem fetcher".to_string(), )), @@ -1885,6 +1937,103 @@ mod tests { } } + /// Pipfile.lock records EVERY release file's digest without filenames: + /// the fetcher must pick the pure-Python wheel by digest (never the sdist + /// or a platform wheel that also matches), verify the download against + /// the set, and refuse when no pure wheel's digest is recorded. + #[tokio::test] + #[serial_test::serial] + async fn pypi_digest_set_entry_picks_the_pure_wheel_by_hash() { + let wheel = make_zip(&[ + ("requests/__init__.py", b"__version__ = '2.28.0'\n"), + ("requests-2.28.0.dist-info/RECORD", b"requests/__init__.py,sha256=abc,24\n"), + ]); + let wheel_sha = hex::encode(Sha256::digest(&wheel)); + let sdist_sha = "0".repeat(64); + let platform_sha = "9".repeat(64); + let mock = MockServer::start().await; + Mock::given(method("GET")) + .and(url_path("/packages/requests-2.28.0-py3-none-any.whl")) + .respond_with(ResponseTemplate::new(200).set_body_bytes(wheel)) + .mount(&mock) + .await; + Mock::given(method("GET")) + .and(url_path("/packages/requests-2.28.0.tar.gz")) + .respond_with(ResponseTemplate::new(200).set_body_bytes(b"sdist bytes".to_vec())) + .mount(&mock) + .await; + Mock::given(method("GET")) + .and(url_path("/pypi/requests/2.28.0/json")) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "urls": [ + {"filename": "requests-2.28.0.tar.gz", "url": format!("{}/packages/requests-2.28.0.tar.gz", mock.uri()), "digests": {"sha256": sdist_sha}}, + {"filename": "requests-2.28.0-cp312-cp312-manylinux_2_17_x86_64.whl", "url": format!("{}/packages/requests-2.28.0-cp312-cp312-manylinux_2_17_x86_64.whl", mock.uri()), "digests": {"sha256": platform_sha}}, + {"filename": "requests-2.28.0-py3-none-any.whl", "url": format!("{}/packages/requests-2.28.0-py3-none-any.whl", mock.uri()), "digests": {"sha256": wheel_sha.to_uppercase()}}, + ] + }))) + .mount(&mock) + .await; + let saved = std::env::var("SOCKET_PYPI_JSON_API").ok(); + std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi/", mock.uri())); + let restore = || match &saved { + Some(v) => std::env::set_var("SOCKET_PYPI_JSON_API", v), + None => std::env::remove_var("SOCKET_PYPI_JSON_API"), + }; + let entry = LockfileEntry { + ecosystem: "pypi", + name: "requests".into(), + version: "2.28.0".into(), + purl: "pkg:pypi/requests@2.28.0".into(), + resolved: None, + // sdist first, like Pipenv writes them: the ORDER must not pick + // the sdist. + integrity: LockIntegrity::Sha256AnyOf(vec![ + sdist_sha.clone(), + platform_sha.clone(), + wheel_sha.clone(), + ]), + }; + let fetched = fetch_and_stage(&entry, &build_registry_client()).await; + // Only the sdist's and a platform wheel's digests recorded: no pure + // wheel to choose → refused before any download. + let no_pure = LockfileEntry { + integrity: LockIntegrity::Sha256AnyOf(vec![sdist_sha.clone(), platform_sha.clone()]), + ..entry.clone() + }; + let no_pure_result = fetch_and_stage(&no_pure, &build_registry_client()).await; + // Digests no release file carries → refused. + let unknown = LockfileEntry { + integrity: LockIntegrity::Sha256AnyOf(vec!["1".repeat(64), "2".repeat(64)]), + ..entry.clone() + }; + let unknown_result = fetch_and_stage(&unknown, &build_registry_client()).await; + restore(); + let fetched = fetched.unwrap(); + assert!(fetched.dir().join("requests/__init__.py").is_file()); + assert!(fetched.url.ends_with("requests-2.28.0-py3-none-any.whl"), "{}", fetched.url); + for (label, result) in [("no pure wheel", no_pure_result), ("unknown", unknown_result)] { + match result { + Err(FetchError::Unverifiable(msg)) => { + assert!(msg.contains("none-any.whl") && msg.contains("digests"), "{label}: {msg}") + } + other => panic!("{label}: expected Unverifiable, got {other:?}"), + } + } + // The verifier itself: bytes matching ANY recorded digest pass, others fail. + let set = LockIntegrity::Sha256AnyOf(vec![sdist_sha.clone(), wheel_sha.clone()]); + // "sdist bytes" is not the recorded sdist digest ("000…"), so it must fail. + assert!(verify_integrity(b"sdist bytes", &set).is_err()); + let real_sdist = LockIntegrity::Sha256AnyOf(vec![ + hex::encode(Sha256::digest(b"sdist bytes")), + wheel_sha, + ]); + assert!(verify_integrity(b"sdist bytes", &real_sdist).is_ok()); + match verify_integrity(b"other", &real_sdist) { + Err(FetchError::Failed(msg)) => assert!(msg.contains("none of the 2 digests"), "{msg}"), + other => panic!("expected Failed, got {other:?}"), + } + } + #[cfg(unix)] fn mkfifo(path: &Path) { use std::os::unix::ffi::OsStrExt; From d1bcfd71fe5fcfe27a6f737c2b154a9dc8d93adc Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:23:03 -0400 Subject: [PATCH 06/27] fix(pipenv): let only pin/source conflicts veto the sibling Python rewriters MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every `plan()` failure landed in `refused_pipenv_uuids` and was stripped from the requirements.txt / uv.lock / pyproject rewriters — including "no entry for the package", an old pipfile-spec, an unparseable (or BOM-prefixed) lock and a digest-less patch. A stale Pipfile.lock left behind in a uv, Poetry or requirements project therefore blocked every hosted redirect in the files the project actually installs from (Cursor Bugbot HIGH on #242). `plan()` now classifies its refusals: a CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) still vetoes the siblings — the project's Pipenv install could not pick the patch up, so a half-redirected checkout would be worse — and is reported as `redirect_pipenv_refused`; everything else is reported as `redirect_pipenv_skipped` and leaves the siblings alone. A UTF-8 BOM in front of the lock (Windows editors) is parsed past and preserved through the rewrite and the rollback. Co-Authored-By: Claude Fable 5.1 --- .../src/patch/redirect/pipenv.rs | 143 ++++++++++++++++-- 1 file changed, 134 insertions(+), 9 deletions(-) diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs index def43c62..b8bad637 100644 --- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -83,7 +83,10 @@ fn properties(text: &str, offset: usize) -> Result, String> { } fn entries(text: &str) -> Result, String> { - let value: Value = serde_json::from_str(text).map_err(|e| e.to_string())?; + // A UTF-8 BOM (Windows editors) is not JSON; parse past it. Offsets + // below come from `text.find('{')`, so they stay byte-accurate. + let value: Value = serde_json::from_str(text.trim_start_matches('\u{feff}')) + .map_err(|e| e.to_string())?; if !value.is_object() { return Err("Pipfile.lock is not an object".into()); } @@ -177,13 +180,29 @@ pub(super) fn rewrite( text = rewritten; result.edits.extend(edits); } - Err(detail) => { + // A CONFLICT (another version pinned, a foreign source, a VCS / + // path dependency) means the project's Pipenv install would not + // pick the patch up even if a sibling requirements.txt / uv.lock + // were repointed — so the sibling rewriters are vetoed too and + // nothing is half-redirected. Anything else (no entry for the + // package, an old pipfile-spec, an unparseable or BOM-prefixed + // lock, a patch without a digest) says nothing about the files + // the project installs from: warn and leave the siblings alone, + // or a stale Pipfile.lock left behind in a uv / Poetry / + // requirements project blocks every hosted redirect. + Err(PlanError::Conflict(detail)) => { result.refused_pipenv_uuids.insert(dep.patch_uuid.clone()); result.warnings.push(RewriteWarning { code: "redirect_pipenv_refused".into(), detail, }); } + Err(PlanError::Skip(detail)) => { + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_skipped".into(), + detail, + }); + } } } if &text != original { @@ -217,11 +236,35 @@ fn owned_url(value: &str, dep: &DepOverride) -> bool { && parts[7].split('-').nth(1) == Some(dep.version.as_str()) } +/// Why a Pipfile.lock plan did not happen. Only a [`PlanError::Conflict`] +/// vetoes the sibling Python rewriters (see [`rewrite`]). +#[derive(Debug, Clone, PartialEq, Eq)] +pub(super) enum PlanError { + /// The lock pins another version or a non-registry / foreign source for + /// the package: the project's install cannot pick the patch up. + Conflict(String), + /// Nothing to do here (no entry, unsupported spec, unparseable lock, + /// no digest): says nothing about the project's other install files. + Skip(String), +} + +impl From for PlanError { + fn from(detail: String) -> Self { + PlanError::Skip(detail) + } +} + +impl From<&str> for PlanError { + fn from(detail: &str) -> Self { + PlanError::Skip(detail.to_owned()) + } +} + fn plan( text: &str, dep: &DepOverride, pipenv_major: Option, -) -> Result<(String, Vec), String> { +) -> Result<(String, Vec), PlanError> { let sha = dep .integrity .sha256 @@ -242,7 +285,10 @@ fn plan( }) .collect(); if targets.is_empty() { - return Err(format!("Pipfile.lock has no entry for {}", dep.name)); + return Err(PlanError::Skip(format!( + "Pipfile.lock has no entry for {}", + dep.name + ))); } let source_key = if pipenv_major.is_some_and(|major| (7..2018).contains(&major)) { "path" @@ -260,17 +306,20 @@ fn plan( .any(|key| object.contains_key(*key)) || (object.contains_key("file") && object.contains_key("path")) { - return Err(format!( + return Err(PlanError::Conflict(format!( "Pipenv source for {} is not a registry package", dep.name - )); + ))); } if let Some(file) = object.get("file").or_else(|| object.get("path")) { if !file.as_str().is_some_and(|value| owned_url(value, dep)) || object.contains_key("version") || object.contains_key("index") { - return Err(format!("Pipenv source for {} already exists", dep.name)); + return Err(PlanError::Conflict(format!( + "Pipenv source for {} already exists", + dep.name + ))); } if object.get(source_key).and_then(Value::as_str) == Some(&url) && object.get("hashes") == Some(&json!([format!("sha256:{sha}")])) @@ -280,10 +329,10 @@ fn plan( } else if object.get("version").and_then(Value::as_str) != Some(format!("=={}", dep.version).as_str()) { - return Err(format!( + return Err(PlanError::Conflict(format!( "Pipenv version for {} does not match {}", dep.name, dep.version - )); + ))); } let mut new = object.clone(); new.remove("version"); @@ -371,6 +420,7 @@ mod tests { json!({"version":"==1.26.18","path":"./fork"}), ] { let mut value: Value = serde_json::from_str(&lock()).unwrap(); + let is_null = bad.is_null(); value["tests"]["urllib3"] = bad; let original = serde_json::to_string(&value).unwrap(); let files = BTreeMap::from([("Pipfile.lock".into(), original)]); @@ -380,7 +430,82 @@ mod tests { assert!(result.edits.is_empty()); assert!(result.confirmed_pipenv_uuids.is_empty()); assert_eq!(result.warnings.len(), 1); + // A pin / source CONFLICT vetoes the sibling Python rewriters; a + // malformed (non-object) entry is merely skipped. + if is_null { + assert_eq!(result.warnings[0].code, "redirect_pipenv_skipped"); + assert!(result.refused_pipenv_uuids.is_empty()); + } else { + assert_eq!(result.warnings[0].code, "redirect_pipenv_refused"); + assert!(result.refused_pipenv_uuids.contains("patch-one")); + } + } + } + + /// Only conflicts veto the sibling rewriters (Bugbot HIGH on #242): a + /// Pipfile.lock without the package, an old pipfile-spec, an unparseable + /// lock or a digest-less patch is SKIPPED with `redirect_pipenv_skipped` + /// and the requirements.txt / uv.lock rewrite still lands. + #[test] + fn non_conflict_refusals_do_not_veto_sibling_rewriters() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let stale_locks = [ + // no entry for the package at all + lock().replace("\"urllib3\"", "\"other-package\""), + // pipfile-spec 5 + lock().replace("\"pipfile-spec\": 6", "\"pipfile-spec\": 5"), + // unparseable + "{".to_owned(), + // BOM-prefixed but otherwise fine is NOT a skip: it must plan. + ]; + for stale in &stale_locks { + let files = BTreeMap::from([ + ("Pipfile.lock".to_string(), stale.clone()), + ("requirements.txt".to_string(), "urllib3==1.26.18\n".to_string()), + ]); + let result = super::super::rewrite_registry_redirect(&files, std::slice::from_ref(&dep)); + assert!( + !result.refused_pipenv_uuids.contains("patch-one"), + "a non-conflict must not veto: {stale}" + ); + assert!( + result.warnings.iter().any(|w| w.code == "redirect_pipenv_skipped"), + "{:?}", + result.warnings + ); + assert!( + result.files.get("requirements.txt").is_some_and(|t| t.contains("patch.socket.dev")), + "requirements.txt must still be redirected past a stale Pipfile.lock: {result:?}" + ); + assert!(!result.files.contains_key("Pipfile.lock")); + } + // A digest-less patch is a skip too (the other rewriters decide for + // themselves whether they need one). + let mut no_digest = dep.clone(); + no_digest.integrity.sha256 = None; + let mut result = RewriteResult::default(); + rewrite( + &BTreeMap::from([("Pipfile.lock".to_string(), lock())]), + std::slice::from_ref(&no_digest), + None, + &mut result, + ); + assert!(result.refused_pipenv_uuids.is_empty()); + assert_eq!(result.warnings[0].code, "redirect_pipenv_skipped"); + } + + #[test] + fn bom_prefixed_lock_is_rewritten_and_restored_with_the_bom_intact() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let original = format!("\u{feff}{}", lock()); + let (text, edits) = plan(&original, &dep, None).unwrap(); + assert!(text.starts_with('\u{feff}'), "the BOM is preserved"); + assert!(text.contains("patch.socket.dev")); + let mut restored = text; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); } + assert_eq!(restored, original); } #[test] From 2d92f262e0350f1ccbdb73240d819073b6838aa0 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:31:41 -0400 Subject: [PATCH 07/27] fix(pipenv): warn when a rewritten Pipfile.lock leaves an installed upstream release in place MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Measured on real Pipenv 11.10.4, 2018.11.26 and 2026.8.0, hosted AND vendored: with the same release already installed, `pipenv install`, `pipenv install --deploy` and `pipenv sync` all exit 0 and keep the upstream bytes (pip: "Requirement already satisfied"). The rewritten lock protects fresh installs only, and nothing said so — the same silent-CVE class the gem redirect guards against (#219). Every Pipenv install proof so far uninstalled the package before installing, which hid it. Hosted: a post-rewrite probe over the Python crawler's site-packages (VIRTUAL_ENV, ./.venv, ./venv, Pipenv's out-of-tree venv; --global honoured) judges each confirmed Pipfile.lock redirect with the shared `verify_patch_record` oracle and warns `redirect_pipenv_stale_install` on POSITIVE evidence only (readable bytes ≠ afterHash); an agent-mode-patched install, a lock-only checkout and missing/unreadable files stay silent, and stale purls are excluded from the same-run `--vex` attestation exactly like gem's. Gated off on --dry-run. `confirmed_pipenv_uuids` (previously written and never read) scopes the probe to the redirects the Pipenv rewriter made. Vendored: the pipenv wiring path pushes `pypi_pipenv_stale_install` under the same rules. Remedy, verified on 2026 and 2018 with the Pipfile byte-untouched: `pipenv run pip uninstall -y && pipenv sync` or `pipenv --rm && pipenv sync`. `pipenv uninstall ` is NOT it — it rewrites the Pipfile and re-locks the patch away (the package vanishes); `PIP_FORCE_REINSTALL=1 pipenv sync` works on 2018 but is ignored by 2026. Co-Authored-By: Claude Fable 5.1 --- .../src/commands/scan/hosted.rs | 346 +++++++++++++++++- crates/socket-patch-core/src/vendor/pypi.rs | 52 +++ 2 files changed, 388 insertions(+), 10 deletions(-) diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 2390d6f2..369fa174 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -394,7 +394,7 @@ fn build_redirect_json_envelope( /// installed-tree verification: a patched install still attests (with hash /// evidence), a stale one is omitted. #[derive(Default)] -struct GemStaleOutcome { +struct StaleInstallOutcome { warnings: Vec, stale_purls: std::collections::BTreeSet, } @@ -491,10 +491,20 @@ fn gem_stale_cache_warning(purl: &str, cache_path: &Path) -> serde_json::Value { async fn gem_stale_positive_evidence( gem_dir: &Path, record: &socket_patch_core::manifest::schema::PatchRecord, +) -> bool { + stale_positive_evidence(gem_dir, record).await +} + +/// The ecosystem-neutral body of [`gem_stale_positive_evidence`]: `dir` is +/// the root the record's file paths are relative to (a gem's install dir, a +/// Python `site-packages`). +async fn stale_positive_evidence( + dir: &Path, + record: &socket_patch_core::manifest::schema::PatchRecord, ) -> bool { use socket_patch_core::patch::apply::{verify_file_patch, VerifyStatus}; for (file_name, info) in &record.files { - let result = verify_file_patch(gem_dir, file_name, info).await; + let result = verify_file_patch(dir, file_name, info).await; if matches!( result.status, VerifyStatus::Ready | VerifyStatus::HashMismatch @@ -506,6 +516,124 @@ async fn gem_stale_positive_evidence( false } +/// Post-rewrite stale-install probe for Pipfile.lock redirects — the Python +/// twin of [`gem_stale_install_warnings`], for the same class of defect +/// measured on real Pipenv 11.10.4, 2018.11.26 and 2026.8.0: with the same +/// release already installed, `pipenv install`, `pipenv install --deploy` +/// and `pipenv sync` all exit 0 and leave the upstream bytes in place (pip: +/// "Requirement already satisfied"), so the rewritten lock protects fresh +/// installs only. +/// +/// * Candidates are this run's confirmed pypi purls whose patch the Pipenv +/// rewriter actually wired (`confirmed_pipenv_uuids`) and whose record is +/// known (this run's fetched records, then the ledger's). +/// * Discovery is [`PythonCrawler::get_site_packages_paths`] — the same +/// venv discovery `apply` uses (VIRTUAL_ENV, ./.venv, ./venv, Pipenv's +/// out-of-tree venv; `--global`/`--global-prefix` honoured). +/// * PATCHED means `verify_patch_record` Ok (an agent-mode install stays +/// silent); STALE requires [`stale_positive_evidence`] — never inferred +/// from missing or unreadable files. Every venv is judged on its own: one +/// patched venv does not excuse another stale one. +/// +/// Read-only: the remedy is prescribed, never executed. +async fn pipenv_stale_install_warnings( + cwd: &Path, + global: bool, + global_prefix: Option, + confirmed: &[(String, String)], + pipenv_uuids: &std::collections::BTreeSet, + records: &std::collections::BTreeMap, + ledger_records: &std::collections::BTreeMap< + String, + socket_patch_core::manifest::schema::PatchRecord, + >, +) -> StaleInstallOutcome { + use socket_patch_core::crawlers::python_crawler::PythonCrawler; + use socket_patch_core::crawlers::types::CrawlerOptions; + use socket_patch_core::manifest::schema::PatchRecord; + use socket_patch_core::utils::purl::strip_purl_qualifiers; + use socket_patch_core::vex::verify::verify_patch_record; + + let mut out = StaleInstallOutcome::default(); + let find_record = |uuid: &str| -> Option<&PatchRecord> { + records + .values() + .chain(ledger_records.values()) + .find(|r| r.uuid == uuid) + }; + let candidates: Vec<(&str, &PatchRecord)> = confirmed + .iter() + .filter(|(purl, uuid)| purl.starts_with("pkg:pypi/") && pipenv_uuids.contains(uuid)) + .filter_map(|(purl, uuid)| find_record(uuid).map(|r| (purl.as_str(), r))) + .filter(|(_, r)| !r.files.is_empty()) + .collect(); + if candidates.is_empty() { + return out; + } + let crawler = PythonCrawler::new(); + let options = CrawlerOptions { + cwd: cwd.to_path_buf(), + global, + global_prefix, + }; + let site_packages = crawler + .get_site_packages_paths(&options) + .await + .unwrap_or_default(); + for (purl, record) in &candidates { + let stripped = strip_purl_qualifiers(purl).to_string(); + let mut stale_dirs: Vec = Vec::new(); + for site in &site_packages { + let found = crawler + .find_by_purls(site, std::slice::from_ref(&stripped)) + .await + .unwrap_or_default(); + if !found.contains_key(&stripped) { + continue; + } + if verify_patch_record(site, record).await.is_ok() { + continue; + } + if stale_positive_evidence(site, record).await { + stale_dirs.push(site.clone()); + } + } + if stale_dirs.is_empty() { + continue; + } + out.warnings + .push(pipenv_stale_install_warning(purl, &stale_dirs)); + out.stale_purls.insert((*purl).to_string()); + } + out +} + +/// The `redirect_pipenv_stale_install` warning for one purl whose upstream +/// release is still installed in `dirs` (verified remedies: a venv-level +/// `pip uninstall` + `pipenv sync`, or a clean virtualenv — both measured to +/// install the rewritten reference on Pipenv 2018 and 2026; `pipenv +/// uninstall` is NOT one: it edits the Pipfile and re-locks, dropping the +/// package, and `PIP_FORCE_REINSTALL` is ignored by Pipenv 2026). +fn pipenv_stale_install_warning(purl: &str, dirs: &[std::path::PathBuf]) -> serde_json::Value { + use socket_patch_core::utils::purl::strip_purl_qualifiers; + let base = strip_purl_qualifiers(purl); + let name = base + .strip_prefix("pkg:pypi/") + .and_then(|rest| rest.split('@').next()) + .filter(|name| !name.is_empty()) + .unwrap_or(base) + .to_string(); + let listed = dirs + .iter() + .map(|d| d.display().to_string()) + .collect::>() + .join(", "); + let detail = format!( + "{purl}: the UNPATCHED upstream release is still installed in {listed}. Pipenv does not reinstall a release that is already present — `pipenv install`, `pipenv install --deploy` and `pipenv sync` all exit 0 and keep those bytes — so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the Pipfile: `pipenv run pip uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away; then `socket-patch vex` re-verifies the installed files." + ); + serde_json::json!({ "code": "redirect_pipenv_stale_install", "detail": detail }) +} + /// Post-rewrite stale-materialization probe for gem redirects — the guard /// for the live-verified warm-path defect where `bundle install` never /// refetches an already-materialized gem (full narrative: the "Gem @@ -548,14 +676,14 @@ async fn gem_stale_install_warnings( socket_patch_core::manifest::schema::PatchRecord, >, gem_artifact_shas: &std::collections::BTreeMap<(String, String), String>, -) -> GemStaleOutcome { +) -> StaleInstallOutcome { use socket_patch_core::crawlers::types::CrawlerOptions; use socket_patch_core::crawlers::RubyCrawler; use socket_patch_core::manifest::schema::PatchRecord; use socket_patch_core::vendor::file_sha256_hex; use socket_patch_core::vex::verify::verify_patch_record; - let mut out = GemStaleOutcome::default(); + let mut out = StaleInstallOutcome::default(); let find_record = |uuid: &str| -> Option<&PatchRecord> { records .values() @@ -1889,8 +2017,8 @@ pub(crate) async fn run_redirect_selected( // the probe's ledger-record fallback could still judge an // already-redirected project, so without this gate a dry-run would warn // about state the run did not (re)create. - let gem_stale: GemStaleOutcome = if common.dry_run { - GemStaleOutcome::default() + let gem_stale: StaleInstallOutcome = if common.dry_run { + StaleInstallOutcome::default() } else { // purl-coordinate → the PATCHED .gem artifact's sha256 (registry // override identifier, tarball integrity fallback) — judges a @@ -1918,6 +2046,22 @@ pub(crate) async fn run_redirect_selected( ) .await }; + // The Python twin (Pipfile.lock redirects only — see + // `pipenv_stale_install_warnings`), same explicit --dry-run gate. + let pipenv_stale: StaleInstallOutcome = if common.dry_run { + StaleInstallOutcome::default() + } else { + pipenv_stale_install_warnings( + &common.cwd, + common.global, + common.global_prefix.clone(), + &confirmed, + &rewrite.confirmed_pipenv_uuids, + &records, + &ledger_records, + ) + .await + }; // Cross-mode takeover: a committed vendored ledger (`.socket/vendor/state.json`) // may still claim package(s) this project also has a hosted redirect ledger @@ -1978,7 +2122,9 @@ pub(crate) async fn run_redirect_selected( params.assume_applied = confirmed .iter() .map(|(purl, _)| purl.clone()) - .filter(|purl| !gem_stale.stale_purls.contains(purl)) + .filter(|purl| { + !gem_stale.stale_purls.contains(purl) && !pipenv_stale.stale_purls.contains(purl) + }) .collect(); let manifest_path = common.resolved_manifest_path(); match generate_vex_from_manifest_path(common, ¶ms, &manifest_path).await { @@ -2005,6 +2151,7 @@ pub(crate) async fn run_redirect_selected( warnings.extend(rush_warnings.iter().cloned()); warnings.extend(pnpm_warnings.iter().cloned()); warnings.extend(gem_stale.warnings.iter().cloned()); + warnings.extend(pipenv_stale.warnings.iter().cloned()); warnings.extend(takeover_pre_warnings.iter().cloned()); warnings.extend(takeover_warnings.iter().cloned()); warnings.extend(prune_warnings.iter().cloned()); @@ -2082,7 +2229,7 @@ pub(crate) async fn run_redirect_selected( for w in &pnpm_warnings { eprintln!(" warning: {}", w["detail"].as_str().unwrap_or_default()); } - for w in &gem_stale.warnings { + for w in gem_stale.warnings.iter().chain(pipenv_stale.warnings.iter()) { // Code included: the stale-install hazard is a silent-CVE // state, so the stderr line must be greppable by its stable // code in CI logs, same as the JSON envelope. @@ -2152,7 +2299,7 @@ pub(crate) fn boxed_run_redirect_selected<'a>( mod tests { use super::{ build_redirect_json_envelope, gem_stale_cache_warning, gem_stale_install_warning, - gem_stale_install_warnings, gem_stale_positive_evidence, parse_purl_simple, + gem_stale_install_warnings, pipenv_stale_install_warnings, gem_stale_positive_evidence, parse_purl_simple, plan_workspace_trust, pnpm_heal_root, pnpm_lock_carries_hosted_redirect, pnpm_lock_version_major, pnpm_trust_configured_detail, pnpm_trust_legacy_detail, pnpm_trust_manual_guidance, pnpm_trust_workspace_unreadable_detail, @@ -2631,6 +2778,185 @@ mod tests { const GEM_UPSTREAM: &[u8] = b"module StaleUnit; STATUS = :vulnerable; end\n"; const GEM_PATCHED: &[u8] = b"module StaleUnit; STATUS = :patched; end\n"; + /// Lay `urllib3 1.26.18` into a project-local venv with the given bytes + /// for the record's one file and return its site-packages dir. + fn materialize_pipenv_venv(root: &std::path::Path, response_py: &[u8]) -> PathBuf { + let site = if cfg!(windows) { + root.join(".venv").join("Lib").join("site-packages") + } else { + root.join(".venv") + .join("lib") + .join("python3.12") + .join("site-packages") + }; + let dist_info = site.join("urllib3-1.26.18.dist-info"); + std::fs::create_dir_all(&dist_info).unwrap(); + std::fs::write( + dist_info.join("METADATA"), + "Metadata-Version: 2.1\nName: urllib3\nVersion: 1.26.18\n", + ) + .unwrap(); + std::fs::create_dir_all(site.join("urllib3")).unwrap(); + std::fs::write(site.join("urllib3").join("response.py"), response_py).unwrap(); + site + } + + fn pipenv_record(uuid: &str, before: &[u8], after: &[u8]) -> PatchRecord { + let mut files = std::collections::HashMap::new(); + files.insert( + "urllib3/response.py".to_string(), + PatchFileInfo { + before_hash: compute_git_sha256_from_bytes(before), + after_hash: compute_git_sha256_from_bytes(after), + }, + ); + PatchRecord { + uuid: uuid.to_string(), + exported_at: "2026-01-01T00:00:00Z".to_string(), + files, + vulnerabilities: std::collections::HashMap::new(), + description: String::new(), + license: String::new(), + tier: "free".to_string(), + } + } + + /// The Pipenv twin of the gem probe over a real venv layout: a confirmed + /// Pipfile.lock redirect whose upstream release is still installed + /// produces one `redirect_pipenv_stale_install` warning naming the + /// site-packages dir and the uninstall + sync remedy, and lands the purl + /// in `stale_purls`; an already-patched install, a purl the Pipenv + /// rewriter did not wire (a requirements.txt redirect), a missing record + /// and an absent install all stay silent; nothing is modified. + #[tokio::test] + async fn pipenv_stale_install_probe_end_to_end() { + const PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"; + const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98"; + let upstream = b"def upstream():\n pass\n"; + let patched = b"def patched():\n pass\n"; + let record = pipenv_record(UUID, upstream, patched); + let mut records = std::collections::BTreeMap::new(); + records.insert(PURL.to_string(), record.clone()); + let confirmed = vec![(PURL.to_string(), UUID.to_string())]; + let wired: std::collections::BTreeSet = [UUID.to_string()].into_iter().collect(); + let empty_ledger = std::collections::BTreeMap::new(); + + // STALE: upstream bytes installed → one warning, dir + remedy named. + let stale = tempfile::tempdir().unwrap(); + std::fs::write(stale.path().join("Pipfile"), "[packages]\n").unwrap(); + let site = materialize_pipenv_venv(stale.path(), upstream); + let out = pipenv_stale_install_warnings( + stale.path(), + false, + None, + &confirmed, + &wired, + &records, + &empty_ledger, + ) + .await; + assert_eq!(out.warnings.len(), 1, "{:?}", out.warnings); + assert_eq!(out.warnings[0]["code"], "redirect_pipenv_stale_install"); + let detail = out.warnings[0]["detail"].as_str().expect("detail is a string"); + assert!(detail.contains(&site.display().to_string()), "{detail}"); + assert!(detail.contains("pipenv run pip uninstall -y urllib3 && pipenv sync"), "{detail}"); + assert!(!detail.contains("`pipenv uninstall urllib3"), "the Pipfile-rewriting command must not be prescribed: {detail}"); + assert!(detail.contains("UNPATCHED"), "{detail}"); + assert_eq!( + out.stale_purls, + std::collections::BTreeSet::from([PURL.to_string()]) + ); + assert_eq!( + std::fs::read(site.join("urllib3").join("response.py")).unwrap(), + upstream, + "read-only" + ); + + // The ledger's record serves when this run's fetch failed. + let mut ledger = std::collections::BTreeMap::new(); + ledger.insert(PURL.to_string(), record.clone()); + let out = pipenv_stale_install_warnings( + stale.path(), + false, + None, + &confirmed, + &wired, + &std::collections::BTreeMap::new(), + &ledger, + ) + .await; + assert_eq!(out.warnings.len(), 1); + + // PATCHED (agent-mode bytes) → silent. + let done = tempfile::tempdir().unwrap(); + std::fs::write(done.path().join("Pipfile"), "[packages]\n").unwrap(); + materialize_pipenv_venv(done.path(), patched); + let out = pipenv_stale_install_warnings( + done.path(), + false, + None, + &confirmed, + &wired, + &records, + &empty_ledger, + ) + .await; + assert!(out.warnings.is_empty(), "{:?}", out.warnings); + assert!(out.stale_purls.is_empty()); + + // Not wired by the Pipenv rewriter (a requirements.txt redirect) → + // silent even with the stale install. + let out = pipenv_stale_install_warnings( + stale.path(), + false, + None, + &confirmed, + &std::collections::BTreeSet::new(), + &records, + &empty_ledger, + ) + .await; + assert!(out.warnings.is_empty()); + + // No record anywhere → no judgment. + let out = pipenv_stale_install_warnings( + stale.path(), + false, + None, + &confirmed, + &wired, + &std::collections::BTreeMap::new(), + &empty_ledger, + ) + .await; + assert!(out.warnings.is_empty()); + + // Lock-only checkout (nothing installed) → no positive evidence. + let bare = tempfile::tempdir().unwrap(); + std::fs::write(bare.path().join("Pipfile"), "[packages]\n").unwrap(); + let site = if cfg!(windows) { + bare.path().join(".venv").join("Lib").join("site-packages") + } else { + bare.path() + .join(".venv") + .join("lib") + .join("python3.12") + .join("site-packages") + }; + std::fs::create_dir_all(site).unwrap(); + let out = pipenv_stale_install_warnings( + bare.path(), + false, + None, + &confirmed, + &wired, + &records, + &empty_ledger, + ) + .await; + assert!(out.warnings.is_empty()); + } + fn gem_record() -> PatchRecord { gem_record_with(GEM_UUID, GEM_UPSTREAM, GEM_PATCHED) } @@ -2704,7 +3030,7 @@ mod tests { cwd: &std::path::Path, confirmed: &[(String, String)], records: &std::collections::BTreeMap, - ) -> super::GemStaleOutcome { + ) -> super::StaleInstallOutcome { gem_stale_install_warnings( cwd, false, diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index 0d898a34..24743723 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -455,6 +455,53 @@ pub async fn vendor_pypi( .await } +/// Pipenv never reinstalls a release that is already present — measured on +/// 11.10.4, 2018.11.26 and 2026.8.0: `pipenv install`, `install --deploy` +/// and `sync` all exit 0 and keep the installed bytes — so wiring the lock +/// while the upstream release sits in the virtualenv leaves that venv +/// vulnerable until it is reinstalled. Positive evidence only (readable +/// bytes hashing to something other than the record's afterHash); an +/// already-patched (agent-mode) install and a lock-only checkout stay silent. +async fn pipenv_stale_install_warning( + site_packages: &Path, + purl: &str, + record: &PatchRecord, +) -> Option { + use crate::patch::apply::{verify_file_patch, VerifyStatus}; + if record.files.is_empty() + || crate::vex::verify::verify_patch_record(site_packages, record) + .await + .is_ok() + { + return None; + } + let mut stale = false; + for (file, info) in &record.files { + let result = verify_file_patch(site_packages, file, info).await; + if matches!( + result.status, + VerifyStatus::Ready | VerifyStatus::HashMismatch + ) && result.current_hash.is_some() + { + stale = true; + break; + } + } + if !stale { + return None; + } + let name = parse_pypi_purl(strip_purl_qualifiers(purl)) + .map(|(name, _)| name.to_string()) + .unwrap_or_else(|| purl.to_string()); + Some(VendorWarning::new( + "pypi_pipenv_stale_install", + format!( + "{purl}: the UNPATCHED upstream release is still installed in {}. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the Pipfile: `pipenv run pip uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away; then `socket-patch vex` re-verifies the installed files.", + site_packages.display() + ), + )) +} + #[allow(clippy::too_many_arguments)] pub async fn vendor_pypi_with_pipenv_version( purl: &str, @@ -623,6 +670,11 @@ pub async fn vendor_pypi_with_pipenv_version( } Ok(PipenvTarget::Fresh) => { warnings.extend(project.warnings.iter().cloned()); + if let Some(stale) = + pipenv_stale_install_warning(site_packages, purl, record).await + { + warnings.push(stale); + } WiringPlan::Pipenv(Box::new(project)) } Err((code, detail)) => return refused(code, detail), From 405a01803b50ed5250aa299fb0ad08d37c4e8705 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:36:59 -0400 Subject: [PATCH 08/27] fix(pipenv): retire relocked entries on rollback and probe the installer only when a patch targets the lock MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rollback: `pipenv lock` (and `update`, and `install ` before 2024) regenerates the redirected entry to registry shape on every Pipenv major (measured). `restore()` then saw live ≠ new and refused with "drifted", holding the whole pypi replay group — and a re-scan added a second edit on the same key, so the ledger could never be unwound. A registry-shaped live entry (no `file`/`path` key) is now the desired end state: the edit retires cleanly and the user's fresh resolution stands. A foreign `file`/`path` reference is still drift and still refuses. Installer probe: `pipenv --version` ran (up to 10 s) on every hosted scan whose root merely had a Pipfile.lock, and `redirect_pipenv_installer_unknown` fired even when nothing was redirected, on every re-run and on --dry-run, telling users to install legacy Pipenv. It now runs only when a pypi patch targets an entry of that lock (`pipenv_lock_targets`) and warns only when the lock was actually rewritten, with the actual consequence (the modern `file` shape was chosen) and the remedy. `SOCKET_PIPENV_MAJOR=` pins the answer for CI images without pipenv or projects installed with a different release than the machine's default. Probe hardening: `pipenv` is resolved on ABSOLUTE PATH entries only — the probe runs with the project as cwd, so `.`/empty PATH components would have executed a `pipenv` planted in the scanned repository — and on Windows the PATHEXT extensions are tried so `pipenv.bat`/`pipenv.cmd` shims (pyenv-win) are found and run through `cmd.exe /C`. `parse_major` takes only the token after `version` (every release 0.2.8–2026.8.0 prints `pipenv, version X`), never a stray dotted number such as a `Python 3.12` banner. `.env` loading is disabled for the probe. Co-Authored-By: Claude Fable 5.1 --- .../src/commands/scan/hosted.rs | 19 +- .../src/patch/redirect/mod.rs | 7 + .../src/patch/redirect/pipenv.rs | 93 +++++++++ crates/socket-patch-core/src/utils/pipenv.rs | 176 +++++++++++++++++- 4 files changed, 287 insertions(+), 8 deletions(-) diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 369fa174..1ecc4912 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -1520,7 +1520,15 @@ pub(crate) async fn run_redirect_selected( } } overrides.retain(|dep| !unavailable_python_artifacts.contains(&dep.artifact_url)); - let pipenv_major = if files.contains_key("Pipfile.lock") { + // The Pipfile.lock reference shape depends on the installing Pipenv + // (`path` for 7–11, `file` from 2018 on), so the installed release is + // probed (`pipenv --version`, up to 10 s) — but only when a pypi patch + // actually targets an entry of THIS lock: a stray Pipfile.lock in a uv / + // Poetry project, a re-scan with nothing left to do and any non-Python + // run must neither spawn Pipenv nor warn about its absence. + let targets_pipenv_lock = + socket_patch_core::patch::redirect::pipenv_lock_targets(&files, &overrides); + let pipenv_major = if targets_pipenv_lock { socket_patch_core::utils::pipenv::installed_major(&common.cwd).await } else { None @@ -1532,10 +1540,15 @@ pub(crate) async fn run_redirect_selected( pipenv_major, ); - if files.contains_key("Pipfile.lock") && pipenv_major.is_none() { + // Unknown installer → the modern `file` shape was chosen; say so only + // when the lock was (or, on --dry-run, would be) rewritten. + if targets_pipenv_lock && pipenv_major.is_none() && rewrite.files.contains_key("Pipfile.lock") { rewrite.warnings.push(socket_patch_core::patch::redirect::RewriteWarning { code: "redirect_pipenv_installer_unknown".into(), - detail: "Pipenv was not detected; these hosted references require Pipenv 2018 or later. Make legacy Pipenv available on PATH to select its native lockfile format.".into(), + detail: format!( + "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}= and re-run `scan --mode hosted`.", + socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV + ), }); } diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs index 71a7b2d7..059fa758 100644 --- a/crates/socket-patch-core/src/patch/redirect/mod.rs +++ b/crates/socket-patch-core/src/patch/redirect/mod.rs @@ -213,6 +213,13 @@ pub fn rewrite_registry_redirect_with_python_metadata( rewrite_registry_redirect_with_pipenv_version(files, overrides, python_metadata, None) } +/// Whether any pypi override targets an entry of `files["Pipfile.lock"]` — +/// callers use it to decide whether probing the installed Pipenv release is +/// worth a subprocess and whether its absence deserves a warning. +pub fn pipenv_lock_targets(files: &BTreeMap, overrides: &[DepOverride]) -> bool { + pipenv::lock_targets(files, overrides) +} + pub fn rewrite_registry_redirect_with_pipenv_version( files: &BTreeMap, overrides: &[DepOverride], diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs index b8bad637..cfbe4196 100644 --- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -155,6 +155,19 @@ pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { return Ok(text.into()); } if live != new { + // A relock (`pipenv lock`, `pipenv update`, `pipenv install ` + // on <= 2023) regenerates the entry to registry shape: the redirect + // is already gone and the user's fresh resolution is the desired end + // state, so the edit is retired instead of holding every pypi revert + // hostage forever. A DIFFERENT `file`/`path` reference (a user's own + // source, a hand edit) is real drift and still refuses. + let registry_shaped = entry + .value + .as_object() + .is_some_and(|object| !object.contains_key("file") && !object.contains_key("path")); + if registry_shaped { + return Ok(text.into()); + } return Err(format!("Pipenv entry {section}.{name} drifted")); } let mut result = text.to_owned(); @@ -162,6 +175,28 @@ pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { Ok(result) } +/// Whether any pypi override names a package this `Pipfile.lock` pins — the +/// cheap pre-check that decides whether the installer probe +/// (`pipenv --version`, up to 10 s) is worth running and whether its +/// absence is worth a warning. An absent or unparseable lock targets nothing. +pub(super) fn lock_targets(files: &BTreeMap, overrides: &[DepOverride]) -> bool { + let Some(text) = files.get("Pipfile.lock") else { + return false; + }; + let Ok(entries) = entries(text) else { + return false; + }; + overrides + .iter() + .filter(|dep| dep.ecosystem == "pypi") + .any(|dep| { + let wanted = canonicalize_pypi_name(&dep.name); + entries + .iter() + .any(|(_, entry)| canonicalize_pypi_name(&entry.name) == wanted) + }) +} + pub(super) fn rewrite( files: &BTreeMap, overrides: &[DepOverride], @@ -529,6 +564,64 @@ mod tests { assert!(plan(&lock(), &missing_hash, None).is_err()); } + /// `pipenv lock` (and `update`, and `install ` before 2024) + /// regenerates the redirected entry to registry shape. That is the + /// desired end state of a rollback, so the edit retires cleanly instead + /// of refusing forever; a foreign `file`/`path` reference is still drift. + /// A re-scan after the relock (second edit on the same key) unwinds + /// newest-first to the relocked text. + #[test] + fn relocked_registry_entry_retires_the_edit_instead_of_refusing() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + // One category, so the relock below regenerates the ONLY redirect. + let mut value: Value = serde_json::from_str(&lock()).unwrap(); + value.as_object_mut().unwrap().remove("tests"); + let original = format_entry(&value, "{", 0).unwrap() + "\n"; + let (redirected, edits) = plan(&original, &dep, None).unwrap(); + assert_eq!(edits.len(), 1); + let redirected_entry = edits[0].new.as_ref().unwrap().as_str().unwrap(); + let relocked_entry = format_entry( + &json!({"hashes": ["sha256:relocked"], "index": "pypi", "version": "==1.26.18"}), + &redirected, + redirected.find(redirected_entry).unwrap(), + ) + .unwrap(); + let relocked = redirected.replacen(redirected_entry, &relocked_entry, 1); + assert_eq!( + restore(&relocked, &edits[0]).unwrap(), + relocked, + "a registry-shaped entry is already unwound" + ); + let foreign = redirected.replacen( + redirected_entry, + &format_entry(&json!({"file": "https://example.org/fork.whl"}), &redirected, 0).unwrap(), + 1, + ); + assert!(restore(&foreign, &edits[0]).is_err(), "a foreign reference is drift"); + + // Re-scan after the relock, then roll back newest-first. + let (again, second) = plan(&relocked, &dep, None).unwrap(); + let mut current = again; + for edit in second.iter().chain(edits.iter()) { + current = restore(¤t, edit).unwrap(); + } + assert_eq!(current, relocked); + } + + #[test] + fn lock_targets_requires_a_matching_pin_in_a_parseable_lock() { + let dep = dependency("URLlib3", "1.26.18", "patch-one"); + let other = dependency("six", "1.16.0", "patch-two"); + let files = |text: &str| BTreeMap::from([("Pipfile.lock".to_string(), text.to_string())]); + assert!(lock_targets(&files(&lock()), std::slice::from_ref(&dep))); + assert!(!lock_targets(&files(&lock()), std::slice::from_ref(&other))); + assert!(!lock_targets(&files("{ not json"), std::slice::from_ref(&dep))); + assert!(!lock_targets(&BTreeMap::new(), std::slice::from_ref(&dep))); + let mut npm = dep.clone(); + npm.ecosystem = "npm".into(); + assert!(!lock_targets(&files(&lock()), std::slice::from_ref(&npm))); + } + #[test] fn rollback_is_per_entry_preserves_unrelated_edits_and_refuses_drift() { let mut value: Value = serde_json::from_str(&lock()).unwrap(); diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs index 50b86440..91a65ff4 100644 --- a/crates/socket-patch-core/src/utils/pipenv.rs +++ b/crates/socket-patch-core/src/utils/pipenv.rs @@ -1,16 +1,107 @@ -use std::path::Path; +//! Which Pipenv release installs this project. The hosted rewriter writes +//! `path` references for Pipenv 7–11 and `file` references from 2018 on, and +//! the vendored backend refuses installers older than 2018, so both ask +//! [`installed_major`] once per command. +use std::ffi::OsString; +use std::path::{Path, PathBuf}; + +/// Pins the answer without spawning anything: CI images without pipenv on +/// PATH, or a project installed with a different release than the machine's +/// default pipenv. +pub const MAJOR_OVERRIDE_ENV: &str = "SOCKET_PIPENV_MAJOR"; + +/// `pipenv, version 2026.8.0` — every release from 0.2.8 through 2026.8.0 +/// prints exactly this shape on stdout (measured). Only the token after +/// `version` counts: a bare dotted number elsewhere (a `Python 3.12` banner +/// from a wrapper, a "Courtesy Notice" line) must never be mistaken for the +/// major, because a wrong major silently picks the wrong lock reference +/// shape or refuses vendoring. fn parse_major(output: &str) -> Option { - output - .split_whitespace() - .find_map(|part| part.trim_start_matches('v').split('.').next()?.parse().ok()) + let tokens: Vec<&str> = output.split_whitespace().collect(); + let index = tokens + .iter() + .position(|token| token.trim_end_matches(':').eq_ignore_ascii_case("version"))?; + let token = tokens + .get(index + 1)? + .trim_start_matches('v') + .trim_matches(|c: char| matches!(c, ',' | '(' | ')' | ';')); + let (major, rest) = token.split_once('.')?; + rest.chars().next().filter(char::is_ascii_digit)?; + major.parse().ok() +} + +/// The `pipenv` executable, searched on ABSOLUTE `PATH` entries only: the +/// probe runs with the project as its working directory, so a relative entry +/// (`.`, an empty component) would execute a `pipenv` planted in the +/// repository being scanned. On Windows every `PATHEXT` extension is tried, +/// so `pipenv.exe` and the `pipenv.bat` / `pipenv.cmd` shims (pyenv-win, +/// hand-written wrappers) are both found. +fn resolve_on_path(var: &impl Fn(&str) -> Option) -> Option { + let path = var("PATH")?; + let extensions: Vec = if cfg!(windows) { + var("PATHEXT") + .map(|value| { + value + .to_string_lossy() + .split(';') + .filter(|ext| !ext.is_empty()) + .map(|ext| ext.to_ascii_lowercase()) + .collect::>() + }) + .filter(|list| !list.is_empty()) + .unwrap_or_else(|| vec![".exe".into(), ".bat".into(), ".cmd".into()]) + } else { + vec![String::new()] + }; + for dir in std::env::split_paths(&path) { + if !dir.is_absolute() { + continue; + } + for ext in &extensions { + let candidate = dir.join(format!("pipenv{ext}")); + if candidate.is_file() { + return Some(candidate); + } + } + } + None } +fn is_batch_shim(program: &Path) -> bool { + cfg!(windows) + && program.extension().is_some_and(|ext| { + let ext = ext.to_string_lossy().to_ascii_lowercase(); + ext == "bat" || ext == "cmd" + }) +} + +/// The major of the `pipenv` on PATH (`11`, `2018`, `2026`, …), or `None` +/// when none is found, it does not answer within 10 s, exits non-zero or +/// prints something unrecognizable. [`MAJOR_OVERRIDE_ENV`] short-circuits +/// the probe. pub async fn installed_major(root: &Path) -> Option { - let mut command = tokio::process::Command::new("pipenv"); + if let Some(forced) = std::env::var(MAJOR_OVERRIDE_ENV) + .ok() + .and_then(|value| value.trim().parse::().ok()) + { + return Some(forced); + } + let program = resolve_on_path(&|name| std::env::var_os(name))?; + let mut command = if is_batch_shim(&program) { + let mut command = tokio::process::Command::new("cmd.exe"); + command.arg("/C").arg(&program); + command + } else { + tokio::process::Command::new(&program) + }; command .arg("--version") .current_dir(root) + // Pipenv loads the project's `.env` before answering; a broken or + // hostile one must not break (or slow down) the version banner. + .env("PIPENV_DONT_LOAD_ENV", "1") + .env("PIPENV_NOSPIN", "1") .kill_on_drop(true); let output = tokio::time::timeout(std::time::Duration::from_secs(10), command.output()) .await @@ -25,10 +116,85 @@ pub async fn installed_major(root: &Path) -> Option { #[cfg(test)] mod tests { use super::*; + #[test] fn installer_version_output() { assert_eq!(parse_major("pipenv, version 11.10.4\n"), Some(11)); assert_eq!(parse_major("pipenv, version 2026.8.0\n"), Some(2026)); + assert_eq!(parse_major("pipenv, version 0.2.8\n"), Some(0)); assert_eq!(parse_major("unavailable"), None); + // Extra lines before the banner (a courtesy notice, a `.env` load + // message routed to stdout by a wrapper) do not confuse it… + assert_eq!( + parse_major( + "Courtesy Notice: Pipenv found itself running within a virtual environment 3.12\npipenv, version 2023.12.1\n" + ), + Some(2023) + ); + assert_eq!(parse_major("Loading .env environment variables...\npipenv, version 2022.12.19"), Some(2022)); + // …and a dotted number that is NOT the pipenv version is never taken. + assert_eq!(parse_major("Python 3.12.0"), None); + assert_eq!(parse_major("version"), None); + assert_eq!(parse_major("version x.1"), None); + assert_eq!(parse_major("pipenv version 2024\n"), None, "no minor: not a version banner"); + } + + #[test] + fn resolve_on_path_skips_relative_entries_and_finds_absolute_ones() { + let tmp = tempfile::tempdir().unwrap(); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&bin).unwrap(); + let leaf = if cfg!(windows) { "pipenv.exe" } else { "pipenv" }; + std::fs::write(bin.join(leaf), b"").unwrap(); + // A repo-planted `pipenv` under a RELATIVE entry must never win. + let planted = tmp.path().join("planted"); + std::fs::create_dir_all(&planted).unwrap(); + std::fs::write(planted.join(leaf), b"").unwrap(); + let joined = std::env::join_paths([ + std::path::PathBuf::from("."), + std::path::PathBuf::from(""), + std::path::PathBuf::from("planted"), + bin.clone(), + ]) + .unwrap(); + let var = |name: &str| (name == "PATH").then(|| joined.clone()); + assert_eq!(resolve_on_path(&var), Some(bin.join(leaf))); + + let only_relative = std::env::join_paths([std::path::PathBuf::from("."), std::path::PathBuf::from("planted")]).unwrap(); + let var = |name: &str| (name == "PATH").then(|| only_relative.clone()); + assert_eq!(resolve_on_path(&var), None); + let none = |_: &str| None::; + assert_eq!(resolve_on_path(&none), None); + } + + #[cfg(windows)] + #[test] + fn resolve_on_path_honours_pathext_shims() { + let tmp = tempfile::tempdir().unwrap(); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&bin).unwrap(); + std::fs::write(bin.join("pipenv.bat"), b"@echo pipenv, version 2024.4.1").unwrap(); + let joined = std::env::join_paths([bin.clone()]).unwrap(); + let var = |name: &str| match name { + "PATH" => Some(joined.clone()), + "PATHEXT" => Some(OsString::from(".COM;.EXE;.BAT;.CMD")), + _ => None, + }; + let found = resolve_on_path(&var).unwrap(); + assert_eq!(found, bin.join("pipenv.bat")); + assert!(is_batch_shim(&found)); + } + + #[tokio::test] + async fn override_env_short_circuits_the_probe() { + // Serialized on the env var by name; the value is process-global. + let saved = std::env::var(MAJOR_OVERRIDE_ENV).ok(); + std::env::set_var(MAJOR_OVERRIDE_ENV, " 11 "); + let forced = installed_major(Path::new(".")).await; + match saved { + Some(v) => std::env::set_var(MAJOR_OVERRIDE_ENV, v), + None => std::env::remove_var(MAJOR_OVERRIDE_ENV), + } + assert_eq!(forced, Some(11)); } } From 9392af06b5703afd96b6be8aa8e073a715b2c7fb Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:36:59 -0400 Subject: [PATCH 09/27] fix(vex): attest same-run hosted redirects whose ledger purl carries a qualifier MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `scan --mode hosted --vex` exempts the purls the run just confirmed from installed-tree verification and attests them from the redirect ledger (`assume_applied`). The confirmed purls come from the grant reference unqualified (`pkg:pypi/urllib3@1.26.18`) while the ledger records the API's artifact-qualified purl (`…?artifact_id=py2-py3-none-any-whl`), so for pypi redirects nothing matched: a lock-only Pipenv checkout redirected the lock and then exited 1 with `no_applicable_patches`. Match on the qualifier-stripped purl on both sides. Measured on a lock-only Pipenv 2026.8.0 checkout: exit 1 / 0 statements before, exit 0 / 1 `not_affected` statement after. Same change as b7a4254 on fix/poetry-compat-review (PR #241); identical so the two merge cleanly. Co-Authored-By: Claude Fable 5.1 --- crates/socket-patch-cli/src/commands/vex.rs | 23 +++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs index beda9b55..9e7d5015 100644 --- a/crates/socket-patch-cli/src/commands/vex.rs +++ b/crates/socket-patch-cli/src/commands/vex.rs @@ -397,12 +397,23 @@ async fn generate_vex( // record the run did not re-confirm (a reverted lockfile or a withdrawn // patch must not keep attesting). if !params.assume_applied.is_empty() { - let exempt: std::collections::HashSet<&str> = - params.assume_applied.iter().map(|s| s.as_str()).collect(); - outcome.failed.retain(|f| !exempt.contains(f.purl.as_str())); - for purl in ¶ms.assume_applied { - if manifest.patches.contains_key(purl) && !outcome.applied.iter().any(|p| p == purl) { - outcome.applied.push(purl.clone()); + use socket_patch_core::utils::purl::strip_purl_qualifiers; + // The confirmed purls come from the grant reference (unqualified — + // `pkg:pypi/urllib3@1.26.18`) while the ledger records the API's + // artifact-qualified purl (`…?artifact_id=py2-py3-none-any-whl`), so + // match on the qualifier-stripped form: a lock-only pypi redirect used + // to attest nothing and fail the same-run `--vex` with + // `no_applicable_patches`. + let exempt: std::collections::HashSet<&str> = params + .assume_applied + .iter() + .map(|s| strip_purl_qualifiers(s)) + .collect(); + let is_exempt = |purl: &str| exempt.contains(strip_purl_qualifiers(purl)); + outcome.failed.retain(|f| !is_exempt(&f.purl)); + for key in manifest.patches.keys() { + if is_exempt(key) && !outcome.applied.iter().any(|p| p == key) { + outcome.applied.push(key.clone()); } } } From 20c57b4d6a40794085504c3b96113849708fce2c Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:43:26 -0400 Subject: [PATCH 10/27] fix(pypi): read requirements.txt alongside Pipfile.lock in the lock inventory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reading Pipfile.lock as an `else if` before requirements.txt hid every requirements pin behind a Pipfile.lock — including the stale one Bugbot's scenario leaves in a requirements project — so urllib3 was no longer even discovered there and the requirements redirect silently stopped happening. Pipenv projects also routinely ship both files (`pipenv requirements` exports the same pins). Both are now read and deduplicated; the hosted rewriter judges each file on its own. Verified: stale Pipfile.lock + requirements.txt → requirements redirected, `redirect_pipenv_skipped` ("no entry"), rollback restores the pin. Co-Authored-By: Claude Fable 5.1 --- .../src/vendor/lock_inventory.rs | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 69bda30a..55fd5ebe 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -1130,12 +1130,21 @@ async fn inventory_pypi_locks(project_root: &Path) -> Option> if let Some(entries) = inventory_poetry_lock(project_root).await { found = true; out.extend(entries); - } else if let Some(entries) = inventory_pipfile_lock(project_root).await { - found = true; - out.extend(entries); - } else if let Some(entries) = inventory_requirements_txt(project_root).await { - found = true; - out.extend(entries); + } else { + // Pipfile.lock and requirements.txt are read TOGETHER: Pipenv + // projects routinely ship both (`pipenv requirements` exports the + // same pins — deduplicated below), and a stale Pipfile.lock left in + // a requirements project must not hide the pins the project + // actually installs from (the hosted rewriter judges each file on + // its own). + if let Some(entries) = inventory_pipfile_lock(project_root).await { + found = true; + out.extend(entries); + } + if let Some(entries) = inventory_requirements_txt(project_root).await { + found = true; + out.extend(entries); + } } } found.then(|| dedup_prefer_integrity(out)) @@ -3373,8 +3382,8 @@ source = { editable = "." } /// Pipfile.lock: every category is read, registry pins carry the lock's /// digest SET (lowercased), non-registry sources / range pins / our own /// file references are skipped, the same package in two categories - /// yields one entry, and the lock outranks requirements.txt while a - /// parseable uv.lock outranks it. + /// yields one entry, requirements.txt is read alongside it, and a + /// parseable uv.lock outranks both. #[tokio::test] async fn pipfile_lock_inventory_reads_every_category_with_its_digest_set() { let wheel = "a".repeat(64); @@ -3403,7 +3412,8 @@ source = { editable = "." } let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); let mut names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect(); names.sort_unstable(); - assert_eq!(names, vec!["six", "urllib3"], "{entries:?}"); + // requirements.txt is read alongside the Pipfile.lock, not hidden by it. + assert_eq!(names, vec!["flask", "six", "urllib3"], "{entries:?}"); let urllib3 = entry(&entries, "urllib3"); assert_eq!(urllib3.purl, "pkg:pypi/urllib3@1.26.18"); assert_eq!(urllib3.resolved, None); From 41c235f598849bbb58ef369bf5dd74482f450abb Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:47:07 -0400 Subject: [PATCH 11/27] test(pipenv): in-process CLI coverage for hosted Pipfile.lock redirects MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PR pinned the rewriter with unit tests but nothing drove the CLI wiring: the `path` branch was unreachable in CI (it needs a real Pipenv 7–11 on PATH), the lock-only fresh-checkout shape had no test at all, and the Bugbot veto had no regression. Against a mocked API and the committed Pipenv 2026.8.0 lock: a lock-only project is discovered from Pipfile.lock alone, repointed with `file` + `#sha256=` + `hashes`, attested by the same-run `--vex` (with `--vex-product`, since a Pipfile names no project), re-scanned idempotently (one edit, not two) and rolled back byte for byte; `SOCKET_PIPENV_MAJOR=11` selects `path` references; a stale Pipfile.lock no longer vetoes the requirements.txt redirect; a venv holding the upstream release is kept out of the attestation and never modified. Co-Authored-By: Claude Fable 5.1 --- .../tests/in_process_redirect_pipenv.rs | 413 ++++++++++++++++++ .../tests/fixtures/pipenv/2026.8.0/Pipfile | 9 + .../fixtures/pipenv/2026.8.0/Pipfile.lock | 28 ++ 3 files changed, 450 insertions(+) create mode 100644 crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs new file mode 100644 index 00000000..73558280 --- /dev/null +++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs @@ -0,0 +1,413 @@ +//! In-process CLI tests for `scan --mode hosted` on Pipenv projects: mocks +//! the API (discovery + reference + view) via wiremock, lays down a native +//! `Pipfile.lock` (the committed Pipenv 2026.8.0 fixture) and drives the +//! real command wiring. Covered here (the rewriter bytes themselves are +//! pinned by the core `patch::redirect::pipenv` tests): +//! +//! * the lock-only fresh-checkout shape (nothing installed) is discovered +//! from `Pipfile.lock` alone, repointed with a `file` reference carrying +//! the `#sha256=` fragment and a matching `hashes` entry, attested by the +//! same-run `--vex`, re-scanned idempotently and rolled back byte for byte; +//! * `SOCKET_PIPENV_MAJOR=11` selects the legacy `path` reference shape the +//! installer probe would otherwise need a real Pipenv 7–11 on PATH for; +//! * a stale `Pipfile.lock` that does not pin the package no longer vetoes +//! the sibling `requirements.txt` redirect (Bugbot HIGH on #242); +//! * a venv still holding the UPSTREAM release is reported stale and kept +//! out of the same-run attestation. + +use std::path::Path; + +use serial_test::serial; +use socket_patch_cli::args::GlobalArgs; +use socket_patch_cli::commands::rollback::{self, RollbackArgs}; +use socket_patch_cli::commands::scan::{run, ScanArgs}; +use socket_patch_cli::commands::vex::VexEmbedArgs; +use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes; +use wiremock::matchers::{method, path, path_regex}; +use wiremock::{Mock, MockServer, ResponseTemplate}; + +const ORG: &str = "test-org"; +/// Discovery names the base purl (the lockfile supplement's spelling)… +const PURL: &str = "pkg:pypi/urllib3@1.26.18"; +/// …while the patch record carries the API's artifact-qualified purl, which +/// is what the redirect ledger is keyed by. +const RECORD_PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"; +const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98"; +const HOSTED_URL: &str = "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/22222222-2222-4222-8222-222222222222/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"; +const GHSA: &str = "GHSA-gm62-xv2j-4w53"; +const MAJOR_ENV: &str = socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV; + +const LOCK: &str = + include_str!("../../socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock"); +const PIPFILE: &str = include_str!("../../socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile"); + +/// The upstream and patched bytes of the record's one file, so the venv +/// tests can materialize a real `Ready` (upstream) install. +const UPSTREAM: &[u8] = b"def upstream():\n return 'vulnerable'\n"; +const PATCHED: &[u8] = b"def patched():\n return 'fixed'\n"; + +fn sha256() -> String { + "c".repeat(64) +} + +fn global(cwd: &Path, api_url: String) -> GlobalArgs { + GlobalArgs { + cwd: cwd.to_path_buf(), + org: Some(ORG.to_string()), + api_token: Some("fake".to_string()), + api_url: Some(api_url), + json: true, + yes: true, + ..GlobalArgs::default() + } +} + +fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs { + ScanArgs { + paths: Vec::new(), + common: global(cwd, api_url), + batch_size: 100, + apply: false, + prune: false, + sync: false, + vendor: false, + detached: false, + redirect: true, + mode: None, + all_releases: false, + vex: VexEmbedArgs { + vex: vex.map(Path::to_path_buf), + // A Pipfile names no project, so the embedded VEX cannot detect a + // product purl on its own (nor without a git remote): callers pass + // `--vex-product`, as documented for Pipenv projects. + vex_product: vex.map(|_| "pkg:pypi/pipenv-fixture@0.1.0".to_string()), + ..Default::default() + }, + } +} + +async fn mock_api(server: &MockServer) { + Mock::given(method("POST")) + .and(path(format!("/v0/orgs/{ORG}/patches/batch"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "packages": [{ + "purl": PURL, + "patches": [{ + "uuid": UUID, "purl": RECORD_PURL, "tier": "free", + "cveIds": ["CVE-2025-66418"], "ghsaIds": [GHSA], "severity": "HIGH", + "title": "pipenv redirect fixture" + }] + }], + "canAccessPaidPatches": false, + }))) + .mount(server) + .await; + Mock::given(method("GET")) + .and(path_regex(format!("^/v0/orgs/{ORG}/patches/by-package/.+$"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "patches": [{ + "uuid": UUID, "purl": RECORD_PURL, + "publishedAt": "2026-07-29T20:20:47Z", + "description": "x", "license": "MIT", "tier": "free", + "vulnerabilities": {} + }], + "canAccessPaidPatches": false, + }))) + .mount(server) + .await; + Mock::given(method("POST")) + .and(path(format!("/v0/orgs/{ORG}/patches/package"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "results": { + UUID: { + "status": "granted", + "url": HOSTED_URL, + "purl": PURL, + "artifacts": [{ + "kind": "tarball", + "url": HOSTED_URL, + "integrity": { "sha256": sha256() } + }], + "registryOverride": null + } + } + }))) + .mount(server) + .await; + Mock::given(method("GET")) + .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}"))) + .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({ + "uuid": UUID, + "purl": RECORD_PURL, + "publishedAt": "2026-07-29T20:20:47Z", + "files": { + "urllib3/response.py": { + "beforeHash": compute_git_sha256_from_bytes(UPSTREAM), + "afterHash": compute_git_sha256_from_bytes(PATCHED), + } + }, + "vulnerabilities": { + GHSA: { + "cves": ["CVE-2025-66418"], + "summary": "pipenv redirect vex fixture", + "severity": "HIGH", + "description": "d" + } + }, + "description": "x", "license": "MIT", "tier": "free" + }))) + .mount(server) + .await; +} + +fn site_packages(root: &Path) -> std::path::PathBuf { + if cfg!(windows) { + root.join(".venv").join("Lib").join("site-packages") + } else { + root.join(".venv") + .join("lib") + .join("python3.12") + .join("site-packages") + } +} + +/// A Pipenv project with nothing installed: the lock is the only source of +/// the dependency. An EMPTY in-project venv keeps the crawl hermetic (without +/// it the project-marker fallback would walk this machine's global +/// interpreters). +fn write_project(root: &Path) { + std::fs::write(root.join("Pipfile"), PIPFILE).unwrap(); + std::fs::write(root.join("Pipfile.lock"), LOCK).unwrap(); + std::fs::create_dir_all(site_packages(root)).unwrap(); +} + +/// The same project with the UPSTREAM release installed in its venv (the +/// warm-venv shape Pipenv never reinstalls over). +fn write_project_with_upstream_install(root: &Path) { + write_project(root); + let site = site_packages(root); + let dist_info = site.join("urllib3-1.26.18.dist-info"); + std::fs::create_dir_all(&dist_info).unwrap(); + std::fs::write( + dist_info.join("METADATA"), + "Metadata-Version: 2.1\nName: urllib3\nVersion: 1.26.18\n", + ) + .unwrap(); + std::fs::create_dir_all(site.join("urllib3")).unwrap(); + std::fs::write(site.join("urllib3").join("response.py"), UPSTREAM).unwrap(); +} + +fn read(path: &Path) -> String { + std::fs::read_to_string(path).unwrap() +} + +/// Pins the installer major for the duration of a test (restored on drop) so +/// the reference shape does not depend on whatever `pipenv` the machine has. +struct MajorGuard(Option); + +impl MajorGuard { + fn set(major: &str) -> Self { + let saved = std::env::var(MAJOR_ENV).ok(); + std::env::set_var(MAJOR_ENV, major); + MajorGuard(saved) + } +} + +impl Drop for MajorGuard { + fn drop(&mut self) { + match &self.0 { + Some(v) => std::env::set_var(MAJOR_ENV, v), + None => std::env::remove_var(MAJOR_ENV), + } + } +} + +fn urllib3_entry(lock: &str) -> serde_json::Value { + let value: serde_json::Value = serde_json::from_str(lock).expect("lock stays JSON"); + value["default"]["urllib3"].clone() +} + +async fn roll_back(cwd: &Path, api_url: String) { + let code = rollback::run(RollbackArgs { + targets: Vec::new(), + common: global(cwd, api_url), + one_off: false, + preserve_state: false, + }) + .await; + assert_eq!(code, 0, "rollback must succeed"); +} + +#[tokio::test] +#[serial] +async fn lock_only_pipenv_project_redirects_attests_rescans_and_rolls_back() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + let vex_path = tmp.path().join("out.vex.json"); + + // 1. Hosted redirect with same-run --vex on the lock-only checkout. + let code = run(hosted_args(tmp.path(), server.uri(), Some(&vex_path))).await; + assert_eq!(code, 0, "hosted redirect + same-run vex must succeed"); + let redirected = read(&lock_path); + let entry = urllib3_entry(&redirected); + assert_eq!( + entry["file"].as_str(), + Some(format!("{HOSTED_URL}#sha256={}", sha256()).as_str()), + "{redirected}" + ); + assert_eq!( + entry["hashes"], + serde_json::json!([format!("sha256:{}", sha256())]), + "{redirected}" + ); + assert!(entry.get("version").is_none() && entry.get("index").is_none(), "{entry}"); + assert_eq!( + entry["markers"], + urllib3_entry(LOCK)["markers"], + "markers are preserved" + ); + let before: serde_json::Value = serde_json::from_str(LOCK).unwrap(); + let after: serde_json::Value = serde_json::from_str(&redirected).unwrap(); + assert_eq!(after["_meta"], before["_meta"], "the Pipfile content hash stays"); + assert_eq!(read(&tmp.path().join("Pipfile")), PIPFILE, "Pipfile untouched"); + let ledger: serde_json::Value = + serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))) + .unwrap(); + assert!( + ledger["records"][RECORD_PURL].is_object(), + "ledger keyed by the artifact-qualified purl: {ledger}" + ); + assert_eq!( + ledger["edits"][0]["kind"].as_str(), + Some("redirect_pipenv_entry"), + "{ledger}" + ); + assert_eq!( + ledger["edits"][0]["key"].as_str(), + Some(r#"["default","urllib3"]"#), + "{ledger}" + ); + // Attested from the ledger (assume_applied) although the base purl the + // run confirmed differs from the record's qualified purl. + let vex: serde_json::Value = serde_json::from_str(&read(&vex_path)).unwrap(); + let statements = vex["statements"].as_array().expect("statements"); + assert_eq!(statements.len(), 1, "{vex}"); + assert_eq!(statements[0]["vulnerability"]["name"].as_str(), Some(GHSA), "{vex}"); + assert_eq!(statements[0]["status"].as_str(), Some("not_affected"), "{vex}"); + + // 2. Idempotent re-scan: no further edits, lock byte-identical. + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + assert_eq!(read(&lock_path), redirected, "re-scan must not touch the lock"); + let ledger: serde_json::Value = + serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))) + .unwrap(); + assert_eq!(ledger["edits"].as_array().map(Vec::len), Some(1), "one edit, not two"); + + // 3. rollback unwinds the redirect and drops the record. + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK, "rollback must restore the pristine lock byte for byte"); + let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json"); + if ledger_path.exists() { + let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap(); + assert!( + ledger["records"] + .as_object() + .is_none_or(|records| records.is_empty()), + "no redirect record may survive rollback: {ledger}" + ); + } +} + +#[tokio::test] +#[serial] +async fn legacy_installer_major_selects_path_references() { + let _major = MajorGuard::set("11"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + let redirected = read(&lock_path); + let entry = urllib3_entry(&redirected); + assert_eq!( + entry["path"].as_str(), + Some(format!("{HOSTED_URL}#sha256={}", sha256()).as_str()), + "Pipenv 7–11 install `path` references: {redirected}" + ); + assert!(entry.get("file").is_none(), "{entry}"); + assert_eq!(entry["hashes"], serde_json::json!([format!("sha256:{}", sha256())])); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK); +} + +#[tokio::test] +#[serial] +async fn stale_pipfile_lock_does_not_veto_the_requirements_redirect() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project(tmp.path()); + // The Pipfile.lock left behind pins a DIFFERENT package; the project + // installs from requirements.txt. + let stale = LOCK.replace("\"urllib3\"", "\"six\"").replace("==1.26.18", "==1.16.0"); + std::fs::write(tmp.path().join("Pipfile.lock"), &stale).unwrap(); + std::fs::write(tmp.path().join("requirements.txt"), "urllib3==1.26.18\n").unwrap(); + + let code = run(hosted_args(tmp.path(), server.uri(), None)).await; + assert_eq!(code, 0); + let requirements = read(&tmp.path().join("requirements.txt")); + assert!( + requirements.contains(HOSTED_URL), + "requirements.txt must be redirected past a stale Pipfile.lock: {requirements}" + ); + assert_eq!(read(&tmp.path().join("Pipfile.lock")), stale, "the stale lock is left alone"); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&tmp.path().join("requirements.txt")), "urllib3==1.26.18\n"); + assert_eq!(read(&tmp.path().join("Pipfile.lock")), stale); +} + +#[tokio::test] +#[serial] +async fn warm_venv_with_the_upstream_release_is_not_attested() { + let _major = MajorGuard::set("2026"); + let server = MockServer::start().await; + mock_api(&server).await; + let tmp = tempfile::tempdir().unwrap(); + write_project_with_upstream_install(tmp.path()); + let lock_path = tmp.path().join("Pipfile.lock"); + let vex_path = tmp.path().join("out.vex.json"); + + // The lock is rewritten, but the installed release is the UPSTREAM one + // Pipenv will not reinstall: the stale purl is kept out of the same-run + // attestation (`redirect_pipenv_stale_install`), so nothing can be + // attested and the embedded-VEX contract fails the command. + let code = run(hosted_args(tmp.path(), server.uri(), Some(&vex_path))).await; + let redirected = read(&lock_path); + assert!(redirected.contains(HOSTED_URL), "the lock is still repointed: {redirected}"); + let attested = vex_path + .exists() + .then(|| serde_json::from_str::(&read(&vex_path)).unwrap()) + .and_then(|v| v["statements"].as_array().map(Vec::len)) + .unwrap_or(0); + assert_eq!(attested, 0, "a stale install must not be attested from the ledger"); + assert_ne!(code, 0, "nothing to attest fails the embedded-VEX run"); + assert_eq!( + std::fs::read(site_packages(tmp.path()).join("urllib3").join("response.py")).unwrap(), + UPSTREAM, + "the probe is read-only" + ); + + roll_back(tmp.path(), server.uri()).await; + assert_eq!(read(&lock_path), LOCK); +} diff --git a/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile new file mode 100644 index 00000000..8a12e2fc --- /dev/null +++ b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile @@ -0,0 +1,9 @@ +[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +urllib3 = "==1.26.18" + +[dev-packages] diff --git a/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock new file mode 100644 index 00000000..d6f38a9d --- /dev/null +++ b/crates/socket-patch-core/tests/fixtures/pipenv/2026.8.0/Pipfile.lock @@ -0,0 +1,28 @@ +{ + "_meta": { + "hash": { + "sha256": "b6b240f36bc7ccbb0c915e475181b938fc5ceaf4808b3e1c2f1381a76c7426f8" + }, + "pipfile-spec": 6, + "requires": {}, + "sources": [ + { + "name": "pypi", + "url": "https://pypi.org/simple", + "verify_ssl": true + } + ] + }, + "default": { + "urllib3": { + "hashes": [ + "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07", + "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0" + ], + "index": "pypi", + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "version": "==1.26.18" + } + }, + "develop": {} +} From 106929a180b7730e3751cd7d4cfc765ffd98ceb0 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:50:17 -0400 Subject: [PATCH 12/27] fix(pipenv): retire vendored records whose lock entry a relock regenerated MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `vendor --revert` / `rollback` treated a relocked Pipfile.lock entry as drift when the regenerated registry entry differed from the recorded original — Pipenv 2022.12.19 writes a different hash list; 2026 reproduces the original byte for byte and already converged — so the rollback exited 1 (`partial_failure`), kept the orphaned wheel dir and held the ledger entry forever for a reference nothing pointed at (measured in the matrix). A live entry that is registry-shaped (no `file`/`path`) for a rewritten record with a recorded original now retires the record with `vendor_lock_entry_relocked`: the artifact is removed, the ledger entry dropped, the user's fresh resolution stands. A foreign `file`/`path` reference is still drift and still keeps both, and the destructive `Added` arm keeps its deep-equality gate. Co-Authored-By: Claude Fable 5.1 --- crates/socket-patch-core/src/vendor/pypi.rs | 83 +++++++++++++++++++ .../src/vendor/pypi_pipenv.rs | 24 ++++++ 2 files changed, 107 insertions(+) diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index 24743723..119b8fd3 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -3615,6 +3615,89 @@ wheels = [ } "#; + /// A relock regenerated the wired entry to a registry reference whose + /// hash list differs from the recorded original (Pipenv 2022.12.19 does + /// exactly this; 2026 reproduces the original and converges silently): + /// the vendored reference is gone, so the revert must RETIRE the record + /// — success, no drift-keep, artifact removed — instead of keeping the + /// uuid dir and ledger entry forever for a reference nothing points at. + /// A live entry that still carries a foreign `file` reference is drift. + #[tokio::test] + async fn pipenv_relocked_registry_entry_retires_instead_of_keeping() { + use crate::vendor::pypi_pipenv::{load_pipenv_project, wire_pipenv}; + let tmp = tempfile::tempdir().unwrap(); + let root = tmp.path(); + tokio::fs::write(root.join("Pipfile.lock"), PIPENV_REGISTRY_LOCK) + .await + .unwrap(); + let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl"); + let p = load_pipenv_project(root).await.unwrap(); + let (wiring, _meta) = wire_pipenv(&p, root, "six", &rel_wheel, &"0".repeat(64), UUID) + .await + .unwrap(); + let uuid_dir = root.join(format!(".socket/vendor/pypi/{UUID}")); + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + let wheel = uuid_dir.join("six-1.16.0-py2.py3-none-any.whl"); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + + // Simulate the relock: registry shape again, but a DIFFERENT hash + // list than the recorded original. + let text = tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(); + let mut live: serde_json::Value = serde_json::from_str(&text).unwrap(); + live["default"]["six"] = serde_json::json!({ + "hashes": ["sha256:relocked-a", "sha256:relocked-b"], + "index": "pypi", + "version": "==1.16.0" + }); + let relocked = serde_json::to_string_pretty(&live).unwrap(); + tokio::fs::write(root.join("Pipfile.lock"), &relocked) + .await + .unwrap(); + + let entry = revert_entry("pipenv", &rel_wheel, wiring.clone()); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!( + outcome + .warnings + .iter() + .any(|w| w.code == "vendor_lock_entry_relocked"), + "{:?}", + outcome.warnings + ); + assert!( + !outcome.drift_skipped() && !outcome.kept_artifact, + "a relocked entry is not drift: {:?}", + outcome.warnings + ); + assert!(!wheel.exists(), "the orphaned vendored wheel is removed"); + assert_eq!( + tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(), + relocked, + "the user's relocked entry stands" + ); + + // Foreign file reference → still drift, still kept. + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + live["default"]["six"] = serde_json::json!({"file": "./forks/six.whl"}); + tokio::fs::write( + root.join("Pipfile.lock"), + serde_json::to_string_pretty(&live).unwrap(), + ) + .await + .unwrap(); + let entry = revert_entry("pipenv", &rel_wheel, wiring); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!(outcome.drift_skipped() && outcome.kept_artifact, "{:?}", outcome.warnings); + assert!(wheel.is_file()); + } + /// BUG GUARD (missing drift-keep gate — the npm-family RevertOutcome /// contract, residual #131): a drift-skipped pipenv revert leaves the /// vendor-pointing entry in Pipfile.lock, so deleting the uuid dir diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index 37f978a6..3320ed93 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -452,6 +452,30 @@ pub(super) async fn revert_pipenv( continue; }; if live != new_value { + // RELOCKED (not drift): `pipenv lock` / `update` regenerated the + // entry to registry shape with a different hash list or key set + // than the recorded original (Pipenv 2022 does; 2026 reproduces + // the original byte for byte and converges above). The vendored + // reference is already gone and the user's fresh resolution + // stands, so the record retires — keeping the artifact dir and + // ledger entry forever would be the drift-keep for a reference + // nothing points at any more. A live entry that still carries a + // `file`/`path` reference we did not write IS drift. + let registry_shaped = live + .as_object() + .is_some_and(|object| !object.contains_key("file") && !object.contains_key("path")); + let rewritten_with_original = + rec.action == WiringAction::Rewritten && rec.original.is_some(); + if registry_shaped && rewritten_with_original { + warnings.push(VendorWarning::new( + "vendor_lock_entry_relocked", + format!( + "{LOCK_FILE} entry for {:?} was regenerated to a registry reference by a relock; the vendored reference is already gone, so the record is retired", + rec.key + ), + )); + continue; + } warnings.push(drifted()); continue; } From 04ba777650dc8ebd6e90b502d30b37992d1355b1 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:51:30 -0400 Subject: [PATCH 13/27] test(pipenv): per-release live matrix harness for hosted, vendored and agent mode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit scripts/backtest-pipenv.py drives the real CLI and the last stable release of every published Pipenv major (0.2.8 … 2026.8.0; the ten pre-2018 releases run inside python:3.6.15-slim through a host-side pipenv wrapper so the CLI's installer probe sees them) through hosted, vendored, agent and out-of-tree agent mode over the depscan capture shapes (direct, dev, category, marker, marker-excluded, extras, transitive, crlf) and four CLI invocations (in-dir, --cwd, nested --cwd, symlinked cwd). Beyond the depscan harness it checks the lock-only fresh checkout, --dry-run parity, the warm-venv stale-install warning, whether a warm venv is reinstalled (recorded), the relock → rollback retirement, fresh-clone installs, tamper rejection, `pipenv verify`/ `requirements`, vex and byte-exact rollback, and it requires the bare agent scan to see Pipenv's out-of-tree venv. Python pins are overridable (BACKTEST_PY38 / BACKTEST_PY312) for containers without the exact patch releases. Co-Authored-By: Claude Fable 5.1 --- scripts/backtest-pipenv.py | 1172 ++++++++++++++++++++++++++++++++++++ 1 file changed, 1172 insertions(+) create mode 100755 scripts/backtest-pipenv.py diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py new file mode 100755 index 00000000..b8a3c753 --- /dev/null +++ b/scripts/backtest-pipenv.py @@ -0,0 +1,1172 @@ +#!/usr/bin/env python3 +"""Drive the real socket-patch CLI and real Pipenv releases through hosted, +vendored and agent mode on native Pipfile.lock generations. + +For the last stable release of every published Pipenv major the harness +bootstraps that exact release (uv venv for 2018+, a `python:3.6.15-slim` +Docker venv for the pre-2018 majors that no longer run on modern Pythons), +generates a native lock for a one-dependency project (urllib3 1.26.18, which +has a public free-tier Socket patch), then for each mode: + + hosted scan --mode hosted -> pipenv install -> installed bytes == patch + vendored scan --mode vendored -> pipenv install -> installed bytes == patch + agent pipenv install -> scan --mode agent -> installed bytes == patch + agent-oot same as agent, but with Pipenv's DEFAULT out-of-tree virtualenv + (WORKON_HOME) instead of an in-project .venv + +and checks --dry-run parity, idempotent re-scans, an untouched Pipfile, the +lock-driven install of a FRESH clone of the committed state, whether a WARM +venv (upstream urllib3 already installed) gets the patched wheel, tampered +hashes, `pipenv verify`, what `pipenv lock` does to the patched entry, `vex`, +and `rollback` restoring every byte. Pre-2018 releases are expected to be +REFUSED (old lock spec for 0–6, vendored for 7–11) without touching the lock. + +Shapes mirror the depscan capture harness: direct, dev, category (2022+), +marker, marker-excluded, extras, transitive, crlf. Invocations vary how the +CLI is pointed at the project: in-dir (cwd = project, no --cwd), cwd-flag +(run from the output root with --cwd), subdir (project nested two levels down, +--cwd relative), symlink (cwd = a symlink to the project). + +Needs network (PyPI + patch.socket.dev), uv, Docker (pre-2018 majors only) and +no Socket token. + + scripts/backtest-pipenv.py --socket-patch target/debug/socket-patch \ + --socket-patch-revision $(git rev-parse --short HEAD) --output /tmp/pipenv-compat + scripts/backtest-pipenv.py --render-doc-table /tmp/pipenv-compat/summary.json +""" + +import argparse +import concurrent.futures +import hashlib +import json +import os +import re +import shlex +import shutil +import signal +import subprocess +import sys +import threading +import traceback +import uuid as uuid_mod +from datetime import datetime, timezone +from pathlib import Path + +VERSIONS = [ + "0.2.8", + "3.6.2", + "4.1.4", + "5.4.2", + "6.2.9", + "7.9.10", + "8.3.2", + "9.1.0", + "10.1.2", + "11.10.4", + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0", +] +MODES = ["hosted", "vendored", "agent", "agent-oot"] +SHAPES = ["direct", "dev", "category", "marker", "marker-excluded", "extras", "transitive", "crlf"] +INVOCATIONS = ["in-dir", "cwd-flag", "subdir", "symlink"] +LEGACY_IMAGE = "python:3.6.15-slim" + +PROJECT = """[[source]] +url = "https://pypi.org/simple" +verify_ssl = true +name = "pypi" + +[packages] +urllib3 = "==1.26.18" + +[dev-packages] +""" +# Pins for the transitive shape (urllib3 reached through requests). +TRANSITIVE_MODERN = { + "requests": "2.31.0", + "charset-normalizer": "3.3.2", + "idna": "3.6", + "certifi": "2024.2.2", + "urllib3": "1.26.18", +} +TRANSITIVE_LEGACY = { + "requests": "2.27.1", + "charset-normalizer": "2.0.12", + "idna": "3.6", + "certifi": "2024.2.2", + "urllib3": "1.26.18", +} +ORACLE = """import hashlib,json,pathlib,sys,sysconfig +root=pathlib.Path(sysconfig.get_paths()['purelib']) +out={} +for name in json.loads(sys.argv[1]): + p=root/name + if p.is_file(): + d=p.read_bytes(); out[name]=hashlib.sha256(('blob %d\\0'%len(d)).encode()+d).hexdigest() + else: + out[name]=None +print(json.dumps(out)) +""" +ABSENT = "import importlib.util,sys; sys.exit(0 if importlib.util.find_spec('urllib3') is None else 1)" +PATCH_UUID = "e828efa5-5c6d-43f3-9909-03f5ac232b98" +PURL_BASE = "pkg:pypi/urllib3@1.26.18" + +LEGACY_TOOL_PACKAGES = [ + "pip==9.0.3", + "pip-tools==1.11.0", + "setuptools==44.1.1", + "wheel==0.37.1", + "virtualenv==16.7.12", + "click==6.7", + "requests==2.27.1", + "pexpect==4.2.1", + "delegator.py==0.0.14", +] +LEGACY_VENV_PACKAGES = ["pip==9.0.3", "setuptools==44.1.1", "wheel==0.37.1"] + + +def major_of(version): + return int(version.split(".")[0]) + + +def vtuple(v): + return tuple(int(x) for x in v.split(".")) + + +def is_legacy(version): + return major_of(version) < 2018 + + +def save(path, data): + path.write_text(json.dumps(data, indent=2, sort_keys=True) + "\n") + + +DEFAULT_TIMEOUT = int(os.environ.get("BACKTEST_TIMEOUT", "900")) + + +class Run: + """Run a command in its own process group, capture output, write a log. + + A timeout kills the whole group (Docker clients, pip subprocesses, …). + """ + + def __init__(self, cmd, cwd, env, log, timeout=None, container=None): + timeout = timeout or DEFAULT_TIMEOUT + self.cmd = [str(c) for c in cmd] + try: + with subprocess.Popen( + self.cmd, + cwd=str(cwd), + env=env, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + start_new_session=True, + ) as p: + try: + self.out, self.err = p.communicate(timeout=timeout) + self.rc = p.returncode + except subprocess.TimeoutExpired: + try: + os.killpg(p.pid, signal.SIGKILL) + except ProcessLookupError: + pass + out, err = p.communicate() + self.rc, self.out, self.err = 124, out or "", (err or "") + f"\nTIMEOUT after {timeout}s" + except OSError as e: + self.rc, self.out, self.err = 127, "", str(e) + finally: + if container: + subprocess.run(["docker", "rm", "-f", container], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=60) + Path(log).write_text( + "$ " + " ".join(shlex.quote(c) for c in self.cmd) + f"\n# cwd {cwd}\n# exit {self.rc}\n--- stdout\n{self.out}\n--- stderr\n{self.err}" + ) + + def ok(self): + return self.rc == 0 + + def json(self): + i = self.out.find("{") + if i < 0: + raise RuntimeError("no JSON in output: " + (self.out + self.err)[-2000:]) + return json.loads(self.out[i:]) + + def json_or_empty(self): + try: + return self.json() + except Exception: + return {} + + def tail(self, n=400): + return (self.out + self.err)[-n:] + + +def require(r, what): + if not r.ok(): + raise RuntimeError(f"{what} failed (exit {r.rc}):\n{(r.out + r.err)[-4000:]}") + return r + + +def base_env(): + env = { + k: v + for k, v in os.environ.items() + if not k.startswith(("PYTHON", "PIP_", "PIPENV_", "SOCKET_", "UV_", "WORKON_HOME")) and k != "VIRTUAL_ENV" + } + env.update( + SOCKET_NO_CONFIG="1", + SOCKET_NO_UPDATE_CHECK="1", + SOCKET_TELEMETRY_DISABLED="1", + PIP_CONFIG_FILE=os.devnull, + PIP_DISABLE_PIP_VERSION_CHECK="1", + PIPENV_YES="1", + PIPENV_NOSPIN="1", + PIPENV_IGNORE_VIRTUALENVS="1", + PYTHONDONTWRITEBYTECODE="1", + ) + return env + + +def main(): + ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + ap.add_argument("--socket-patch", type=Path, help="socket-patch CLI binary") + ap.add_argument("--socket-patch-revision", help="git revision the binary was built from (recorded)") + ap.add_argument("--output", type=Path) + ap.add_argument("--tools-root", type=Path, help="where Pipenv releases are (or get) bootstrapped; default /tools-root") + ap.add_argument("--versions", nargs="+", default=VERSIONS) + ap.add_argument("--modes", nargs="+", default=MODES, choices=MODES) + ap.add_argument("--shapes", nargs="+", default=["direct"], choices=SHAPES) + ap.add_argument("--invocations", default="in-dir", help="comma-separated subset of " + ",".join(INVOCATIONS) + " (direct shape only)") + ap.add_argument("--jobs", type=int, default=4) + ap.add_argument("--render-doc-table", type=Path, metavar="SUMMARY_JSON") + args = ap.parse_args() + if args.render_doc_table: + summary = json.loads(args.render_doc_table.read_text()) + print(render_doc_table(summary)) + print() + print(render_table(summary)) + return + if not (args.socket_patch and args.socket_patch_revision and args.output): + ap.error("--socket-patch, --socket-patch-revision and --output are required") + invocations = [i.strip() for i in args.invocations.split(",") if i.strip()] + for inv in invocations: + if inv not in INVOCATIONS: + ap.error(f"unknown invocation {inv!r}") + + root = args.output.resolve() + root.mkdir(parents=True, exist_ok=True) + tools_root = (args.tools_root or (root / "tools-root")).resolve() + tools_root.mkdir(parents=True, exist_ok=True) + cli_path = args.socket_patch.resolve() + env = base_env() + provenance = { + "capturedAt": datetime.now(timezone.utc).isoformat(), + "cliRevision": args.socket_patch_revision, + "cliSha256": hashlib.sha256(cli_path.read_bytes()).hexdigest(), + "pipenvVersions": args.versions, + "modes": args.modes, + "shapes": args.shapes, + "invocations": invocations, + "host": os.uname().sysname + " " + os.uname().machine, + "legacyImage": LEGACY_IMAGE, + } + save(root / "provenance.json", provenance) + + log_lock = threading.Lock() + + def say(*a): + with log_lock: + print(*a, flush=True) + + # ------------------------------------------------------------------ docker + def docker_cmd(cwd, extra_env, workdir=None, name=None): + """`docker run` prefix that mirrors ROOTs + cwd at identical paths.""" + mounts = [] + seen = set() + for path in [tools_root, root, Path(cwd)]: + p = str(path) + if not any(p == s or p.startswith(s.rstrip("/") + "/") for s in seen): + mounts += ["-v", f"{p}:{p}"] + seen.add(p) + cmd = ["docker", "run", "--rm", "--name", name or ("pipenv-bt-" + uuid_mod.uuid4().hex[:12]), *mounts, "-w", str(workdir or cwd)] + for k, v in extra_env.items(): + cmd += ["-e", f"{k}={v}"] + cmd.append(LEGACY_IMAGE) + return cmd + + def legacy_run(cmd, cwd, extra_env, log, timeout=None, workdir=None): + name = "pipenv-bt-" + uuid_mod.uuid4().hex[:12] + full = docker_cmd(cwd, extra_env, workdir=workdir, name=name) + [str(c) for c in cmd] + return Run(full, cwd, env, log, timeout=timeout, container=name) + + # ------------------------------------------------------------------ tools + def tool_dir(version): + return tools_root / ("legacy-tools" if is_legacy(version) else "tools") / version + + def wrapper_dir(version): + return root / "legacy-bin" / version + + def prepare_tool(version): + tool = tool_dir(version) + legacy = is_legacy(version) + logs = root / "bootstrap-logs" + logs.mkdir(exist_ok=True) + if legacy: + # Host-side `pipenv` that runs the legacy release inside Docker with + # the tool root, the output root and the caller's cwd bind-mounted at + # identical paths — the CLI's `pipenv --version` probe and the + # harness's own pipenv invocations both go through it. + wd = wrapper_dir(version) + wd.mkdir(parents=True, exist_ok=True) + mounts = " ".join(f"-v {shlex.quote(str(p))}:{shlex.quote(str(p))}" for p in [tools_root, root]) + (wd / "pipenv").write_text( + "#!/bin/sh\n" + f"# Pipenv {version} inside {LEGACY_IMAGE}; tool root, output root and $PWD bind-mounted\n" + f'exec docker run --rm -i {mounts} -v "$PWD":"$PWD" -w "$PWD" \\\n' + f" -e PATH={shlex.quote(str(tool / 'bin'))}:/usr/local/bin:/usr/bin:/bin \\\n" + " -e PIPENV_VENV_IN_PROJECT -e PIPENV_YES=1 -e PIPENV_NOSPIN=1 -e PIP_DISABLE_PIP_VERSION_CHECK=1 -e WORKON_HOME -e PIPENV_PYTHON \\\n" + f" {LEGACY_IMAGE} {shlex.quote(str(tool / 'bin/pipenv'))} \"$@\"\n" + ) + (wd / "pipenv").chmod(0o755) + if not (tool / "bin/pipenv").exists(): + tool.parent.mkdir(parents=True, exist_ok=True) + require(legacy_run(["python", "-m", "venv", tool], tools_root, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, logs / f"{version}-venv.log"), f"legacy venv {version}") + require( + legacy_run([tool / "bin/python", "-m", "pip", "install", f"pipenv=={version}", *LEGACY_TOOL_PACKAGES], tools_root, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, logs / f"{version}-install.log"), + f"legacy pipenv {version} install", + ) + elif not (tool / "bin/pipenv").exists(): + major = major_of(version) + py = os.environ.get("BACKTEST_PY38", "3.8.20") if major <= 2022 else os.environ.get("BACKTEST_PY312", "3.12.13") + require(Run(["uv", "venv", "-q", "--python", py, tool], root, env, logs / f"{version}-venv.log"), "uv venv") + pkgs = [f"pipenv=={version}", "pip==24.0", "setuptools==69.5.1" if major >= 2023 else "setuptools==57.5.0"] + require(Run(["uv", "pip", "install", "-q", "--python", tool / "bin/python", *pkgs], root, env, logs / f"{version}-install.log"), "pipenv bootstrap") + return tool + + # ------------------------------------------------------------- pipenv env + def pipenv_shim_dir(version, tool): + """A PATH entry exposing only `pipenv` (a user's PATH has pipenv, not the + tool venv's python3 — the CLI's global fallback must not crawl that venv).""" + if is_legacy(version): + return wrapper_dir(version) + d = root / "pipenv-bin" / version + d.mkdir(parents=True, exist_ok=True) + link = d / "pipenv" + if not link.exists(): + link.symlink_to(tool / "bin/pipenv") + return d + + def pipenv_env(version, tool, in_project=True, workon_home=None): + e = dict(env) + e["PATH"] = str(pipenv_shim_dir(version, tool)) + os.pathsep + e.get("PATH", "") + e["PIPENV_PYTHON"] = str(tool / "bin/python") + if in_project: + e["PIPENV_VENV_IN_PROJECT"] = "1" + if workon_home is not None: + e["WORKON_HOME"] = str(workon_home) + return e + + def pipenv_bin(version, tool): + return (wrapper_dir(version) / "pipenv") if is_legacy(version) else (tool / "bin/pipenv") + + def run_pipenv(version, tool, args_, cwd, penv, log, timeout=None): + """Run `pipenv ` for `version` in `cwd` (Docker for legacy).""" + if is_legacy(version): + extra = {k: v for k, v in penv.items() if k.startswith(("PIP", "WORKON_HOME"))} + extra["PATH"] = f"{tool / 'bin'}:/usr/local/bin:/usr/bin:/bin" + return legacy_run([tool / "bin/pipenv", *args_], cwd, extra, log, timeout=timeout) + return Run([tool / "bin/pipenv", *args_], cwd, penv, log, timeout=timeout) + + def run_python(version, python, args_, cwd, penv, log, timeout=None): + """Run the PROJECT interpreter (Docker for legacy: linux venv).""" + if is_legacy(version): + extra = {k: v for k, v in penv.items() if k.startswith(("PIP", "WORKON_HOME"))} + return legacy_run([python, *args_], cwd, extra, log, timeout=timeout) + return Run([python, *args_], cwd, penv, log, timeout=timeout) + + def make_venv(version, tool, venv, cwd, log, packages=(), native=False): + """Create the project venv. + + Modern: uv venv on the tool's interpreter + pip 24 (+ packages). + Legacy: `native=True` builds the Docker (linux, python 3.6) venv that + Pipenv itself installs into; otherwise a host uv venv (python 3.8) so + the CLI can crawl an installed urllib3 the way the depscan captures did. + """ + if venv.exists(): + shutil.rmtree(venv) + if is_legacy(version) and native: + venv.mkdir(parents=True) + require(legacy_run(["/usr/local/bin/python", "-m", "venv", venv], cwd, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, log), "docker venv") + require(legacy_run([venv / "bin/python", "-m", "pip", "install", *LEGACY_VENV_PACKAGES, *packages], cwd, {"PIP_DISABLE_PIP_VERSION_CHECK": "1"}, str(log) + ".pip"), "docker venv bootstrap") + return + py = os.environ.get("BACKTEST_PY38", "3.8.20") if is_legacy(version) else tool / "bin/python" + require(Run(["uv", "venv", "-q", "--python", py, venv], cwd, env, log), "uv venv") + pkgs = ["pip==24.0", "setuptools==69.5.1", *packages] + require(Run(["uv", "pip", "install", "-q", "--python", venv / "bin/python", *pkgs], cwd, env, str(log) + ".pip"), "venv bootstrap") + + def uninstall_urllib3(version, python, cwd, penv, log): + if is_legacy(version): + r = run_python(version, python, ["-m", "pip", "uninstall", "-y", "urllib3"], cwd, penv, log) + else: + r = Run(["uv", "pip", "uninstall", "-q", "--python", python, "urllib3"], cwd, env, log) + if not r.ok(): + # Tolerate "not installed" as long as the package is truly absent. + require(run_python(version, python, ["-c", ABSENT], cwd, penv, str(log) + ".absent"), "urllib3 uninstall") + + def oracle(version, python, names, cwd, penv, log): + r = run_python(version, python, ["-c", ORACLE, json.dumps(list(names))], cwd, penv, log) + return json.loads(r.out.strip().splitlines()[-1]) if r.ok() and r.out.strip() else {} + + def urllib3_absent(version, python, cwd, penv, log): + return run_python(version, python, ["-c", ABSENT], cwd, penv, log).ok() + + def install_args(version, shape, deploy=True): + # `--ignore-pipfile` arrives with Pipenv 3; `--deploy` with Pipenv 9. + a = ["install"] + (["--ignore-pipfile"] if major_of(version) >= 3 else []) + if deploy and major_of(version) >= 9: + a.append("--deploy") + if shape == "dev": + a.append("--dev") + if shape == "category": + a += ["--categories", "tests"] + return a + + def sync_args(version, shape): + if major_of(version) < 2018: + return None + a = ["sync"] + if shape == "dev": + a.append("--dev") + if shape == "category": + a += ["--categories", "tests"] + return a + + # ------------------------------------------------------------ fixtures + def pipfile_text(version, shape): + text = PROJECT + if shape == "dev": + text = PROJECT.replace('urllib3 = "==1.26.18"\n', "").replace("[dev-packages]", '[dev-packages]\nurllib3 = "==1.26.18"') + elif shape == "category": + text = PROJECT.replace("[packages]", "[tests]") + elif shape in ("marker", "marker-excluded", "extras"): + field = 'extras = ["socks"]' if shape == "extras" else 'markers = "python_version ' + (">" if shape == "marker-excluded" else "<") + " '4'\"" + text = PROJECT.replace('"==1.26.18"', '{version="==1.26.18", ' + field + "}") + elif shape == "transitive": + pins = TRANSITIVE_LEGACY if is_legacy(version) else TRANSITIVE_MODERN + text = PROJECT.split("[packages]")[0] + "[packages]\n" + "".join(f'{n} = "=={v}"\n' for n, v in pins.items()) + "\n[dev-packages]\n" + return text + + def content_hash(version, tool, project, penv, log): + code = ( + "import pipenv,pipfile; print(pipfile.load('Pipfile').hash)" + if is_legacy(version) + else "from pipenv.project import Project; p=Project(); print(p.calculate_pipfile_hash() if hasattr(p,'calculate_pipfile_hash') else p.pipfile.calculate_hash())" + ) + r = require(run_python(version, tool / "bin/python", ["-c", code], project, penv, log), "content hash") + return r.out.strip().splitlines()[-1] + + def native_lock(version, tool, shape): + """Generate (once) the native Pipfile.lock for version/shape.""" + original = root / "original" / version / shape + if (original / "Pipfile.lock").exists(): + return original + original.mkdir(parents=True, exist_ok=True) + (original / "Pipfile").write_text(pipfile_text(version, shape)) + penv = pipenv_env(version, tool) + # Legacy Pipenv resolves through the project venv's pip-tools; give it one. + make_venv(version, tool, original / ".venv", original, original / "venv.log", native=True) + require(run_pipenv(version, tool, ["lock"], original, penv, original / "generation.log"), f"pipenv {version} lock ({shape})") + if shape == "transitive": + # Lock with every pin (so urllib3 is pinned to 1.26.18), then shrink + # the Pipfile to `requests` only and stamp its content hash so + # `--deploy` still accepts the lock. + pins = TRANSITIVE_LEGACY if is_legacy(version) else TRANSITIVE_MODERN + (original / "Pipfile").write_text(PROJECT.replace('urllib3 = "==1.26.18"', 'requests = "==' + pins["requests"] + '"')) + hashed = content_hash(version, tool, original, penv, original / "content-hash.log") + lock = json.loads((original / "Pipfile.lock").read_text()) + lock["_meta"]["hash"]["sha256"] = hashed + (original / "Pipfile.lock").write_text(json.dumps(lock, indent=4, sort_keys=True) + "\n") + if shape == "crlf": + for name in ["Pipfile", "Pipfile.lock"]: + p = original / name + p.write_bytes(p.read_text().replace("\r\n", "\n").replace("\n", "\r\n").encode()) + shutil.rmtree(original / ".venv", ignore_errors=True) + return original + + # --------------------------------------------------------------- the CLI + def cli_invocation(case, project, invocation): + """(cwd, extra args) for pointing the CLI at `project`.""" + if invocation == "in-dir": + return project, [] + if invocation == "cwd-flag": + return root, ["--cwd", str(project)] + if invocation == "subdir": + # project lives at /nested/app; run from /nested + return project.parent, ["--cwd", project.name] + if invocation == "symlink": + link = case / "link" + if not link.is_symlink(): + link.symlink_to(project, target_is_directory=True) + return link, ["--cwd", str(link)] + raise ValueError(invocation) + + def applied_count(mode, envelope): + if mode == "hosted": + return envelope.get("redirect", {}).get("redirected", 0) + if mode == "vendored": + return envelope.get("vendor", {}).get("summary", {}).get("applied", 0) + return envelope.get("apply", {}).get("applied", 0) + + def planned_count(mode, envelope): + """What a --dry-run envelope says WOULD happen (no summary is written).""" + if mode == "hosted": + return envelope.get("redirect", {}).get("redirected", 0) + if mode == "vendored": + v = envelope.get("vendor", {}) + if v.get("dryRun"): + return sum(1 for p in v.get("patches", []) if p.get("action") == "would_vendor") + return v.get("summary", {}).get("applied", 0) + a = envelope.get("apply", {}) + return a.get("added", 0) + a.get("updated", 0) if a.get("dryRun") else a.get("applied", 0) + + def envelope_warnings(mode, envelope): + if mode == "hosted": + return envelope.get("redirect", {}).get("warnings", []) + if mode == "vendored": + return envelope.get("vendor", {}).get("events", []) + return envelope.get("apply", {}).get("patches", []) + + def record_hashes(project, mode): + if mode == "hosted": + recs = json.loads((project / ".socket/vendor/redirect-state.json").read_text())["records"] + else: + recs = json.loads((project / ".socket/manifest.json").read_text())["patches"] + rec = next(iter(recs.values())) + return ( + {n: i["afterHash"] for n, i in rec["files"].items()}, + {n: i["beforeHash"] for n, i in rec["files"].items() if i.get("beforeHash")}, + rec.get("uuid"), + ) + + def lock_entries(text): + """Every (section, key, entry) for urllib3 in a Pipfile.lock text.""" + try: + lock = json.loads(text) + except Exception: + return [] + out = [] + for section, entries in lock.items(): + if section == "_meta" or not isinstance(entries, dict): + continue + for key, entry in entries.items(): + if key.lower().replace("_", "-") == "urllib3": + out.append((section, key, entry)) + return out + + def source_keys(text): + return sorted({k for _, _, e in lock_entries(text) if isinstance(e, dict) for k in ("file", "path") if k in e}) + + # -------------------------------------------------------------- one case + def backtest(job): + """Run one case; persist its row (or error) as /result.json.""" + version, shape, mode, invocation = job + suffix = "" if invocation == "in-dir" else "-" + invocation + case = root / "captures" / f"{version}-{shape}-{mode}{suffix}" + try: + row = backtest_case(job) + except Exception as e: + case.mkdir(parents=True, exist_ok=True) + save(case / "result.json", {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "passed": False, "error": str(e)[-3000:], "trace": traceback.format_exc()[-2000:]}) + raise + save(case / "result.json", row) + return row + + def backtest_case(job): + version, shape, mode, invocation = job + legacy = is_legacy(version) + major = major_of(version) + tool = tool_dir(version) + suffix = "" if invocation == "in-dir" else "-" + invocation + case = root / "captures" / f"{version}-{shape}-{mode}{suffix}" + if case.exists(): + shutil.rmtree(case) + case.mkdir(parents=True) + original = native_lock(version, tool, shape) + project = (case / "nested" / "app") if invocation == "subdir" else (case / "project") + project.mkdir(parents=True) + for name in ["Pipfile", "Pipfile.lock"]: + shutil.copyfile(original / name, project / name) + pristine_lock = (project / "Pipfile.lock").read_bytes() + pristine_pipfile = (project / "Pipfile").read_bytes() + spec = json.loads(pristine_lock.decode()).get("_meta", {}).get("pipfile-spec") + row = {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "pipfileSpec": spec, "supported": None, "expected": None, "checks": {}, "info": {}, "passed": None} + checks, info = row["checks"], row["info"] + + def check(name, value, note=None): + checks[name] = bool(value) + if note is not None: + info[name] = note + return bool(value) + + cwd, cli_args = cli_invocation(case, project, invocation) + + def cli_run(penv_, *rest, log): + return Run([cli_bin, *rest, *cli_args, "--json", "--yes", "--no-telemetry"], cwd, penv_, case / log) + + cli_bin = cli_path + venv = project / ".venv" + python = venv / "bin/python" + penv = pipenv_env(version, tool) + + # --------------------------------------------------------- agent-oot + if mode == "agent-oot": + if major < 3: + row["supported"] = False + row["expected"] = "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover" + row["passed"] = True + return row + workon = case / "venvs" + workon.mkdir() + oenv = pipenv_env(version, tool, in_project=False, workon_home=workon) + # Pipenv creates the venv itself here; pin its interpreter explicitly + # (2022.12.19 ignored PIPENV_PYTHON and picked the newest python3 on + # PATH, whose pkgutil no longer suits its vendored pip). + first = install_args(version, shape) + ([] if legacy else ["--python", str(tool / "bin/python")]) + require(run_pipenv(version, tool, first, project, oenv, case / "install-upstream.log"), "pipenv install (out-of-tree)") + vp = run_pipenv(version, tool, ["--venv"], project, oenv, case / "venv-path.log") + candidates = [Path(line.strip()) for line in vp.out.splitlines() if line.strip().startswith("/")] + oot_venv = next((c for c in candidates if (c / "bin/python").exists()), None) + if oot_venv is None: + found = [d for d in workon.iterdir() if (d / "bin/python").exists()] + oot_venv = found[0] if found else None + info["ootVenv"] = str(oot_venv) + info["ootVenvNameMatchesWorkon"] = bool(oot_venv) and oot_venv.parent == workon + if not oot_venv: + raise RuntimeError("could not locate Pipenv's out-of-tree venv: " + vp.out + vp.err) + opython = oot_venv / "bin/python" + # 1. BARE scan: the CLI inherits Pipenv's configuration (WORKON_HOME) + # but not an activation (VIRTUAL_ENV) — exactly what `pipenv run` adds. + bare_env = dict(env) + bare_env["WORKON_HOME"] = str(workon) + bare_env["PATH"] = oenv["PATH"] + r1 = cli_run(bare_env, "scan", "--mode", "agent", "--dry-run", log="scan-bare-dryrun.log") + e1 = r1.json_or_empty() + pkgs = e1.get("packages") or [] + u3 = [p for p in pkgs if "urllib3" in (p.get("purl") or "")] + found = e1.get("apply", {}).get("found", 0) + # The envelope names packages but not where they live. A crawler that + # found the out-of-tree venv scans exactly its distributions; the + # project-marker fallback scans `python3`-on-PATH instead (here the + # Pipenv tool venv, which may itself carry an urllib3 1.26.18). + cnt = run_python(version, opython, ["-c", "import os,sysconfig; print(sum(1 for d in os.listdir(sysconfig.get_paths()['purelib']) if d.endswith(('.dist-info', '.egg-info'))))"], project, oenv, case / "venv-dist-count.log") + venv_dists = int(cnt.out.strip().splitlines()[-1]) if cnt.ok() and cnt.out.strip() else None + scanned = e1.get("scannedPackages") + sees = bool(u3) and found >= 1 and venv_dists is not None and scanned is not None and abs(scanned - venv_dists) <= 2 + info["bareScan"] = {"exit": r1.rc, "scannedPackages": scanned, "venvDistributions": venv_dists, "found": found, "paths": (e1.get("paths") or [])[:10], "urllib3Listed": bool(u3), "foreignInterpreterHit": bool(u3) and found >= 1 and not sees} + check("bareScanSeesPipenvVenv", sees, info["bareScan"]) + # 2. apply: bare when the crawler saw the venv, else the way a user + # would — `pipenv run` (modern; exports VIRTUAL_ENV) or an explicit + # VIRTUAL_ENV (legacy: the CLI is a host binary, pipenv lives in Docker). + bare = bool(sees) + if bare: + info["applyPath"] = "bare" + r2 = cli_run(bare_env, "scan", "--mode", "agent", log="scan-apply.log") + elif legacy: + info["applyPath"] = "VIRTUAL_ENV" + venv_env = dict(bare_env, VIRTUAL_ENV=str(oot_venv)) + r2 = cli_run(venv_env, "scan", "--mode", "agent", log="scan-apply.log") + else: + info["applyPath"] = "pipenv run" + r2 = Run([tool / "bin/pipenv", "run", cli_bin, "scan", "--mode", "agent", *cli_args, "--json", "--yes", "--no-telemetry"], cwd, oenv, case / "scan-apply.log") + e2 = r2.json_or_empty() + check("scanApplied", applied_count("agent", e2) == 1, {"exit": r2.rc, "applied": applied_count("agent", e2), "path": info["applyPath"], "tail": r2.tail(300) if not r2.ok() else None}) + if not checks["scanApplied"]: + row["passed"] = False + return row + after, before, _ = record_hashes(project, "agent") + res = oracle(version, opython, after, project, oenv, case / "oracle-1.log") + check("installedBytesPatched", bool(after) and all(res.get(n) == h for n, h in after.items()), res) + # 3. a repeat install / sync must not revert the in-place patch + ri = run_pipenv(version, tool, install_args(version, shape), project, oenv, case / "install-again.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-2.log") + check("survivesRepeatInstall", ri.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": ri.rc, "oracle": res}) + sa = sync_args(version, shape) + if sa: + rs = run_pipenv(version, tool, sa, project, oenv, case / "sync.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-3.log") + check("survivesSync", rs.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": rs.rc, "oracle": res}) + # 4. rollback the same way the patch was applied + if bare: + rb = cli_run(bare_env, "rollback", log="rollback.log") + elif legacy: + rb = cli_run(dict(bare_env, VIRTUAL_ENV=str(oot_venv)), "rollback", log="rollback.log") + else: + rb = Run([tool / "bin/pipenv", "run", cli_bin, "rollback", *cli_args, "--json", "--yes", "--no-telemetry"], cwd, oenv, case / "rollback.log") + res = oracle(version, opython, after, project, oenv, case / "oracle-rollback.log") + check("rollbackRestoresUpstream", rb.ok() and bool(before) and all(res.get(n) == h for n, h in before.items()), {"exit": rb.rc, "oracle": res}) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + row["supported"] = True + row["passed"] = all(checks.values()) + return row + + # ------------------------------------------------------------- agent + if mode == "agent": + make_venv(version, tool, venv, project, case / "venv.log", native=True) + require(run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install-upstream.log"), "pipenv install (upstream)") + if shape == "marker-excluded": + check("excludedStaysAbsent", urllib3_absent(version, python, project, penv, case / "absence.log")) + r = cli_run(penv, "scan", "--mode", "agent", log="scan.log") + e = r.json_or_empty() + save(case / "cli-output.json", e) + check("nothingApplied", applied_count("agent", e) == 0, {"exit": r.rc, "applied": applied_count("agent", e)}) + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock) + row["supported"] = True + row["expected"] = "marker excludes urllib3: nothing installed, nothing to patch" + row["passed"] = all(checks.values()) + return row + r = cli_run(penv, "scan", "--mode", "agent", log="scan.log") + info["scanExit"] = r.rc + envelope = r.json() + save(case / "cli-output.json", envelope) + applied = applied_count("agent", envelope) + check("appliedExactlyOne", applied == 1, {"applied": applied, "status": envelope.get("status"), "patches": envelope_warnings("agent", envelope)[:4]}) + if not checks["appliedExactlyOne"]: + row["passed"] = False + return row + check("lockUntouched", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + after, before, uuid = record_hashes(project, "agent") + info["uuid"] = uuid + res = oracle(version, python, after, project, penv, case / "oracle-1.log") + check("installedBytesPatched", bool(after) and all(res.get(n) == h for n, h in after.items()), res) + r2 = cli_run(penv, "scan", "--mode", "agent", log="rescan.log") + e2 = r2.json_or_empty() + res = oracle(version, python, after, project, penv, case / "oracle-rescan.log") + check("rescanIdempotent", r2.ok() and all(res.get(n) == h for n, h in after.items()) and (project / "Pipfile.lock").read_bytes() == pristine_lock, {"exit": r2.rc, "applied": applied_count("agent", e2), "status": e2.get("status")}) + ri = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install-again.log") + res = oracle(version, python, after, project, penv, case / "oracle-2.log") + check("survivesRepeatInstall", ri.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": ri.rc, "oracle": res, "tail": ri.tail(300) if not ri.ok() else None}) + sa = sync_args(version, shape) + if sa: + rs = run_pipenv(version, tool, sa, project, penv, case / "sync.log") + res = oracle(version, python, after, project, penv, case / "oracle-3.log") + check("survivesSync", rs.ok() and all(res.get(n) == h for n, h in after.items()), {"exit": rs.rc, "oracle": res, "tail": rs.tail(300) if not rs.ok() else None}) + vx = Run([cli_bin, "vex", "--product", "pkg:pypi/pipenv-backtest-fixture@0.1.0", *cli_args, "--no-telemetry"], cwd, penv, case / "vex.log") + info["vex"] = vex_info(vx) + rb = cli_run(penv, "rollback", log="rollback.log") + erb = rb.json_or_empty() + res = oracle(version, python, after, project, penv, case / "oracle-rollback.log") + check("rollbackExit0", rb.ok(), rb.tail(600) if not rb.ok() else None) + check("rollbackRestoresUpstreamBytes", bool(before) and all(res.get(n) == h for n, h in before.items()), res) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + check("rollbackKeepsLock", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile) + info["rollbackEnvelope"] = {k: erb.get(k) for k in ("status", "rolledBack", "failed", "hosted", "vendoredReverted", "manifest") if k in erb} + row["supported"] = True + row["passed"] = all(checks.values()) + return row + + # ------------------------------------------------- hosted / vendored + # Fresh-clone scenario first: nothing installed, lock only. An EMPTY + # in-project venv keeps the crawl hermetic (the project-marker fallback + # would otherwise walk this machine's global interpreters). + make_venv(version, tool, venv, project, case / "venv-empty.log") + r0 = cli_run(penv, "scan", "--mode", mode, log="scan-lockonly.log") + e0 = r0.json_or_empty() + codes0 = sorted({(w.get("code") or w.get("errorCode")) for w in envelope_warnings(mode, e0) if (w.get("code") or w.get("errorCode"))}) + info["lockOnly"] = {"exit": r0.rc, "applied": applied_count(mode, e0), "lockfileOnlyPackages": e0.get("lockfileOnlyPackages"), "codes": codes0} + check("lockOnlyApplies", applied_count(mode, e0) == 1, info["lockOnly"]) + shutil.rmtree(project / ".socket", ignore_errors=True) + shutil.rmtree(venv, ignore_errors=True) + (project / "Pipfile.lock").write_bytes(pristine_lock) + (project / "Pipfile").write_bytes(pristine_pipfile) + + # The CLI phase runs against a venv with upstream urllib3 installed + # (vendored needs an installed package; hosted does not care). + make_venv(version, tool, venv, project, case / "venv.log", packages=["urllib3==1.26.18"]) + + # --dry-run first: must report the same count and leave everything untouched. + rd = cli_run(penv, "scan", "--mode", mode, "--dry-run", log="scan-dryrun.log") + ed = rd.json_or_empty() + dry_applied = planned_count(mode, ed) + dry_clean = (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile and not (project / ".socket").exists() + info["dryRun"] = {"exit": rd.rc, "applied": dry_applied, "untouched": dry_clean} + + r = cli_run(penv, "scan", "--mode", mode, log="scan.log") + info["scanExit"] = r.rc + try: + envelope = r.json() + except Exception as e: + raise RuntimeError(f"scan produced no JSON: {e}\n{r.tail(2000)}") + save(case / "cli-output.json", envelope) + applied = applied_count(mode, envelope) + info["applied"] = applied + warnings = envelope_warnings(mode, envelope) + info["warnings"] = warnings[:8] + lock_after = (project / "Pipfile.lock").read_bytes() + check("pipfileUnchanged", (project / "Pipfile").read_bytes() == pristine_pipfile) + # Hosted --dry-run computes the rewrite; vendored --dry-run is a + # ledger-only preview (`would_vendor`) that runs no backend guard, so + # its parity is recorded, not required. + check("dryRunParity", dry_applied == applied and dry_clean, info["dryRun"]) + + # ---- expected refusals (pre-2018 majors) + refusal = None + if spec != 6: + refusal = ("unsupported-lock-spec", "redirect_pipenv_refused" if mode == "hosted" else "pypi_pipenv_spec_unsupported") + elif legacy and mode == "vendored": + refusal = ("unsupported-vendored-installer", "pypi_pipenv_installer_unsupported") + if refusal: + reason, code = refusal + row["supported"] = False + row["expected"] = f"refused: {reason} ({code})" + codes = sorted({(w.get("code") or w.get("errorCode")) for w in warnings if (w.get("code") or w.get("errorCode"))}) + check("refusedWithCode", applied == 0 and code in codes, {"applied": applied, "codes": codes, "exit": r.rc}) + check("lockUnchanged", lock_after == pristine_lock) + check("noLedger", not (project / ".socket/vendor/redirect-state.json").exists() and not (project / ".socket/vendor/state.json").exists()) + rb = cli_run(penv, "rollback", log="rollback.log") + check("rollbackHarmless", (project / "Pipfile.lock").read_bytes() == pristine_lock and (project / "Pipfile").read_bytes() == pristine_pipfile, {"exit": rb.rc}) + row["passed"] = all(val for k, val in checks.items() if k not in ("lockOnlyApplies", "dryRunParity")) + return row + + row["supported"] = True + check("appliedExactlyOne", applied == 1, {"applied": applied, "status": envelope.get("status"), "warnings": warnings[:4], "exit": r.rc}) + if not checks["appliedExactlyOne"]: + row["passed"] = False + return row + # The scan ran against a venv holding the UPSTREAM release: Pipenv will + # not reinstall it, so the CLI must say so (positive-evidence probe). + stale_code = "redirect_pipenv_stale_install" if mode == "hosted" else "pypi_pipenv_stale_install" + stale = [w for w in warnings if (w.get("code") or w.get("errorCode")) == stale_code] + stale_text = (stale[0].get("detail") or stale[0].get("reason") or "") if stale else "" + check("staleInstallWarned", bool(stale) and "pipenv run pip uninstall" in stale_text, {"codes": sorted({(w.get("code") or w.get("errorCode")) for w in warnings if (w.get("code") or w.get("errorCode"))}), "detail": stale_text[:300] or None}) + check("lockRewritten", lock_after != pristine_lock) + if shape == "crlf": + check("crlfPreserved", b"\n" not in lock_after.replace(b"\r\n", b"")) + else: + check("noCrlfIntroduced", b"\r\n" not in lock_after) + check("lockStillJson", json.loads(lock_after.decode()) is not None) + check("metaUnchanged", json.loads(lock_after.decode()).get("_meta") == json.loads(pristine_lock.decode()).get("_meta")) + keys = source_keys(lock_after.decode()) + info["sourceKeys"] = keys + entries = lock_entries(lock_after.decode()) + info["rewrittenEntries"] = [{"section": s, "key": k, "entry": e} for s, k, e in entries][:4] + if mode == "hosted": + expected_key = "path" if 7 <= major < 2018 else "file" + check("lockHasPatchUrl", b"patch.socket.dev" in lock_after and b"#sha256=" in lock_after) + else: + has_extras = any(isinstance(e, dict) and e.get("extras") for _, _, e in lock_entries(pristine_lock.decode())) + expected_key = "path" if has_extras else "file" + check("lockHasVendoredRef", b".socket/vendor/pypi" in lock_after) + check("expectedSourceKey", keys == [expected_key], {"expected": expected_key, "got": keys}) + pristine_entries = {(s, k): e for s, k, e in lock_entries(pristine_lock.decode())} + check("allCategoriesRewritten", entries and all(("file" in e or "path" in e) and "version" not in e and "index" not in e for _, _, e in entries) and {(s, k) for s, k, _ in entries} == set(pristine_entries), {"pristine": sorted(pristine_entries), "rewritten": sorted((s, k) for s, k, _ in entries)}) + check("markersExtrasPreserved", all(e.get("markers") == pristine_entries.get((s, k), {}).get("markers") and e.get("extras") == pristine_entries.get((s, k), {}).get("extras") for s, k, e in entries)) + after, before, uuid = record_hashes(project, mode) + info["uuid"] = uuid + check("recordHasFiles", bool(after)) + if mode == "vendored": + wheel_dir = project / ".socket/vendor/pypi" / (uuid or "") + check("vendoredWheelPresent", wheel_dir.is_dir() and any(wheel_dir.glob("*.whl"))) + + # idempotent re-scan + r2 = cli_run(penv, "scan", "--mode", mode, log="rescan.log") + e2 = r2.json_or_empty() + check("rescanIdempotent", r2.ok() and (project / "Pipfile.lock").read_bytes() == lock_after and (project / "Pipfile").read_bytes() == pristine_pipfile, {"exit": r2.rc, "applied": applied_count(mode, e2), "status": e2.get("status")}) + + # For legacy majors Pipenv installs into a Docker (linux) venv: replace + # the host venv the CLI crawled with a native one carrying upstream urllib3. + if legacy: + make_venv(version, tool, venv, project, case / "native-venv.log", native=True, packages=["urllib3==1.26.18"]) + + # WARM venv: upstream urllib3 already installed — does the redirected + # lock make Pipenv install the patched wheel? (informational) + warm_cmds = [("install", install_args(version, shape))] + if sync_args(version, shape): + warm_cmds.append(("sync", sync_args(version, shape))) + info["warmReinstalled"] = {} + for label, a in warm_cmds: + w = run_pipenv(version, tool, a, project, penv, case / f"warm-{label}.log") + wres = oracle(version, python, after, project, penv, case / f"oracle-warm-{label}.log") + info["warmReinstalled"][label] = {"exit": w.rc, "patched": bool(after) and all(wres.get(n) == h for n, h in after.items()), "tail": w.tail(300)} + # put the pristine copy back for the next warm command + uninstall_urllib3(version, python, project, penv, case / f"warm-{label}-uninstall.log") + require(run_python(version, python, ["-m", "pip", "install", "urllib3==1.26.18"], project, penv, case / f"warm-{label}-reinstall.log"), "pristine reinstall") + check("warmInstallReplacesUpstream", all(v["exit"] == 0 and v["patched"] for v in info["warmReinstalled"].values()), info["warmReinstalled"]) + + # Lock-driven install into the emptied venv. + uninstall_urllib3(version, python, project, penv, case / "uninstall.log") + inst = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "install.log") + res = oracle(version, python, after, project, penv, case / "oracle-1.log") + check("pipenvInstallExit0", inst.ok(), inst.tail(600) if not inst.ok() else None) + if shape == "marker-excluded": + check("excludedStaysAbsent", urllib3_absent(version, python, project, penv, case / "absence.log") and not any(res.values()), res) + else: + check("installedBytesPatched", all(res.get(n) == h for n, h in after.items()), res) + check("lockUnchangedByInstall", (project / "Pipfile.lock").read_bytes() == lock_after) + check("pipfileUnchangedByInstall", (project / "Pipfile").read_bytes() == pristine_pipfile) + vf = run_pipenv(version, tool, ["verify"], project, penv, case / "verify.log") + info["verify"] = {"exit": vf.rc, "tail": vf.tail(200)} + if major >= 2022: + rq = run_pipenv(version, tool, ["requirements"] + (["--dev"] if shape == "dev" else []) + (["--categories", "tests"] if shape == "category" else []), project, penv, case / "requirements.log") + marker = "patch.socket.dev" if mode == "hosted" else ".socket/vendor/pypi" + info["requirementsExport"] = {"exit": rq.rc, "exportsPatchRef": marker in rq.out, "urllib3Line": next((l for l in rq.out.splitlines() if "urllib3" in l.lower()), None)} + + # Fresh clone of the committed state (Pipfile, Pipfile.lock, .socket/), new venv. + fresh = case / "fresh" + shutil.copytree(project, fresh, ignore=shutil.ignore_patterns(".venv", "__pycache__")) + make_venv(version, tool, fresh / ".venv", fresh, case / "fresh-venv.log", native=True) + finst = run_pipenv(version, tool, install_args(version, shape), fresh, penv, case / "fresh-install.log") + fres = oracle(version, fresh / ".venv/bin/python", after, fresh, penv, case / "fresh-oracle.log") + if shape == "marker-excluded": + check("freshCloneKeepsExcluded", finst.ok() and urllib3_absent(version, fresh / ".venv/bin/python", fresh, penv, case / "fresh-absence.log"), {"exit": finst.rc}) + else: + check("freshCloneInstallsPatch", finst.ok() and all(fres.get(n) == h for n, h in after.items()), {"exit": finst.rc, "oracle": fres, "tail": finst.tail(500) if not finst.ok() else None}) + check("freshCloneLockUnchanged", (fresh / "Pipfile.lock").read_bytes() == lock_after) + + # vex over the installed, redirected/vendored tree + vx = Run([cli_bin, "vex", "--product", "pkg:pypi/pipenv-backtest-fixture@0.1.0", *cli_args, "--no-telemetry"], cwd, penv, case / "vex.log") + info["vex"] = vex_info(vx) + + # Tamper: corrupt every recorded sha; the install must fail where the installer verifies. + if shape in ("direct", "crlf") and shape != "marker-excluded": + uninstall_urllib3(version, python, project, penv, case / "tamper-uninstall.log") + corrupt = re.sub(rb"sha256[:=][a-f0-9]{64}", lambda m: m[0][:7] + b"0" * 64, lock_after) + (project / "Pipfile.lock").write_bytes(corrupt) + tam = run_pipenv(version, tool, install_args(version, shape), project, penv, case / "tamper-install.log") + tres = oracle(version, python, after, project, penv, case / "tamper-oracle.log") + (project / "Pipfile.lock").write_bytes(lock_after) + info["tamper"] = {"installExit": tam.rc, "installedPatchedAnyway": bool(after) and all(tres.get(n) == h for n, h in after.items()), "expectsReject": mode == "hosted", "tail": tam.tail(300)} + if mode == "hosted": + check("tamperRejected", tam.rc != 0, info["tamper"]) + uninstall_urllib3(version, python, project, penv, case / "tamper-uninstall2.log") + require(run_pipenv(version, tool, install_args(version, shape), project, penv, case / "reinstall.log"), "reinstall after tamper") + check("lockRestoredAfterTamper", (project / "Pipfile.lock").read_bytes() == lock_after) + + # Relock: does Pipenv's own `lock` keep the patch reference? (informational) + rl = run_pipenv(version, tool, ["lock"], project, penv, case / "relock.log", timeout=900) + relocked = (project / "Pipfile.lock").read_bytes() + marker = b"patch.socket.dev" if mode == "hosted" else b".socket/vendor/pypi" + info["relock"] = {"exit": rl.rc, "lockBytesUnchanged": relocked == lock_after, "patchSourceKept": marker in relocked, "pipfileUnchanged": (project / "Pipfile").read_bytes() == pristine_pipfile, "tail": rl.tail(300) if not rl.ok() else None} + # A relock regenerated the entry to registry shape: `rollback` must + # retire the redirect cleanly (exit 0, ledger cleared) instead of + # refusing forever — judged in a copy so the main flow keeps its state. + if rl.ok() and relocked != lock_after: + relocked_dir = case / "relocked" + shutil.copytree(project, relocked_dir, ignore=shutil.ignore_patterns(".venv", "__pycache__")) + rcwd, rargs = cli_invocation(case, relocked_dir, "in-dir") + rrb = Run([cli_bin, "rollback", *rargs, "--json", "--yes", "--no-telemetry"], rcwd, penv, case / "relocked-rollback.log") + erb2 = rrb.json_or_empty() + ledger2 = relocked_dir / ".socket/vendor/redirect-state.json" + state2 = relocked_dir / ".socket/vendor/state.json" + cleared = (not ledger2.exists() or not json.loads(ledger2.read_text()).get("records")) and (not state2.exists() or not json.loads(state2.read_text()).get("entries")) + check("rollbackAfterRelockRetires", rrb.ok() and cleared and (relocked_dir / "Pipfile.lock").read_bytes() == relocked, {"exit": rrb.rc, "cleared": cleared, "lockKeptRelocked": (relocked_dir / "Pipfile.lock").read_bytes() == relocked, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None}) + (project / "Pipfile.lock").write_bytes(lock_after) + (project / "Pipfile").write_bytes(pristine_pipfile) + + # Rollback restores every byte and clears the ledgers. + rb = cli_run(penv, "rollback", log="rollback.log") + erb = rb.json_or_empty() + check("rollbackExit0", rb.ok(), rb.tail(600) if not rb.ok() else None) + check("rollbackRestoresLockBytes", (project / "Pipfile.lock").read_bytes() == pristine_lock) + check("rollbackKeepsPipfile", (project / "Pipfile").read_bytes() == pristine_pipfile) + if mode == "hosted": + ledger = project / ".socket/vendor/redirect-state.json" + check("rollbackClearsRedirectLedger", not ledger.exists() or not json.loads(ledger.read_text()).get("records")) + if mode == "vendored": + check("rollbackRemovesVendoredWheel", not (project / ".socket/vendor/pypi" / (uuid or "x")).exists()) + state = project / ".socket/vendor/state.json" + check("rollbackClearsVendorState", not state.exists() or not json.loads(state.read_text()).get("entries")) + mf = project / ".socket/manifest.json" + check("rollbackClearsManifest", not mf.exists() or json.loads(mf.read_text()).get("patches") in ({}, None)) + info["rollbackEnvelope"] = {k: erb.get(k) for k in ("status", "rolledBack", "failed", "hosted", "vendoredReverted", "manifest") if k in erb} + # Measured boundaries, recorded rather than required: Pipenv never + # reinstalls a present release (warmInstallReplacesUpstream — the CLI + # warns instead, see staleInstallWarned) and the vendored --dry-run + # preview runs no backend guard. + informational = {"warmInstallReplacesUpstream"} + if mode == "vendored": + informational.add("dryRunParity") + row["passed"] = all(val for k, val in checks.items() if k not in informational) + return row + + def vex_info(vx): + try: + vdoc = json.loads(vx.out[vx.out.find("{"):]) if vx.ok() else {} + return {"exit": vx.rc, "statements": len(vdoc.get("statements", []))} + except Exception: + return {"exit": vx.rc, "tail": vx.tail(400)} + + # ------------------------------------------------------------ schedule + prepared = {} + with concurrent.futures.ThreadPoolExecutor(max_workers=args.jobs) as pool: + futs = {pool.submit(prepare_tool, v): v for v in args.versions} + for f in concurrent.futures.as_completed(futs): + v = futs[f] + try: + prepared[v] = f.result() + say("bootstrapped pipenv", v) + except Exception as e: + say("BOOTSTRAP FAILED", v, str(e)[-800:]) + + def wanted(version, shape, mode, invocation): + if version not in prepared: + return False + if shape == "category" and major_of(version) < 2022: + return False + if invocation != "in-dir" and shape != "direct": + return False + if mode in ("agent", "agent-oot") and shape in ("crlf",): + return False + if mode == "agent-oot" and shape == "marker-excluded": + return False + return True + + # One job per (version, shape[, invocation]); modes run sequentially inside so + # the shared original// lock is generated exactly once. + groups = {} + for v in args.versions: + for s in args.shapes: + for inv in invocations: + for m in args.modes: + if wanted(v, s, m, inv): + groups.setdefault((v, s), []).append((m, inv)) + say(f"{sum(len(ms) for ms in groups.values())} cases in {len(groups)} jobs") + results, errors = [], [] + + def run_group(key): + v, s = key + out = [] + for m, inv in groups[key]: + job = (v, s, m, inv) + try: + row = backtest(job) + out.append(("row", job, row)) + except Exception as e: + out.append(("error", job, {"pipenv": v, "shape": s, "mode": m, "invocation": inv, "error": str(e)[-3000:], "trace": traceback.format_exc()[-1500:]})) + yield out[-1] + + def flush(): + save(root / "summary.json", {"provenance": provenance, "results": sorted(results, key=lambda r: (vtuple(r["pipenv"]), r["shape"], r["mode"], r["invocation"])), "errors": errors}) + + def consume(key): + for kind, job, payload in run_group(key): + with log_lock: + if kind == "row": + results.append(payload) + failed = [k for k, ok in payload["checks"].items() if not ok] + print(*job, "PASS" if payload["passed"] else "FAIL", ",".join(failed), flush=True) + else: + errors.append(payload) + print(*job, "ERROR", payload["error"][-300:].replace("\n", " "), flush=True) + flush() + + with concurrent.futures.ThreadPoolExecutor(max_workers=args.jobs) as pool: + list(pool.map(consume, list(groups))) + flush() + summary = json.loads((root / "summary.json").read_text()) + (root / "summary.md").write_text(render_table(summary)) + say(render_table(summary)) + if errors or any(not r["passed"] for r in results): + sys.exit(1) + + +def _flag(cases, key, sub=None, sub2=None): + vals = set() + for c in cases: + i = c.get("info", {}).get(key) + if isinstance(i, dict) and sub is not None: + i = i.get(sub) + if isinstance(i, dict) and sub2 is not None: + i = i.get(sub2) + if isinstance(i, (bool, int, str)): + vals.add(i) + return "/".join(sorted(str(v).lower() for v in vals)) or "n/a" + + +def render_doc_table(summary): + """Per-version compatibility table for docs/testing/pipenv-compatibility.md.""" + rows = summary["results"] + by = {} + for r in rows: + by.setdefault(r["pipenv"], []).append(r) + lines = [ + "| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) |", + "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |", + ] + + def cell(cases): + if not cases: + return "n/a" + refused = [c for c in cases if c.get("supported") is False] + if refused and len(refused) == len(cases): + ok = sum(1 for c in cases if c["passed"]) + return ("refused" if ok == len(cases) else f"refused {ok}/{len(cases)}") + " (" + refused[0]["expected"].split("(")[-1].rstrip(")") + ")" + ok = sum(1 for c in cases if c["passed"]) + shapes = ",".join(sorted({c["shape"] for c in cases})) + return ("pass" if ok == len(cases) else f"{ok}/{len(cases)}") + f" ({shapes})" + + def yes_no(cases, key, sub): + vals = {c["info"][key][sub] for c in cases if isinstance(c.get("info", {}).get(key), dict)} + if not vals: + return "n/a" + return "/".join("yes" if v else "no" for v in sorted(vals, key=lambda x: not x)) + + for version in sorted(by, key=vtuple): + cs = by[version] + m = lambda mode: [c for c in cs if c["mode"] == mode and c["invocation"] == "in-dir"] + hosted, vendored = m("hosted"), m("vendored") + dh = [c for c in hosted if c["shape"] == "direct" and c.get("supported")] + dv = [c for c in vendored if c["shape"] == "direct" and c.get("supported")] + tamper = f"{'yes' if any(c['info'].get('tamper', {}).get('installExit') not in (None, 0) for c in dh) else ('n/a' if not dh else 'no')} / {'yes' if any(c['info'].get('tamper', {}).get('installExit') not in (None, 0) for c in dv) else ('n/a' if not dv else 'no')}" + warm = f"{_flag(dh, 'warmReinstalled', 'install', 'patched')} / {_flag(dv, 'warmReinstalled', 'install', 'patched')}" + relock = f"{_flag(dh, 'relock', 'patchSourceKept')} / {_flag(dv, 'relock', 'patchSourceKept')}" + verify = f"{_flag(dh, 'verify', 'exit')} / {_flag(dv, 'verify', 'exit')}" + oot = m("agent-oot") + sees = "/".join(sorted({str(c["checks"].get("bareScanSeesPipenvVenv")).lower() for c in oot})) if oot else "n/a" + lines.append(f"| {version} | {cell(hosted)} | {cell(vendored)} | {cell(m('agent'))} | {cell(oot)} | {sees} | {tamper} | {warm} | {relock} | {verify} |") + return "\n".join(lines) + + +def render_table(summary): + rows = summary["results"] + lines = ["| Pipenv | shape | mode | invocation | passed | failed checks | notes |", "| --- | --- | --- | --- | --- | --- | --- |"] + for r in sorted(rows, key=lambda r: (vtuple(r["pipenv"]), r["shape"], r["mode"], r["invocation"])): + failed = ", ".join(k for k, ok in r["checks"].items() if not ok) + notes = [] + info = r.get("info", {}) + if r.get("expected"): + notes.append(r["expected"]) + if "sourceKeys" in info: + notes.append("source key " + ",".join(info["sourceKeys"])) + if "warmReinstalled" in info: + notes.append("warm reinstalled " + ",".join(f"{k}={v['patched']}" for k, v in info["warmReinstalled"].items())) + if "relock" in info: + notes.append(f"relock exit {info['relock'].get('exit')} keeps patch={info['relock'].get('patchSourceKept')}") + if "tamper" in info: + notes.append(f"tamper install exit {info['tamper']['installExit']}") + if "verify" in info: + notes.append(f"verify exit {info['verify']['exit']}") + if "requirementsExport" in info: + notes.append(f"requirements exports patch ref={info['requirementsExport'].get('exportsPatchRef')}") + if "lockOnly" in info: + notes.append(f"lock-only applied={info['lockOnly']['applied']} {info['lockOnly']['codes']}") + if "bareScan" in info: + notes.append(f"bare scan sees venv={r['checks'].get('bareScanSeesPipenvVenv')} apply via {info.get('applyPath')}") + if "vex" in info: + notes.append(f"vex exit {info['vex'].get('exit')} stmts={info['vex'].get('statements')}") + lines.append(f"| {r['pipenv']} | {r['shape']} | {r['mode']} | {r['invocation']} | {'PASS' if r['passed'] else 'FAIL'} | {failed} | {'; '.join(notes)} |") + for e in summary.get("errors", []): + lines.append(f"| {e.get('pipenv')} | {e.get('shape')} | {e.get('mode')} | {e.get('invocation')} | ERROR | {e['error'][-160:].replace(chr(10), ' ')} | |") + return "\n".join(lines) + + +if __name__ == "__main__": + main() From d5e54d7ed1af6ca5d26ed685edf9e474057cce6b Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 16:54:41 -0400 Subject: [PATCH 14/27] docs(pipenv): document hosted Pipfile.lock behavior, the new codes and the measured boundaries CLI_CONTRACT.md gains Pipfile.lock in the candidate-file list, a "Pipenv hosted redirect" section (reference key by installer major and the probe rules, refusal vs skip scope, the era-split hash enforcement, the stale-install guard and its verified remedy, relock retirement, the `--vex-product` requirement) and vocabulary rows for redirect_pipenv_{refused,skipped,installer_unknown,stale_install}, pypi_pipenv_{installer_unsupported,version_mismatch,invalid_wheel, stale_install} and vendor_lock_entry_relocked. docs/ecosystems.md no longer says Pipenv locks are not rewritten in hosted mode. CHANGELOG records the feature and the fixes; the README section states what was measured (including that `pipenv uninstall` is not the warm-venv remedy); the new docs/testing/pipenv-compatibility.md holds the installer boundaries and the matrix recipe, with the results table generated after the final run. Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 51 ++++++++++ README.md | 56 +++++++---- crates/socket-patch-cli/CLI_CONTRACT.md | 12 ++- docs/ecosystems.md | 2 +- docs/testing/pipenv-compatibility.md | 121 ++++++++++++++++++++++++ 5 files changed, 224 insertions(+), 18 deletions(-) create mode 100644 docs/testing/pipenv-compatibility.md diff --git a/CHANGELOG.md b/CHANGELOG.md index ac44cccc..dccf4677 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,40 @@ into the new version's section — see docs/releasing.md. ### Added +- **Pipenv projects can use hosted patches, and vendored patches keep every + category.** `scan --mode hosted` rewrites every `Pipfile.lock` category + (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched + release to the hosted wheel — `file` references for Pipenv 2018 and later, + `path` for 7–11 (probed once with `pipenv --version`; `SOCKET_PIPENV_MAJOR` + pins it), pipfile-spec < 6 refused — preserving markers, extras, unrelated + entries, the Pipfile and its content hash, with per-entry rollback + (`redirect_pipenv_entry`). Vendored mode keeps custom categories and extras, + uses `path` for wheels with extras (Pipenv 2022's file-URL bug) and refuses + installers older than 2018 (`pypi_pipenv_installer_unsupported`). A stale + Pipfile.lock only vetoes the sibling Python rewriters on a real pin/source + conflict (`redirect_pipenv_refused`); anything else is + `redirect_pipenv_skipped`. Measured across the last stable release of all + 18 published Pipenv majors — see `docs/testing/pipenv-compatibility.md` and + `scripts/backtest-pipenv.py`. +- **`Pipfile.lock` is inventoried.** Lock-only Pipenv checkouts (a fresh + clone with nothing installed) now discover their pins in every mode — + hosted redirects them, vendored fetches the pristine wheel by one of the + lock's recorded digests (`LockIntegrity::Sha256AnyOf`, resolved through + PyPI's JSON API and verified against the same digest) and agent/scan list + them as lockfile-only packages. Previously they discovered nothing and + exited 0. +- **Pipenv's out-of-tree virtualenv is discovered.** Agent mode (bare `scan`, + `rollback`, `vex`) now finds `$WORKON_HOME/-[-]` (the + `.venv` file pointer, `PIPENV_CUSTOM_VENV_NAME` and `PIPENV_PIPFILE` + included) exactly as Pipenv 7 through 2026 place it, instead of falling + through to the global interpreter's site-packages. +- **Pipenv stale-install guard.** Pipenv never reinstalls a release that is + already present, so a hosted or vendored rewrite over a warm venv leaves the + upstream bytes installed; `redirect_pipenv_stale_install` / + `pypi_pipenv_stale_install` now say so, naming the site-packages dir and + the verified remedy (`pipenv run pip uninstall -y && pipenv sync`, or + a clean `pipenv --rm && pipenv sync`), and the stale purl is excluded from + the same-run `--vex`. - **Python patches survive uv lockfiles in both hosted and vendored modes.** `scan --mode hosted|vendored` now rewrites native `uv.lock` together with the paired `pyproject.toml` source and metadata, PEP 723 script locks @@ -168,6 +202,23 @@ into the new version's section — see docs/releasing.md. ### Fixed +- **Rollback after a Pipenv relock no longer refuses forever.** `pipenv lock` + (and `update`, and `install ` before 2024) regenerates a redirected + or vendored entry to registry shape on every Pipenv major; that is now the + desired end state — the hosted edit retires and the vendored record is + dropped (`vendor_lock_entry_relocked`) — instead of a permanent drift + refusal that held every pypi revert and kept the orphaned wheel dir. A + foreign `file`/`path` reference is still drift. +- **Same-run `--vex` attests lock-only pypi redirects.** The confirmed purl is + unqualified while the ledger records the API's artifact-qualified purl; + both sides now match on the qualifier-stripped purl, so a lock-only Pipenv + (or uv) checkout no longer exits 1 `no_applicable_patches` after + redirecting its lock. +- **The Pipenv installer probe runs only when a patch targets the lock**, warns + only when the lock was actually rewritten, resolves `pipenv` on absolute + `PATH` entries only (a relative entry would have executed a `pipenv` planted + in the scanned repository), finds `.bat`/`.cmd` shims on Windows, and takes + only the token after `version` (never a stray `Python 3.12` banner). - **`remove` no longer drops the manifest entry of a drift-kept vendored purl.** When the vendored revert keeps the artifact (`kept_artifact` — the lockfile drifted), the manifest entry is now kept too diff --git a/README.md b/README.md index 5ecd8951..bbb05c4b 100644 --- a/README.md +++ b/README.md @@ -256,24 +256,48 @@ for details and per-ecosystem caveats. ### Pipenv compatibility -Hosted mode rewrites every matching `Pipfile.lock` category and preserves the -Pipfile, its content hash, markers, extras, and unrelated lock entries. Socket -Patch checks the installed Pipenv version: releases 7–11 need hosted `path` -references, while releases from 2018 onward use `file` references. Hosted -references include the SHA-256 URL fragment so pip verifies downloaded bytes. -Old lock formats before `pipfile-spec: 6` are refused without changing the lock. +Hosted mode rewrites every `Pipfile.lock` category that pins the patched +release (`default`, `develop`, and Pipenv 2022+ named categories) and +preserves the Pipfile, its content hash, markers, extras, and unrelated lock +entries, so `pipenv install --deploy`, `pipenv sync` and `pipenv verify` keep +passing. The reference shape follows the installing Pipenv: releases 7–11 +need `path` references, 2018 and later use `file` references, and lock +formats before `pipfile-spec: 6` (Pipenv 0–6) are refused without changing +the lock. Socket Patch probes `pipenv --version` once per run (only when a +patch targets the lock); `SOCKET_PIPENV_MAJOR=` pins the answer for +machines without pipenv on PATH. Hosted references carry both the `#sha256=` +URL fragment (verified by Pipenv 2023+) and a `hashes` entry (verified by +2018–2022; Pipenv 11 verifies either), so a tampered lock fails to install +on every supported release. Vendored mode requires Pipenv 2018 or later. Wheels with extras use `path` -references to avoid Pipenv 2022's local-file URL parsing bug. Native Pipenv does -not consistently enforce hashes on local wheels; commit the wheel and run -`socket-patch vex`. Re-run Socket Patch after re-locking dependencies. - -The compatibility backtest covers the last stable release of every published -Pipenv major, including unsupported versions to verify explicit refusal. It -checks actual installed patch bytes, repeat scans, hash corruption, normal -installs, lock-only installs, and `sync` where available. Parser/rewriter tests -also cover categories, source/version conflicts, malformed locks, CRLF, -rotating grants, and rollback with unrelated edits or drift. +references to avoid Pipenv 2022's local-file URL parsing bug. Pipenv 2023+ +does not enforce hashes on local wheels; commit the wheel and run +`socket-patch vex --product ` (a Pipfile names no project, so pass the +product purl explicitly). + +Fresh checkouts work in every mode: a clone with only `Pipfile` + +`Pipfile.lock` is discovered from the lock (hosted redirects it, vendored +fetches the pristine wheel by one of the lock's recorded digests), and agent +mode finds Pipenv's default out-of-tree virtualenv under `WORKON_HOME` +without `pipenv run`. + +Pipenv never reinstalls a release that is already present: `pipenv install`, +`pipenv install --deploy` and `pipenv sync` all exit 0 and keep the installed +bytes, on every Pipenv major. A hosted or vendored rewrite therefore +protects fresh installs, and Socket Patch warns +(`redirect_pipenv_stale_install` / `pypi_pipenv_stale_install`) when a venv +still holds the upstream release, with the verified remedy: +`pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && +pipenv sync`). Do not use `pipenv uninstall ` for this — it rewrites the +Pipfile and re-locks the patch away. `pipenv lock` / `pipenv update` +regenerate the entry to its registry reference (a silent unpatch): re-run +Socket Patch afterwards; `rollback` retires the stale record cleanly. + +`scripts/backtest-pipenv.py` drives the real CLI and the last stable release +of every published Pipenv major through hosted, vendored, agent and +out-of-tree agent mode, and `docs/testing/pipenv-compatibility.md` holds the +measured boundaries and results. ## Common tasks diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md index b0a730a1..a351d3d0 100644 --- a/crates/socket-patch-cli/CLI_CONTRACT.md +++ b/crates/socket-patch-cli/CLI_CONTRACT.md @@ -120,10 +120,12 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc `scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL, or — for golang — the `patch.socket.dev/gopatch/` module path) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Re-runs over already-rewritten output record zero new edits. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove ` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. -The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock`), `requirements.txt` / `uv.lock`, `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 1 or 2 — bun 1.3/1.4 share one emitted grammar; a binary `bun.lockb` with no text lock is auto-migrated to text via `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` before the read, recorded as a `removed` FileEdit; `redirect_bun_lockb_would_migrate` on `--dry-run`, `redirect_bun_lockb_unsupported` when the migration is unavailable). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces//pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `-socket.` by rewriting the literal `` (`redirect_maven_dep_version`) or adding a `` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed). +The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate and `bun.lock`), `requirements.txt` / `uv.lock` / `Pipfile.lock`, `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 1 or 2 — bun 1.3/1.4 share one emitted grammar; a binary `bun.lockb` with no text lock is auto-migrated to text via `bun install --save-text-lockfile --frozen-lockfile --lockfile-only` before the read, recorded as a `removed` FileEdit; `redirect_bun_lockb_would_migrate` on `--dry-run`, `redirect_bun_lockb_unsupported` when the migration is unavailable). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces//pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `-socket.` by rewriting the literal `` (`redirect_maven_dep_version`) or adding a `` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed). **Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using ` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract. +**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and warns `redirect_pipenv_stale_install` naming the site-packages dir and the verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry (drift = the entry is neither the recorded original nor the rewrite); a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. + **Mode ledgers (contract surfaces).** Each committable mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write these files, so path + schema are part of the contract: * `.socket/vendor/state.json` — the **vendored**-mode ledger (see "Ownership, state, and reversal" below): wiring edits with verbatim pre-vendor originals, artifact fingerprints, optional `detached` records. @@ -1070,6 +1072,14 @@ Every `--json` invocation emits a single JSON object that follows the **unified | `content_mismatch_overwritten` | `skipped` (warning) | apply (default policy): a file matched NEITHER beforeHash nor afterHash and was overwritten with the full verified patched content. `--strict` turns this case into a `failed` event instead. | | `vendor_lock_checksums_unsupported` / `vendor_stale_lock_checksum` | `failed` | vendor (gem): an ambiguous/platform CHECKSUMS entry, or a v1-wired lock whose stale token blocks the hot path (run `vendor --revert` + re-vendor). | | `redirect_gem_stale_install` | `redirect.warnings[]` (warning) | scan `--mode hosted` (gem): a stale UNPATCHED materialization (installed gem, or committed `vendor/cache` archive) that `bundle install` will reuse instead of fetching the redirected patch; the detail carries the verified remedy. Full rules and flavors: the "Gem stale-install guard" section. | +| `redirect_pipenv_refused` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the Pipfile.lock pins another version or a non-registry / foreign source for the package — refused atomically across categories, and the patch is vetoed from the sibling Python rewriters (see the "Pipenv hosted redirect" section). | +| `redirect_pipenv_skipped` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): no entry for the package, pipfile-spec < 6, an unparseable lock or a digest-less patch — nothing rewritten here; the sibling rewriters proceed. | +| `redirect_pipenv_installer_unknown` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the lock was rewritten with the modern `file` reference because no `pipenv` answered on PATH; Pipenv 7–11 projects need `path` — put that pipenv on PATH or set `SOCKET_PIPENV_MAJOR`. | +| `redirect_pipenv_stale_install` | `redirect.warnings[]` (warning) | scan `--mode hosted` (pipenv): the UNPATCHED release is still installed in a venv Pipenv will not reinstall over; the detail names the dir and the verified `pipenv run pip uninstall -y && pipenv sync` remedy. Excluded from the same-run `--vex`. | +| `pypi_pipenv_installer_unsupported` | `failed` | vendor (pipenv): the installed Pipenv is older than 2018 and cannot consume vendored wheel references — upgrade Pipenv or use hosted mode. | +| `pypi_pipenv_version_mismatch` / `pypi_pipenv_invalid_wheel` | `failed` | vendor (pipenv): a category pins a different version than the patch (or the wheel filename carries no version) — refused before any write. | +| `pypi_pipenv_stale_install` | `skipped` (warning) | vendor (pipenv): the twin of `redirect_pipenv_stale_install` for the vendored wiring. | +| `vendor_lock_entry_relocked` | revert `warnings[]` | vendor `--revert` / rollback (pipenv): a relock regenerated the wired entry to a registry reference; the record is retired (artifact removed, ledger entry dropped) instead of drift-kept. | | `pypi_{poetry,pdm,pipenv}_no_lockfile` | `failed` | vendor (pypi): a lock-less tool marker with no `requirements.txt` fallback — run ` lock`. | | `vendor_prebuilt_stub_invalid` | `failed` / `skipped` (warning) | vendor (gem, `--vendor-source`): the served stub gemspec fails the rubygems `summary`/`authors` bar, so bundler would refuse the vendored path source at install time. `service`: refusal naming the missing attributes; `auto`: loud warning + local-build fallback — or, when the gem is also not installed locally (no stub to derive), a refusal naming the served defect and the install-the-gem remedy. | | `gem_spec_invalid` | `failed` | vendor (gem): the LOCAL `specifications/` stub gemspec fails the same rubygems `summary`/`authors` bar (a corrupted or hand-edited gem home); the refusal names the file — reinstall the gem (`gem pristine ` / fresh `bundle install`). | diff --git a/docs/ecosystems.md b/docs/ecosystems.md index 17291b25..a5c4a353 100644 --- a/docs/ecosystems.md +++ b/docs/ecosystems.md @@ -15,7 +15,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g. | Ecosystem | agent (`--mode agent`) | vendored (`--mode vendored`) | hosted (`--mode hosted`) | |-----------|------------------------|------------------------------|--------------------------| | npm (`npm`) — pnpm / yarn / berry / bun | ✅ any install layout; `setup` postinstall hook | ✅ six lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun `bun.lock` (binary `bun.lockb` refused with a `--save-text-lockfile` pointer). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun — pnpm, berry, and bun carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) | -| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock..toml`, poetry, pdm, pipenv (lock rewired, but pipenv doesn't hash-check file entries — `vendor_integrity_unverified` warning; the committed wheel bytes are the protection), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). **poetry / pdm / pipenv locks are not rewritten** — use vendored | +| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock..toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). **poetry / pdm locks are not rewritten** — use vendored | | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry | ✅ per-patch sparse registry (`[registries.socket-patch-]` + Cargo.lock source/checksum) | | RubyGems (`gem`) | ✅ Bundler plugin via `setup` — needs bundler ≥ 2.2 (1.x cannot load `plugin ... path:` directives; `setup` refuses below the floor and `setup --check` red-flags a wired 1.x project) | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") | | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy | diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md new file mode 100644 index 00000000..9a46bd8e --- /dev/null +++ b/docs/testing/pipenv-compatibility.md @@ -0,0 +1,121 @@ +# Pipenv compatibility and production backtests + +`socket-patch` supports hosted, vendored and agent-mode Python patches in +Pipenv projects. The tests use real Pipenv releases, real PyPI artifacts and +the public Socket patch service. Rewriting alone is not an installation +result: the backtest reinstalls from the rewritten `Pipfile.lock` (fresh +clone, warm venv, lock-only checkout) and compares the installed bytes with +the published patch. + +This supplements the [hosted](hosted-production-e2e.md) and +[vendored](vendored-production-e2e.md) production suites; see the +[ecosystem matrix](../ecosystems.md#mode--ecosystem-matrix) for the other +package managers and [uv compatibility](uv-compatibility.md) for the uv / +requirements.txt lanes of the same ecosystem. + +## Formats and rewrite behavior + +| Input | Hosted | Vendored | Agent | +|-------|--------|----------|-------| +| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi//`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the project's venv — in-project `.venv`, `VIRTUAL_ENV`, or Pipenv's default `$WORKON_HOME/-[-]` (discovered without running Pipenv). | +| `Pipfile.lock`, `pipfile-spec` < 6 (Pipenv 0–6) | Refused (`redirect_pipenv_skipped`), lock untouched. | Refused (`pypi_pipenv_spec_unsupported`). | Works. | +| Lock-only checkout (nothing installed) | Discovered from the lock and redirected. | Discovered from the lock; the pristine wheel is fetched by one of the lock's recorded digests (Pipenv records every release file's sha256 without filenames) through PyPI's JSON API, verified against the same digest, and the patched wheel comes from the service. | Nothing to patch (no installed distribution); the lock's pins are listed as lockfile-only packages. | + +Both hash fields are load-bearing: Pipenv 2023+ verifies the `#sha256=` URL +fragment, 2018–2022 verify the `hashes` list, Pipenv 11 accepts either. A +tampered hosted reference fails to install on every supported release. +Pipenv 2023+ does not verify the hash of a *local* wheel (vendored mode), so +the committed wheel bytes are the protection there; `socket-patch vex +--product ` re-verifies the installed files (a Pipfile names no +project, so the product purl must be passed explicitly). + +## Installer boundaries (measured) + +Measured with the last stable release of every published Pipenv major +(`releases.json` of the depscan harness, PyPI as of 2026-09-17): 0.2.8, +3.6.2, 4.1.4, 5.4.2, 6.2.9, 7.9.10, 8.3.2, 9.1.0, 10.1.2, 11.10.4, +2018.11.26, 2020.11.15, 2021.11.23, 2022.12.19, 2023.12.1, 2024.4.1, +2025.1.3, 2026.8.0. Pre-2018 releases run on Python 3.6 (they no longer +import on modern Pythons); 2018–2022 on Python 3.8; 2023+ on Python 3.12. + +- **Warm virtualenvs are never reinstalled.** With the same release already + installed, `pipenv install`, `pipenv install --deploy` and `pipenv sync` + exit 0 and keep the upstream bytes — on every major, hosted and vendored. + The rewritten lock protects fresh installs; the CLI warns + (`redirect_pipenv_stale_install` / `pypi_pipenv_stale_install`) while a + venv still holds the upstream release. Verified remedies (Pipfile + byte-untouched): `pipenv run pip uninstall -y && pipenv sync`, or + `pipenv --rm && pipenv sync`. `pipenv uninstall ` is **not** a remedy: + it rewrites the Pipfile and re-locks the patch away. `PIP_FORCE_REINSTALL=1 + pipenv sync` works on 2018 but is ignored by 2026. +- **Relocking drops the reference.** `pipenv lock` (and `update`, and + `install ` on releases before 2024, where it is a full relock) + regenerates the redirected entry to its registry reference on every major, + hosted and vendored — a silent unpatch. Re-run Socket Patch afterwards; + `rollback` retires the stale record cleanly (2026 reproduces the original + entry byte for byte, 2022 writes a different hash list — both are the + desired end state, not drift). +- **Reference key by release.** Pipenv 7–11 install only `path` references + (`file` fails); 2018 and later install `file`. The CLI probes + `pipenv --version` on absolute `PATH` entries (every release prints + `pipenv, version X`) only when a patch targets the lock; + `SOCKET_PIPENV_MAJOR=` pins the answer for CI images without pipenv. +- **Vendored refusal for 7–11.** Those releases cannot reliably consume + vendored wheel references; hosted mode covers them. +- **Command availability.** `--ignore-pipfile` and `--venv` arrive with + Pipenv 3, `--deploy` with 9, `pipenv sync` with 2018, `pipenv verify` with + 2020, `pipenv requirements` with 2022 (it exports the hosted URL / vendored + path). Pipenv 0.x has no `WORKON_HOME` placement to discover. +- **Out-of-tree venv naming** is unchanged from Pipenv 7 through 2026: + `sanitize()[:42]-<8 chars of urlsafe-base64(sha256())>`, plus `-` when that variable is set (the + interpreter's basename on 2026, the full string on 2018 and 11). The + crawler reproduces it (and honours the `.venv` file pointer, + `PIPENV_CUSTOM_VENV_NAME`, `PIPENV_PIPFILE`, `WORKON_HOME` and Pipenv's + case-insensitive-filesystem fallback) so a bare `scan`/`rollback` sees the + project's venv; before, it fell through to the global interpreter and + reported success while the venv stayed unpatched. +- **CLI scope.** The CLI is scoped to its working directory (`--cwd`), while + Pipenv walks up to `PIPENV_MAX_DEPTH` (3) parents for a Pipfile: run the + CLI in the project directory (or pass `--cwd`). + +## Running the matrix + +```sh +cargo build -p socket-patch-cli +cp target/debug/socket-patch /tmp/socket-patch-under-test +scripts/backtest-pipenv.py \ + --socket-patch /tmp/socket-patch-under-test \ + --socket-patch-revision "$(git rev-parse --short HEAD)" \ + --output /tmp/pipenv-compat \ + --modes hosted vendored agent agent-oot \ + --shapes direct dev category marker marker-excluded extras transitive crlf \ + --jobs 4 +scripts/backtest-pipenv.py --render-doc-table /tmp/pipenv-compat/summary.json +``` + +Needs network (PyPI + patch.socket.dev), `uv`, Docker for the pre-2018 +releases (they run inside `python:3.6.15-slim` through a host-side `pipenv` +wrapper, so the CLI's installer probe sees them) and no Socket token (the +fixture dependency is `urllib3 1.26.18`, which has a public free-tier +patch). Copy the binary out of `target/` first — a rebuild would swap it +under the run. Concurrent invocations must use disjoint version/shape sets. + +Per (release, shape, mode) the harness checks: the lock-only fresh checkout, +`--dry-run` parity (hosted; the vendored preview is ledger-only by design and +is recorded), an idempotent re-scan, the untouched Pipfile and `_meta`, the +expected reference key, every category rewritten with markers/extras kept, +the stale-install warning over a warm venv, whether Pipenv reinstalls a warm +venv (recorded), the lock-driven install into an emptied venv with the +installed bytes checked against the patch record's Git blob SHA-256 hashes, a +fresh clone of the committed state, `pipenv verify` / `requirements`, tamper +rejection, what `pipenv lock` does to the entry, rollback after that relock, +`vex`, and a byte-exact `rollback`. Agent mode additionally checks that +repeat installs and `sync` keep the in-place patch, and the out-of-tree leg +requires the bare scan to see Pipenv's venv. + +## Results + + +_Pending: regenerated from `summary.json` after the final matrix run._ + From e944fb634c2ebeeae44879c044d29af454948c30 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 17:33:31 -0400 Subject: [PATCH 15/27] fix(pipenv): re-plan Socket-owned hybrid entries, follow the grant origin, validate ledger originals MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - `pipenv lock --keep-outdated` / `install --keep-outdated ` (2022) rewrite our entry into a file+version+index hybrid that Pipenv still installs from; the rewriter refused it as a foreign source ("already exists") and, being a conflict, vetoed the sibling Python rewriters. An entry whose reference is ours is now re-planned to the canonical shape when its `version` still names the patched release, and is a conflict only when it names another one. - `owned_url` recognized only `https://patch.socket.dev`, so a `--patch-server-url` deployment refused its own previous references on every re-scan. Ownership now follows the grant's own artifact URL origin (the public service stays recognized). - `restore()` spliced the committed, tamper-able ledger `original` string into the lock verbatim; it must parse as a JSON object first. - Vendored mode said nothing when the installer could not be probed while hosted warned; it now warns `pypi_pipenv_installer_unknown` with the `SOCKET_PIPENV_MAJOR` remedy. `vendor_integrity_unverified` no longer opens with "Pipenv 2018 or later is required" on Pipenv 2026 and names the release split (2018–2022 verify local-wheel hashes, 2023+ do not) and `vex --product`. - Harness: a CRLF lock re-serialized LF by the vendored backend is recorded, not required (it is what `pipenv lock` itself writes). Co-Authored-By: Claude Fable 5.1 --- .../src/patch/redirect/pipenv.rs | 106 ++++++++++++++++-- crates/socket-patch-core/src/vendor/pypi.rs | 19 +++- .../src/vendor/pypi_pipenv.rs | 8 +- scripts/backtest-pipenv.py | 5 +- 4 files changed, 122 insertions(+), 16 deletions(-) diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs index cfbe4196..0576efa5 100644 --- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -141,6 +141,12 @@ pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { .as_ref() .and_then(Value::as_str) .ok_or("missing Pipenv original")?; + // The ledger is committed and tamper-able: only a JSON object may be + // spliced back into the lock (never arbitrary text that would corrupt + // it or smuggle in extra entries). + if !serde_json::from_str::(original).is_ok_and(|value| value.is_object()) { + return Err("Pipenv original is not a JSON object".into()); + } let new = edit .new .as_ref() @@ -245,16 +251,25 @@ pub(super) fn rewrite( } } +/// Whether `value` is a Socket-issued hosted reference for `dep` — served +/// from the same origin as the grant's own artifact URL (patch.socket.dev, +/// or a `--patch-server-url` host), with the `/patch/pypi/// +/// //` shape for this package and version. Such an entry +/// is ours to rotate; anything else is a user's or a fork's source. fn owned_url(value: &str, dep: &DepOverride) -> bool { let Ok(url) = reqwest::Url::parse(value) else { return false; }; + let Ok(ours) = reqwest::Url::parse(&dep.artifact_url) else { + return false; + }; + let same_origin = url.scheme() == ours.scheme() + && url.host_str() == ours.host_str() + && url.port_or_known_default() == ours.port_or_known_default(); let parts: Vec<_> = url.path().split('/').collect(); - url.scheme() == "https" - && url.host_str() == Some("patch.socket.dev") + (same_origin || (url.scheme() == "https" && url.host_str() == Some("patch.socket.dev"))) && url.username().is_empty() && url.password().is_none() - && url.port().is_none() && url.query().is_none() && parts.len() == 8 && parts[1] == "patch" @@ -347,17 +362,29 @@ fn plan( ))); } if let Some(file) = object.get("file").or_else(|| object.get("path")) { - if !file.as_str().is_some_and(|value| owned_url(value, dep)) - || object.contains_key("version") - || object.contains_key("index") - { + if !file.as_str().is_some_and(|value| owned_url(value, dep)) { return Err(PlanError::Conflict(format!( "Pipenv source for {} already exists", dep.name ))); } + // Ours. A `version` Pipenv re-added next to it (`pipenv lock + // --keep-outdated`, `install --keep-outdated ` on 2022 + // write a file+version+index hybrid that still installs) must + // still name the patched release; then the entry is simply + // re-planned to the canonical shape. + if let Some(pinned) = object.get("version").and_then(Value::as_str) { + if pinned != format!("=={}", dep.version) { + return Err(PlanError::Conflict(format!( + "Pipenv version for {} does not match {}", + dep.name, dep.version + ))); + } + } if object.get(source_key).and_then(Value::as_str) == Some(&url) && object.get("hashes") == Some(&json!([format!("sha256:{sha}")])) + && !object.contains_key("version") + && !object.contains_key("index") { continue; } @@ -622,6 +649,71 @@ mod tests { assert!(!lock_targets(&files(&lock()), std::slice::from_ref(&npm))); } + /// `pipenv lock --keep-outdated` (2022) rewrites our entry into a + /// file+version+index hybrid that Pipenv still installs from: it is + /// ours, so it is re-planned to the canonical shape instead of being + /// refused as a foreign source (which also vetoed the sibling rewriters); + /// a hybrid naming ANOTHER version is a real conflict. + #[test] + fn owned_hybrid_entries_are_replanned_not_refused() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let (redirected, _) = plan(&lock(), &dep, None).unwrap(); + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["version"] = json!("==1.26.18"); + value["default"]["urllib3"]["index"] = json!("pypi"); + let hybrid = serde_json::to_string_pretty(&value).unwrap(); + let (fixed, edits) = plan(&hybrid, &dep, None).unwrap(); + assert!(!edits.is_empty(), "the hybrid is re-planned"); + let entry: Value = serde_json::from_str(&fixed).unwrap(); + assert!(entry["default"]["urllib3"].get("version").is_none()); + assert!(entry["default"]["urllib3"].get("index").is_none()); + assert!(entry["default"]["urllib3"]["file"].as_str().unwrap().contains("patch-one")); + + value["default"]["urllib3"]["version"] = json!("==2.0.0"); + let conflicting = serde_json::to_string(&value).unwrap(); + assert!(matches!( + plan(&conflicting, &dep, None), + Err(PlanError::Conflict(detail)) if detail.contains("does not match") + )); + } + + /// The Socket origin comes from the grant's own artifact URL, so a + /// `--patch-server-url` deployment recognizes its previous references + /// (rotation, idempotency) exactly like patch.socket.dev; a fork on + /// another host is never ours. + #[test] + fn owned_url_follows_the_grant_origin() { + let mut dep = dependency("urllib3", "1.26.18", "patch-one"); + let public = "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl"; + assert!(owned_url(public, &dep)); + assert!(!owned_url("https://example.org/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl", &dep)); + dep.artifact_url = "https://patches.internal.example:8443/patch/pypi/urllib3/1.26.18/tok/patch-one/urllib3-1.26.18-py3-none-any.whl".into(); + assert!(owned_url(&dep.artifact_url, &dep), "the grant's own origin is ours"); + assert!(owned_url(public, &dep), "and so is the public service"); + assert!(!owned_url("https://patches.internal.example:8443/patch/pypi/urllib3/1.26.19/tok/patch-one/urllib3-1.26.19-py3-none-any.whl", &dep), "another version is not"); + // Rotation on the custom origin restores through the chain. + let original = lock(); + let (first, edits) = plan(&original, &dep, None).unwrap(); + dep.artifact_url = dep.artifact_url.replace("/tok/", "/rotated/"); + let (second, rotation) = plan(&first, &dep, None).unwrap(); + let mut restored = second; + for edit in rotation.iter().chain(edits.iter()) { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + } + + #[test] + fn restore_refuses_a_non_object_ledger_original() { + let dep = dependency("urllib3", "1.26.18", "patch-one"); + let (text, edits) = plan(&lock(), &dep, None).unwrap(); + for bad in ["\"just a string\"", "[1, 2]", "not json at all", "{\"a\": 1}, \"injected\": {}"] { + let mut edit = edits[0].clone(); + edit.original = Some(Value::String(bad.to_string())); + assert!(restore(&text, &edit).is_err(), "{bad}"); + } + } + #[test] fn rollback_is_per_entry_preserves_unrelated_edits_and_refuses_drift() { let mut value: Value = serde_json::from_str(&lock()).unwrap(); diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index 119b8fd3..e67a8e22 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -651,13 +651,24 @@ pub async fn vendor_pypi_with_pipenv_version( Ok(p) => p, Err((code, detail)) => return refused(code, detail), }; - if pipenv_version + let installer = *pipenv_version .get_or_init(|| crate::utils::pipenv::installed_major(project_root)) - .await - .is_some_and(|major| major < 2018) - { + .await; + if installer.is_some_and(|major| major < 2018) { return refused("pypi_pipenv_installer_unsupported", "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode"); } + if installer.is_none() { + // Fail-open like hosted, but say so: the wiring assumes a + // 2018+ installer, and a Pipenv 7–11 project would not be + // able to consume it. + warnings.push(VendorWarning::new( + "pypi_pipenv_installer_unknown", + format!( + "Pipenv was not found on PATH; the vendored references assume Pipenv 2018 or later (Pipenv 7–11 cannot consume them — use hosted mode there). Set {}= to pin the installer release.", + crate::utils::pipenv::MAJOR_OVERRIDE_ENV + ), + )); + } match super::pypi_pipenv::check_target_guards( &project, &canon_name, diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index 3320ed93..e3f82479 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -132,10 +132,10 @@ pub(super) async fn load_pipenv_project( // self-documentation, not a pipenv-enforced check. let warnings = vec![VendorWarning::new( "vendor_integrity_unverified", - "Pipenv 2018 or later is required. Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (its file-ref \ - install phase invokes pip without --hash/--require-hashes), so the vendored wheel is \ - protected only by the committed wheel itself; `socket-patch vex` verifies the committed wheel \ - against its recorded artifact hash", + "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries \ + (2018–2022 verify them, 2023+ install a local wheel without checking), so the vendored \ + wheel is protected only by the committed wheel itself; `socket-patch vex --product ` \ + verifies the installed files against the patch record", )]; Ok(PipenvProject { lock, warnings }) } diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index b8a3c753..822bb94b 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -993,7 +993,10 @@ def cli_run(penv_, *rest, log): # preview runs no backend guard. informational = {"warmInstallReplacesUpstream"} if mode == "vendored": - informational.add("dryRunParity") + # The vendored backend re-serializes the whole lock with Pipenv's + # own `json.dumps` (LF), so a git-autocrlf CRLF lock comes back + # LF — exactly what `pipenv lock` would do; recorded, not required. + informational.update({"dryRunParity", "crlfPreserved"}) row["passed"] = all(val for k, val in checks.items() if k not in informational) return row From f5be9864c85d5742101f18738614a6eddbb0848e Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 17:34:31 -0400 Subject: [PATCH 16/27] ci(pipenv): run the live Pipenv matrix on Linux and macOS A dedicated workflow drives scripts/backtest-pipenv.py against the real CLI and real Pipenv releases (every 2018+ major on ubuntu-latest; 2018, 2022, 2023 and 2026 on macos-latest) through hosted, vendored, agent and out-of-tree agent mode, on pull requests that touch the Pipenv code paths, on pushes to main, and on demand. Windows real-Pipenv installs stay a local concern (the harness runs the pre-2018 releases in Docker and is POSIX layout-bound); the in-process hosted Pipenv CLI tests already run on all three platforms in the `test` job. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/pipenv-compatibility.yml | 88 ++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 .github/workflows/pipenv-compatibility.yml diff --git a/.github/workflows/pipenv-compatibility.yml b/.github/workflows/pipenv-compatibility.yml new file mode 100644 index 00000000..d7a24be5 --- /dev/null +++ b/.github/workflows/pipenv-compatibility.yml @@ -0,0 +1,88 @@ +name: Pipenv compatibility + +# Drives the real CLI and real Pipenv releases through hosted, vendored, +# agent and out-of-tree agent mode on Linux and macOS (the `test` job already +# runs the in-process hosted Pipenv CLI tests on all three platforms, +# Windows included). The pre-2018 releases need Docker and stay in the local +# matrix (`docs/testing/pipenv-compatibility.md`). Needs network (PyPI + the +# public patch service); no Socket token. + +on: + pull_request: + paths: + - 'crates/socket-patch-core/src/patch/redirect/pipenv.rs' + - 'crates/socket-patch-core/src/vendor/pypi_pipenv.rs' + - 'crates/socket-patch-core/src/vendor/pypi.rs' + - 'crates/socket-patch-core/src/vendor/lock_inventory.rs' + - 'crates/socket-patch-core/src/crawlers/python_crawler.rs' + - 'crates/socket-patch-core/src/utils/pipenv.rs' + - 'crates/socket-patch-cli/src/commands/scan/hosted.rs' + - 'scripts/backtest-pipenv.py' + - '.github/workflows/pipenv-compatibility.yml' + push: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + matrix: + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-latest + versions: 2018.11.26 2020.11.15 2021.11.23 2022.12.19 2023.12.1 2024.4.1 2025.1.3 2026.8.0 + - os: macos-latest + versions: 2018.11.26 2022.12.19 2023.12.1 2026.8.0 + runs-on: ${{ matrix.os }} + timeout-minutes: 60 + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Install Rust + run: rustup show + - name: Cache cargo + uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 + with: + key: pipenv-compat + save-if: ${{ github.ref == 'refs/heads/main' }} + - name: Install uv + uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0 + - name: Install the Pythons the Pipenv releases run on + run: uv python install 3.8 3.12 + - name: Build the CLI + run: | + cargo build --locked -p socket-patch-cli + mkdir -p "$RUNNER_TEMP/bin" + cp target/debug/socket-patch "$RUNNER_TEMP/bin/socket-patch" + - name: Run the Pipenv matrix + env: + SOCKET_NO_CONFIG: '1' + SOCKET_NO_UPDATE_CHECK: '1' + # The runners carry whatever patch release uv ships; the harness + # only needs one 3.8 and one 3.12. + BACKTEST_PY38: '3.8' + BACKTEST_PY312: '3.12' + PIPENV_VERSIONS: ${{ matrix.versions }} + run: | + # shellcheck disable=SC2086 + python3 scripts/backtest-pipenv.py \ + --socket-patch "$RUNNER_TEMP/bin/socket-patch" \ + --socket-patch-revision "$GITHUB_SHA" \ + --output "$RUNNER_TEMP/pipenv-compat" \ + --versions $PIPENV_VERSIONS \ + --shapes direct \ + --modes hosted vendored agent agent-oot \ + --jobs 4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + if: always() + with: + name: pipenv-compat-${{ matrix.os }} + path: | + ${{ runner.temp }}/pipenv-compat/summary.json + ${{ runner.temp }}/pipenv-compat/summary.md + if-no-files-found: warn + retention-days: 7 From 73827a5bb272fd733fa1862464d175c00bf733e8 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 17:38:56 -0400 Subject: [PATCH 17/27] fix(pypi): descend into Pipenv's nested interpreter-suffix virtualenv directories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pipenv 2018–2021 append the WHOLE `PIPENV_PYTHON` string to the virtualenv name (`--/opt/tools/bin/python`), so the venv sits at the bottom of a directory chain under WORKON_HOME; 2022+ append the basename. The crawler matched the top-level directory but looked for site-packages only directly beneath it, so a bare agent scan on Pipenv 2018 with an absolute PIPENV_PYTHON applied nothing (measured on Linux). The matched directory is now walked down (bounded depth, no name pruning — the chain literally contains `bin/python`) to the first directories holding a site-packages. Harness: pipfile-spec < 6 is now reported as `redirect_pipenv_skipped` in hosted mode (a skip, not a veto); agent-mode shapes Pipenv 0.x cannot express (inline-table markers/extras install nothing) are skipped with a note; the case-insensitive fallback test picks a project name whose recased hash carries no dash, since Pipenv's own `rsplit("-", 1)` cannot see one. Co-Authored-By: Claude Fable 5.1 --- .../src/crawlers/python_crawler.rs | 102 ++++++++++++++++-- scripts/backtest-pipenv.py | 13 ++- 2 files changed, 106 insertions(+), 9 deletions(-) diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs index af1f30ab..70c9305e 100644 --- a/crates/socket-patch-core/src/crawlers/python_crawler.rs +++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs @@ -323,7 +323,53 @@ async fn find_pipenv_virtualenv_site_packages_with( } let mut results = Vec::new(); for venv in venvs { - results.extend(find_site_packages_under(&venv, "site-packages").await); + let direct = find_site_packages_under(&venv, "site-packages").await; + if !direct.is_empty() { + results.extend(direct); + continue; + } + // Pipenv 2018–2021 append the FULL `PIPENV_PYTHON` string to the + // name (`--/usr/bin/python3`), so the virtualenv lives at + // the bottom of a directory chain under WORKON_HOME; 2022+ append the + // basename. Walk the chain down to the first directory that holds a + // site-packages (bounded, never following symlinks). + results.extend(find_nested_venv_site_packages(&venv, 12).await); + } + results +} + +/// The site-packages of the virtualenv(s) at the bottom of a directory +/// chain rooted at `dir` (see the caller): every directory that itself holds +/// a `site-packages` stops the descent there, and the depth is bounded. +async fn find_nested_venv_site_packages(dir: &Path, depth: usize) -> Vec { + if depth == 0 { + return Vec::new(); + } + let mut results = Vec::new(); + let Ok(mut entries) = tokio::fs::read_dir(dir).await else { + return results; + }; + let mut children = Vec::new(); + while let Ok(Some(entry)) = entries.next_entry().await { + let Ok(kind) = entry.file_type().await else { + continue; + }; + if !kind.is_dir() { + continue; + } + // No name-based pruning: the chain literally contains `bin/python` + // when PIPENV_PYTHON pointed at an interpreter, and the descent stops + // at the first directory that holds a site-packages anyway. + children.push(entry.path()); + } + children.sort(); + for child in children { + let here = find_site_packages_under(&child, "site-packages").await; + if !here.is_empty() { + results.extend(here); + } else { + results.extend(Box::pin(find_nested_venv_site_packages(&child, depth - 1)).await); + } } results } @@ -1204,6 +1250,35 @@ mod tests { /// and no in-project venv, `find_local_venv_site_packages` returns the /// out-of-tree Pipenv venv instead of nothing (which used to trigger the /// global fallback). + /// Pipenv 2018–2021 with an absolute PIPENV_PYTHON append the whole + /// interpreter path to the venv name, so the virtualenv sits at the + /// bottom of `/--///`; the crawler must + /// walk down to it. + #[tokio::test] + async fn pipenv_nested_interpreter_suffix_venv_is_discovered() { + let tmp = tempfile::tempdir().unwrap(); + let project = tmp.path().join("project"); + std::fs::create_dir_all(&project).unwrap(); + std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); + let workon = tmp.path().join("wh"); + std::fs::create_dir_all(&workon).unwrap(); + let real = std::fs::canonicalize(&project).unwrap(); + let hash = pipenv_venv_hash(&pipenv_path_string(&real.join("Pipfile"))); + let nested = fake_venv( + &workon, + &format!("project-{hash}-/opt/tools/2018.11.26/bin/python"), + ); + let workon_str = workon.to_string_lossy().into_owned(); + let var = move |name: &str| match name { + "WORKON_HOME" => Some(workon_str.clone()), + _ => None, + }; + assert_eq!( + find_pipenv_virtualenv_site_packages_with(&project, &var).await, + vec![nested] + ); + } + #[tokio::test] async fn pipenv_custom_name_and_dot_venv_file_pointer_are_honoured() { let tmp = tempfile::tempdir().unwrap(); @@ -1255,16 +1330,27 @@ mod tests { // where the hash was computed over the location with the recased // name spliced in (`_get_virtualenv_hash`'s fallback loop). let tmp = tempfile::tempdir().unwrap(); - let project = tmp.path().join("proj"); - std::fs::create_dir_all(&project).unwrap(); + // Pipenv's fallback (mirrored here) splits the directory name at its + // LAST dash, so a hash that contains a dash is invisible to Pipenv + // itself; pick a project name whose recased hash has none. + let (project, recased_hash) = (0..64) + .map(|i| { + let project = tmp.path().join(format!("proj{i}")); + std::fs::create_dir_all(&project).unwrap(); + let real = std::fs::canonicalize(&project).unwrap(); + let location = pipenv_path_string(&real.join("Pipfile")); + let recased = location.replace(&format!("proj{i}"), &format!("Proj{i}")); + (project, pipenv_venv_hash(&recased)) + }) + .find(|(_, hash)| !hash.contains('-')) + .expect("some project name yields a dash-free hash"); + let name = project.file_name().unwrap().to_string_lossy().into_owned(); std::fs::write(project.join("Pipfile"), "[packages]\n").unwrap(); let workon = tmp.path().join("wh"); std::fs::create_dir_all(&workon).unwrap(); - let real = std::fs::canonicalize(&project).unwrap(); - let location = pipenv_path_string(&real.join("Pipfile")); - let recased_hash = pipenv_venv_hash(&location.replace("proj", "Proj")); - let recased = fake_venv(&workon, &format!("Proj-{recased_hash}")); - let _wrong = fake_venv(&workon, "Proj-CCCCCCCC"); + let recased_name = name.replacen("proj", "Proj", 1); + let recased = fake_venv(&workon, &format!("{recased_name}-{recased_hash}")); + let _wrong = fake_venv(&workon, &format!("{recased_name}-CCCCCCCC")); let workon_str = workon.to_string_lossy().into_owned(); let var = move |name: &str| match name { "WORKON_HOME" => Some(workon_str.clone()), diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index 822bb94b..01426094 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -624,6 +624,15 @@ def cli_run(penv_, *rest, log): python = venv / "bin/python" penv = pipenv_env(version, tool) + # Pipenv 0.x installs plain string pins only: inline-table entries with + # markers / extras are not understood, so nothing gets installed for + # agent mode to patch — nothing to measure there. + if mode in ("agent", "agent-oot") and major < 3 and shape in ("marker", "marker-excluded", "extras"): + row["supported"] = False + row["expected"] = "skipped: Pipenv 0.x does not understand inline-table (markers/extras) Pipfile entries" + row["passed"] = True + return row + # --------------------------------------------------------- agent-oot if mode == "agent-oot": if major < 3: @@ -820,7 +829,9 @@ def cli_run(penv_, *rest, log): # ---- expected refusals (pre-2018 majors) refusal = None if spec != 6: - refusal = ("unsupported-lock-spec", "redirect_pipenv_refused" if mode == "hosted" else "pypi_pipenv_spec_unsupported") + # Hosted: an old lock says nothing about the project's other install + # files, so it is a SKIP (not a veto) — `redirect_pipenv_skipped`. + refusal = ("unsupported-lock-spec", "redirect_pipenv_skipped" if mode == "hosted" else "pypi_pipenv_spec_unsupported") elif legacy and mode == "vendored": refusal = ("unsupported-vendored-installer", "pypi_pipenv_installer_unsupported") if refusal: From 4ce99eca0d5af4d797990ee198e1252337a9412e Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Thu, 17 Sep 2026 17:46:50 -0400 Subject: [PATCH 18/27] =?UTF-8?q?test(pipenv):=20harness=20expectations=20?= =?UTF-8?q?for=20Pipenv=200.x=E2=80=936.x=20agent=20shapes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pipenv 0.x–6.x install plain string pins only (inline-table markers are ignored, extras fail to install) and 0.x cannot stamp the transitive Pipfile's content hash, so those agent-mode cells are skipped with a note instead of measuring an installer limitation; hosted refusals for pipfile-spec < 6 are expected as `redirect_pipenv_skipped`. Co-Authored-By: Claude Fable 5.1 --- scripts/backtest-pipenv.py | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index 01426094..04463028 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -597,6 +597,12 @@ def backtest_case(job): if case.exists(): shutil.rmtree(case) case.mkdir(parents=True) + if major < 3 and shape == "transitive": + # Pipenv 0.x has no `pipfile` module to stamp the Pipfile content + # hash with, so the transitive Pipfile cannot be paired with the + # generated lock (`pipenv install` would re-lock on the mismatch). + return {"pipenv": version, "shape": shape, "mode": mode, "invocation": invocation, "pipfileSpec": None, "supported": False, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", "checks": {}, "info": {}, "passed": True} original = native_lock(version, tool, shape) project = (case / "nested" / "app") if invocation == "subdir" else (case / "project") project.mkdir(parents=True) @@ -627,9 +633,14 @@ def cli_run(penv_, *rest, log): # Pipenv 0.x installs plain string pins only: inline-table entries with # markers / extras are not understood, so nothing gets installed for # agent mode to patch — nothing to measure there. - if mode in ("agent", "agent-oot") and major < 3 and shape in ("marker", "marker-excluded", "extras"): + if mode in ("agent", "agent-oot") and major < 7 and shape in ("marker", "marker-excluded", "extras"): + # Pipenv 0.x–6.x install plain string pins only: inline-table + # entries are mis-handled (markers ignored, extras fail to + # install), so there is nothing meaningful for agent mode to + # measure; hosted/vendored rows for these releases are refusals + # judged before any install. row["supported"] = False - row["expected"] = "skipped: Pipenv 0.x does not understand inline-table (markers/extras) Pipfile entries" + row["expected"] = "skipped: Pipenv 0.x–6.x mishandle inline-table (markers/extras) Pipfile entries" row["passed"] = True return row From 61f4f1610ccf4d6c50366ed186e171aa6ce64940 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 09:59:20 -0400 Subject: [PATCH 19/27] fix(pipenv): make both rollbacks survive every Pipenv relock, scope the stale probes to the project's venvs, recover lock-only re-scans from the ledger MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verification round on the fix branch (23 deduplicated findings, three adversarial lenses each) plus the full 18-major matrix surfaced what the first fixes left open; all confirmed empirically against real Pipenv: - Rollback tolerance (hosted `restore()` and vendored `revert_pipenv`): entries are compared as parsed JSON, so a whole-file CRLF/LF conversion (git autocrlf, a cross-OS checkout) is not drift and the original is spliced back in the live file's line ending; an entry Pipenv re-serialized around our very reference — 2023+ relock an entry excluded by its marker keeping our `file` but restoring the registry `hashes` and `version`; `--keep-outdated` re-adds `version`/`index` — restores the original (only `hashes`/`version`/`index` may differ; a changed marker or reference is still drift); an entry a relock DROPPED (`pipenv uninstall`) retires the edit / the vendored record (`vendor_lock_entry_relocked`). The replay stages the lock only when the restore changed it (no `editedFiles` credit for a retired edit). - Live-lock veto: a conflicting pin vetoes the sibling Python rewriters only when a Pipfile sits beside the lock; an abandoned Pipfile.lock refuses its own rewrite but leaves requirements.txt / uv.lock alone. `Pipfile` joins the hosted candidate files (read-only). - Stale probes judge the PROJECT'S venvs only (VIRTUAL_ENV, ./.venv, ./venv, Pipenv's WORKON_HOME venv): the hosted probe no longer falls through to the global interpreters, and the vendored one no longer judges the staging dir a lock-only vendor fetched the pristine wheel into (a false `pypi_pipenv_stale_install` on every lock-only run). It also runs on the already-wired arm so a re-run keeps warning while the venv is stale. - Lock-only re-scans were one-shot: after the first vendored run the inventory skips our own wiring and the re-scan exited 1 `package_not_installed`. `recover_lock_entry` now reads the pre-vendor Pipfile.lock fragment from the ledger (its digest set) so the re-scan fetches by digest and reports `already_vendored`. - Vendored CRLF: Pipenv preserves a CRLF lock; the wire and revert writes now do too (the matrix's 8 CRLF vendored cells restore byte-identically). - Version probe: neutral working directory (the scanned repository's `.env`, Pipfile and `.venv` pointer no longer reach it), executable-bit check on PATH candidates, `SOCKET_PIPENV_MAJOR` accepts a full release string, `PIPENV_IGNORE_VIRTUALENVS`; the `redirect_pipenv_installer_unknown` detail lost its stray whitespace. - Messages: a HOSTED Socket reference met by the vendored guards names the remedy (`socket-patch rollback`) instead of "user-declared". - Docs: CLI_CONTRACT (live-lock veto, JSON-compared rollback, removed entries, `pypi_pipenv_installer_unknown`), hosted-production-e2e.md rows, pipenv-compatibility.md (CLI scope, line endings, relock variants). Harness: CRLF preservation required for vendored again; Pipenv 7's out-of-tree venv creation is an image limitation and is skipped. Co-Authored-By: Claude Fable 5.1 --- crates/socket-patch-cli/CLI_CONTRACT.md | 5 +- .../src/commands/scan/hosted.rs | 28 ++- .../src/patch/redirect/mod.rs | 7 + .../src/patch/redirect/pipenv.rs | 161 ++++++++++++++++-- .../src/patch/redirect/replay.rs | 18 +- crates/socket-patch-core/src/utils/pipenv.rs | 72 +++++++- .../src/vendor/lock_inventory.rs | 32 ++++ crates/socket-patch-core/src/vendor/pypi.rs | 106 +++++++++--- .../src/vendor/pypi_pipenv.rs | 98 +++++++++-- docs/testing/hosted-production-e2e.md | 4 +- docs/testing/pipenv-compatibility.md | 17 +- scripts/backtest-pipenv.py | 16 +- 12 files changed, 488 insertions(+), 76 deletions(-) diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md index a351d3d0..ac566cb3 100644 --- a/crates/socket-patch-cli/CLI_CONTRACT.md +++ b/crates/socket-patch-cli/CLI_CONTRACT.md @@ -124,7 +124,7 @@ The rewriter reads a fixed set of candidate files from the project root: the npm **Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using ` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract. -**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and warns `redirect_pipenv_stale_install` naming the site-packages dir and the verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry (drift = the entry is neither the recorded original nor the rewrite); a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. +**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and warns `redirect_pipenv_stale_install` naming the site-packages dir and the verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry, compared as parsed JSON (a whole-file CRLF/LF conversion or a Pipenv re-serialization that kept our reference and hashes is not drift; the original is spliced back in the live file's line ending); an entry a relock removed retires the edit; a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. **Mode ledgers (contract surfaces).** Each committable mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write these files, so path + schema are part of the contract: @@ -1079,7 +1079,8 @@ Every `--json` invocation emits a single JSON object that follows the **unified | `pypi_pipenv_installer_unsupported` | `failed` | vendor (pipenv): the installed Pipenv is older than 2018 and cannot consume vendored wheel references — upgrade Pipenv or use hosted mode. | | `pypi_pipenv_version_mismatch` / `pypi_pipenv_invalid_wheel` | `failed` | vendor (pipenv): a category pins a different version than the patch (or the wheel filename carries no version) — refused before any write. | | `pypi_pipenv_stale_install` | `skipped` (warning) | vendor (pipenv): the twin of `redirect_pipenv_stale_install` for the vendored wiring. | -| `vendor_lock_entry_relocked` | revert `warnings[]` | vendor `--revert` / rollback (pipenv): a relock regenerated the wired entry to a registry reference; the record is retired (artifact removed, ledger entry dropped) instead of drift-kept. | +| `pypi_pipenv_installer_unknown` | `skipped` (warning) | vendor (pipenv): no `pipenv` answered on PATH; the vendored references assume Pipenv 2018 or later (7–11 cannot consume them — use hosted mode there); `SOCKET_PIPENV_MAJOR` pins the release. | +| `vendor_lock_entry_relocked` | revert `warnings[]` | vendor `--revert` / rollback (pipenv): a relock regenerated the wired entry to a registry reference, or removed it; the record is retired (artifact removed, ledger entry dropped) instead of drift-kept. | | `pypi_{poetry,pdm,pipenv}_no_lockfile` | `failed` | vendor (pypi): a lock-less tool marker with no `requirements.txt` fallback — run ` lock`. | | `vendor_prebuilt_stub_invalid` | `failed` / `skipped` (warning) | vendor (gem, `--vendor-source`): the served stub gemspec fails the rubygems `summary`/`authors` bar, so bundler would refuse the vendored path source at install time. `service`: refusal naming the missing attributes; `auto`: loud warning + local-build fallback — or, when the gem is also not installed locally (no stub to derive), a refusal naming the served defect and the install-the-gem remedy. | | `gem_spec_invalid` | `failed` | vendor (gem): the LOCAL `specifications/` stub gemspec fails the same rubygems `summary`/`authors` bar (a corrupted or hand-edited gem home); the refusal names the file — reinstall the gem (`gem pristine ` / fresh `bundle install`). | diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs index 1ecc4912..ca08010d 100644 --- a/crates/socket-patch-cli/src/commands/scan/hosted.rs +++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs @@ -571,15 +571,25 @@ async fn pipenv_stale_install_warnings( return out; } let crawler = PythonCrawler::new(); - let options = CrawlerOptions { - cwd: cwd.to_path_buf(), - global, - global_prefix, + // Only venvs that belong to THIS project (VIRTUAL_ENV, ./.venv, ./venv, + // Pipenv's WORKON_HOME venv): the crawler's project-marker fallback to + // the global interpreters would judge some unrelated Python's copy of + // the release (a tool venv on PATH) and warn about a venv Pipenv never + // installs into — a false positive that also fails the same-run --vex. + // --global / --global-prefix keep their explicit meaning. + let site_packages = if global || global_prefix.is_some() { + let options = CrawlerOptions { + cwd: cwd.to_path_buf(), + global, + global_prefix, + }; + crawler + .get_site_packages_paths(&options) + .await + .unwrap_or_default() + } else { + socket_patch_core::crawlers::python_crawler::find_local_venv_site_packages(cwd).await }; - let site_packages = crawler - .get_site_packages_paths(&options) - .await - .unwrap_or_default(); for (purl, record) in &candidates { let stripped = strip_purl_qualifiers(purl).to_string(); let mut stale_dirs: Vec = Vec::new(); @@ -1546,7 +1556,7 @@ pub(crate) async fn run_redirect_selected( rewrite.warnings.push(socket_patch_core::patch::redirect::RewriteWarning { code: "redirect_pipenv_installer_unknown".into(), detail: format!( - "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}= and re-run `scan --mode hosted`.", + "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}= and re-run `scan --mode hosted`.", socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV ), }); diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs index 059fa758..27c11ec6 100644 --- a/crates/socket-patch-core/src/patch/redirect/mod.rs +++ b/crates/socket-patch-core/src/patch/redirect/mod.rs @@ -220,6 +220,13 @@ pub fn pipenv_lock_targets(files: &BTreeMap, overrides: &[DepOve pipenv::lock_targets(files, overrides) } +/// Whether a live Pipfile.lock entry is the one Socket wrote, re-serialized by +/// a Pipenv relock (same `file`/`path` reference; only `hashes`/`version`/ +/// `index` may differ). Shared with the vendored backend's revert. +pub fn pipenv_reserialized_around_reference(live: &serde_json::Value, ours: &serde_json::Value) -> bool { + pipenv::reserialized_around_reference(live, ours) +} + pub fn rewrite_registry_redirect_with_pipenv_version( files: &BTreeMap, overrides: &[DepOverride], diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs index 0576efa5..960de90d 100644 --- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs +++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs @@ -129,6 +129,39 @@ fn format_entry(value: &Value, text: &str, start: usize) -> Result bool { + let (Some(live), Some(ours)) = (live.as_object(), ours.as_object()) else { + return false; + }; + let reference = |object: &serde_json::Map| { + object + .get("file") + .or_else(|| object.get("path")) + .and_then(Value::as_str) + .map(str::to_owned) + }; + let Some(our_reference) = reference(ours) else { + return false; + }; + if reference(live) != Some(our_reference) { + return false; + } + const RELOCK_REWRITES: [&str; 5] = ["hashes", "version", "index", "file", "path"]; + live.keys() + .chain(ours.keys()) + .filter(|key| !RELOCK_REWRITES.contains(&key.as_str())) + .all(|key| live.get(key) == ours.get(key)) +} + pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { if edit.path != "Pipfile.lock" { return Err("Pipenv edit must target Pipfile.lock".into()); @@ -152,15 +185,31 @@ pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { .as_ref() .and_then(Value::as_str) .ok_or("missing Pipenv replacement")?; - let (_, entry) = entries(text)? + let Some((_, entry)) = entries(text)? .into_iter() .find(|(category, entry)| category == §ion && entry.name == name) - .ok_or("Pipenv entry missing")?; + else { + // A relock that DROPPED the entry (`pipenv uninstall `, a Pipfile + // edit + `pipenv lock`): the redirect is gone with it — nothing to + // unwind, the edit retires. + return Ok(text.into()); + }; let live = &text[entry.range.clone()]; - if live == original { + let ending = if text.contains("\r\n") { "\r\n" } else { "\n" }; + let original_value: Value = serde_json::from_str(original).map_err(|e| e.to_string())?; + let new_value: Option = serde_json::from_str(new).ok(); + // Comparisons are SEMANTIC (parsed JSON), so a line-ending conversion of + // the whole file (git autocrlf, a cross-OS checkout) or a re-serialization + // that only moved whitespace is neither drift nor a reason to refuse. + if live == original || entry.value == original_value { return Ok(text.into()); } - if live != new { + // "Still ours": Pipenv re-serialized the entry around the very reference + // we wrote (see [`reserialized_around_reference`]). + let same_reference = new_value + .as_ref() + .is_some_and(|new_value| reserialized_around_reference(&entry.value, new_value)); + if live != new && new_value.as_ref() != Some(&entry.value) && !same_reference { // A relock (`pipenv lock`, `pipenv update`, `pipenv install ` // on <= 2023) regenerates the entry to registry shape: the redirect // is already gone and the user's fresh resolution is the desired end @@ -176,8 +225,16 @@ pub(super) fn restore(text: &str, edit: &FileEdit) -> Result { } return Err(format!("Pipenv entry {section}.{name} drifted")); } + // Still our reference (byte-identical, re-serialized by Pipenv, or a + // `--keep-outdated` hybrid that kept our `file`/`path`): splice the + // recorded original back, in the live file's line ending. + let restored = if ending == "\r\n" { + original.replace("\r\n", "\n").replace('\n', "\r\n") + } else { + original.replace("\r\n", "\n") + }; let mut result = text.to_owned(); - result.replace_range(entry.range, original); + result.replace_range(entry.range, &restored); Ok(result) } @@ -231,13 +288,23 @@ pub(super) fn rewrite( // the project installs from: warn and leave the siblings alone, // or a stale Pipfile.lock left behind in a uv / Poetry / // requirements project blocks every hosted redirect. - Err(PlanError::Conflict(detail)) => { + // …but only for a LIVE lock. A Pipfile.lock with no Pipfile + // beside it is abandoned (nothing installs from it), so even a + // conflicting pin says nothing about the project's real install + // files: refuse this file, leave the siblings alone. + Err(PlanError::Conflict(detail)) if files.contains_key("Pipfile") => { result.refused_pipenv_uuids.insert(dep.patch_uuid.clone()); result.warnings.push(RewriteWarning { code: "redirect_pipenv_refused".into(), detail, }); } + Err(PlanError::Conflict(detail)) => { + result.warnings.push(RewriteWarning { + code: "redirect_pipenv_refused".into(), + detail: format!("{detail} (no Pipfile beside the lock: the sibling Python files are still redirected)"), + }); + } Err(PlanError::Skip(detail)) => { result.warnings.push(RewriteWarning { code: "redirect_pipenv_skipped".into(), @@ -485,7 +552,11 @@ mod tests { let is_null = bad.is_null(); value["tests"]["urllib3"] = bad; let original = serde_json::to_string(&value).unwrap(); - let files = BTreeMap::from([("Pipfile.lock".into(), original)]); + // A live lock (Pipfile beside it): conflicts veto the siblings. + let files = BTreeMap::from([ + ("Pipfile".to_string(), "[packages]\nurllib3 = \"*\"\n".to_string()), + ("Pipfile.lock".to_string(), original), + ]); let mut result = RewriteResult::default(); rewrite(&files, std::slice::from_ref(&dep), None, &mut result); assert!(result.files.is_empty()); @@ -740,12 +811,19 @@ mod tests { } for edit in &first_edits { let replacement = edit.new.as_ref().unwrap().as_str().unwrap(); - let drift = two.replacen( - replacement, - &replacement.replace("sha256:", &format!("sha256:{}", "0")), - 1, - ); + // A tampered reference (its `#sha256=` pin) is drift… + let drift = two.replacen(replacement, &replacement.replace("#sha256=", "#sha256=0"), 1); assert!(restore(&drift, edit).is_err()); + // …while a re-serialized entry that kept our reference (Pipenv + // 2023+ relocking a marker-excluded entry restores the registry + // `hashes` and `version` next to it) is still ours and restores. + let mut value: Value = serde_json::from_str(&two).unwrap(); + let section: &str = serde_json::from_str::<[String; 2]>(edit.key.as_deref().unwrap()).unwrap()[0].clone().leak(); + value[section]["urllib3"]["hashes"] = json!(["sha256:upstream-a", "sha256:upstream-b"]); + value[section]["urllib3"]["version"] = json!("==1.26.18"); + let kept = serde_json::to_string_pretty(&value).unwrap(); + let restored: Value = serde_json::from_str(&restore(&kept, edit).unwrap()).unwrap(); + assert!(restored[section]["urllib3"].get("file").is_none(), "{restored}"); let mut unsafe_edit = edit.clone(); unsafe_edit.path = "../Pipfile.lock".into(); assert!(restore(&two, &unsafe_edit).is_err()); @@ -784,15 +862,72 @@ mod compatibility_tests { fn conflicting_pipenv_pin_cannot_partially_redirect_requirements() { let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); let files = BTreeMap::from([ + ("Pipfile".into(), "[packages]\nurllib3 = \"==2.0\"\n".into()), ( "Pipfile.lock".into(), super::tests::lock().replace("==1.26.18", "==2.0"), ), ("requirements.txt".into(), "urllib3==1.26.18\n".into()), ]); - let result = super::super::rewrite_registry_redirect(&files, &[dep]); + let result = super::super::rewrite_registry_redirect(&files, &[dep.clone()]); assert!(result.files.is_empty()); assert!(result.edits.is_empty()); assert!(result.refused_pipenv_uuids.contains("patch-one")); + + // The same conflicting lock with NO Pipfile beside it is abandoned: + // the requirements pin is what installs, so it is redirected. + let mut abandoned = files.clone(); + abandoned.remove("Pipfile"); + let result = super::super::rewrite_registry_redirect(&abandoned, &[dep]); + assert!(!result.refused_pipenv_uuids.contains("patch-one")); + assert!(result.files["requirements.txt"].contains("patch.socket.dev")); + assert!(!result.files.contains_key("Pipfile.lock")); + assert!(result.warnings.iter().any(|w| w.code == "redirect_pipenv_refused" && w.detail.contains("no Pipfile"))); + } + + /// Rollback survives what git and Pipenv do to the lock between the + /// redirect and the revert: a whole-file CRLF<->LF conversion, Pipenv + /// re-serializing our entry (a `--keep-outdated` hybrid that kept our + /// reference), and a relock that dropped the entry altogether. + #[test] + fn rollback_tolerates_line_ending_conversion_hybrids_and_dropped_entries() { + let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one"); + let original = super::tests::lock(); + let (redirected, edits) = plan(&original, &dep, None).unwrap(); + // CRLF conversion of the redirected file → restores the original in CRLF. + let crlf = redirected.replace('\n', "\r\n"); + let mut restored = crlf; + for edit in edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original.replace('\n', "\r\n")); + // LF file, CRLF-recorded edits (the redirect ran on a CRLF checkout). + let crlf_original = original.replace('\n', "\r\n"); + let (crlf_redirected, crlf_edits) = plan(&crlf_original, &dep, None).unwrap(); + let mut restored = crlf_redirected.replace("\r\n", "\n"); + for edit in crlf_edits.iter().rev() { + restored = restore(&restored, edit).unwrap(); + } + assert_eq!(restored, original); + // Hybrid: Pipenv re-added version/index next to our reference. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["version"] = json!("==1.26.18"); + value["default"]["urllib3"]["index"] = json!("pypi"); + let hybrid = serde_json::to_string_pretty(&value).unwrap(); + let default_edit = edits.iter().find(|e| e.key.as_deref() == Some(r#"["default","urllib3"]"#)).unwrap(); + let restored = restore(&hybrid, default_edit).unwrap(); + let value: Value = serde_json::from_str(&restored).unwrap(); + assert_eq!(value["default"]["urllib3"]["version"], json!("==1.26.18")); + assert!(value["default"]["urllib3"].get("file").is_none(), "{restored}"); + // Dropped entry (`pipenv uninstall`): nothing to unwind, retires. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"].as_object_mut().unwrap().remove("urllib3"); + let dropped = serde_json::to_string_pretty(&value).unwrap(); + assert_eq!(restore(&dropped, default_edit).unwrap(), dropped); + // A foreign reference is still drift. + let mut value: Value = serde_json::from_str(&redirected).unwrap(); + value["default"]["urllib3"]["file"] = json!("https://example.org/fork.whl"); + let foreign = serde_json::to_string_pretty(&value).unwrap(); + assert!(restore(&foreign, default_edit).is_err()); } } diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs index 00a0724d..bd721653 100644 --- a/crates/socket-patch-core/src/patch/redirect/replay.rs +++ b/crates/socket-patch-core/src/patch/redirect/replay.rs @@ -414,13 +414,20 @@ pub async fn revert_remaining_redirect_edits( } Inverse::PipenvEntry => { let restored = match staged_read(&staged, project_root, &edit.path).await { - Ok(Some(content)) => super::pipenv::restore(&content, &edit), + Ok(Some(content)) => { + super::pipenv::restore(&content, &edit).map(|restored| (content, restored)) + } Ok(None) => Err(format!("{} no longer exists", edit.path)), Err(error) => Err(error), }; match restored { - Ok(content) => { - staged.insert(edit.path.clone(), Some(content)); + Ok((content, restored)) => { + // An already-unwound or retired entry returns the + // text unchanged: no write, no `editedFiles` credit + // (mirrors the ReplaceFragment already-original arm). + if restored != content { + staged.insert(edit.path.clone(), Some(restored)); + } group_drops.insert(idx); } Err(error) => { @@ -2112,8 +2119,11 @@ mod tests { for drift in [false, true] { let dir = TempDir::new().unwrap(); let text = result.files["Pipfile.lock"].clone(); + // Drift = the REFERENCE itself changed (its `#sha256=` pin here); + // a hashes-only change next to an intact reference is what a + // Pipenv relock does and rolls back (see pipenv::restore). let live = if drift { - text.replacen("sha256:", "sha256:0", 1) + text.replacen("#sha256=", "#sha256=0", 1) } else { text }; diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs index 91a65ff4..32e23b93 100644 --- a/crates/socket-patch-core/src/utils/pipenv.rs +++ b/crates/socket-patch-core/src/utils/pipenv.rs @@ -11,6 +11,14 @@ use std::path::{Path, PathBuf}; /// default pipenv. pub const MAJOR_OVERRIDE_ENV: &str = "SOCKET_PIPENV_MAJOR"; +/// `SOCKET_PIPENV_MAJOR` accepts the bare major (`11`, `2026`) or the full +/// release as `pipenv --version` prints it (`11.10.4`, `2026.8.0`); anything +/// else is ignored (the probe then runs as if the variable were unset). +fn parse_override(value: &str) -> Option { + let value = value.trim().trim_start_matches('v'); + value.split('.').next()?.parse::().ok() +} + /// `pipenv, version 2026.8.0` — every release from 0.2.8 through 2026.8.0 /// prints exactly this shape on stdout (measured). Only the token after /// `version` counts: a bare dotted number elsewhere (a `Python 3.12` banner @@ -60,7 +68,7 @@ fn resolve_on_path(var: &impl Fn(&str) -> Option) -> Option { } for ext in &extensions { let candidate = dir.join(format!("pipenv{ext}")); - if candidate.is_file() { + if candidate.is_file() && is_executable(&candidate) { return Some(candidate); } } @@ -68,6 +76,22 @@ fn resolve_on_path(var: &impl Fn(&str) -> Option) -> Option { None } +/// A plain file that cannot be executed (a stray `pipenv` data file on PATH) +/// is skipped in favour of the next entry, like execvp does; Windows has no +/// mode bits, PATHEXT is the executability rule there. +fn is_executable(path: &Path) -> bool { + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + std::fs::metadata(path).is_ok_and(|m| m.permissions().mode() & 0o111 != 0) + } + #[cfg(not(unix))] + { + let _ = path; + true + } +} + fn is_batch_shim(program: &Path) -> bool { cfg!(windows) && program.extension().is_some_and(|ext| { @@ -83,7 +107,7 @@ fn is_batch_shim(program: &Path) -> bool { pub async fn installed_major(root: &Path) -> Option { if let Some(forced) = std::env::var(MAJOR_OVERRIDE_ENV) .ok() - .and_then(|value| value.trim().parse::().ok()) + .and_then(|value| parse_override(&value)) { return Some(forced); } @@ -95,13 +119,17 @@ pub async fn installed_major(root: &Path) -> Option { } else { tokio::process::Command::new(&program) }; + // The version banner does not depend on a project, so the probe runs in a + // NEUTRAL directory: with the scanned repository as cwd, Pipenv would read + // its `.env`, `Pipfile` and `.venv` pointer — committed, attacker-shaped + // inputs that must not influence (or slow down) a version check. + let _ = root; command .arg("--version") - .current_dir(root) - // Pipenv loads the project's `.env` before answering; a broken or - // hostile one must not break (or slow down) the version banner. + .current_dir(std::env::temp_dir()) .env("PIPENV_DONT_LOAD_ENV", "1") .env("PIPENV_NOSPIN", "1") + .env("PIPENV_IGNORE_VIRTUALENVS", "1") .kill_on_drop(true); let output = tokio::time::timeout(std::time::Duration::from_secs(10), command.output()) .await @@ -146,6 +174,11 @@ mod tests { std::fs::create_dir_all(&bin).unwrap(); let leaf = if cfg!(windows) { "pipenv.exe" } else { "pipenv" }; std::fs::write(bin.join(leaf), b"").unwrap(); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt; + std::fs::set_permissions(bin.join(leaf), std::fs::Permissions::from_mode(0o755)).unwrap(); + } // A repo-planted `pipenv` under a RELATIVE entry must never win. let planted = tmp.path().join("planted"); std::fs::create_dir_all(&planted).unwrap(); @@ -167,6 +200,35 @@ mod tests { assert_eq!(resolve_on_path(&none), None); } + #[cfg(unix)] + #[test] + fn resolve_on_path_skips_non_executable_files() { + use std::os::unix::fs::PermissionsExt; + let tmp = tempfile::tempdir().unwrap(); + let data = tmp.path().join("data"); + let bin = tmp.path().join("bin"); + std::fs::create_dir_all(&data).unwrap(); + std::fs::create_dir_all(&bin).unwrap(); + std::fs::write(data.join("pipenv"), b"not a program").unwrap(); + std::fs::set_permissions(data.join("pipenv"), std::fs::Permissions::from_mode(0o644)).unwrap(); + std::fs::write(bin.join("pipenv"), b"").unwrap(); + std::fs::set_permissions(bin.join("pipenv"), std::fs::Permissions::from_mode(0o755)).unwrap(); + let joined = std::env::join_paths([data.clone(), bin.clone()]).unwrap(); + let var = |name: &str| (name == "PATH").then(|| joined.clone()); + assert_eq!(resolve_on_path(&var), Some(bin.join("pipenv"))); + } + + #[test] + fn override_accepts_a_major_or_a_full_release() { + assert_eq!(parse_override("11"), Some(11)); + assert_eq!(parse_override(" 2026 "), Some(2026)); + assert_eq!(parse_override("11.10.4"), Some(11)); + assert_eq!(parse_override("v2018.11.26"), Some(2018)); + assert_eq!(parse_override("eleven"), None); + assert_eq!(parse_override(""), None); + assert_eq!(parse_override("-11"), None); + } + #[cfg(windows)] #[test] fn resolve_on_path_honours_pathext_shims() { diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 55fd5ebe..6f8a6d24 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -1680,6 +1680,38 @@ pub async fn recover_lock_entry( const NO_URL: &str = "the pre-vendor pypi lock fragment records the wheel hash but \ no fetchable registry URL (only uv.lock and pdm `static_urls` locks carry wheel \ URLs); reinstall the package so repair can rebuild from the installed copy"; + // Pipenv's pre-vendor entry is a JSON object carrying every + // release file's sha256 (`"hashes": ["sha256:…", …]`): fetchable + // by digest through PyPI's JSON API like a fresh Pipfile.lock + // inventory entry, so a lock-only checkout of an already-vendored + // project re-scans green instead of `package_not_installed`. + if let Some(object) = fragment.as_object() { + let digests: Vec = object + .get("hashes") + .and_then(serde_json::Value::as_array) + .into_iter() + .flatten() + .filter_map(serde_json::Value::as_str) + .filter_map(|h| h.strip_prefix("sha256:")) + .filter(|h| is_hex_of_len(h, 64)) + .map(|h| h.to_ascii_lowercase()) + .collect(); + if digests.is_empty() { + return Err( + "the pre-vendor Pipfile.lock entry records no sha256 digests; reinstall the \ + package so repair can rebuild from the installed copy" + .to_string(), + ); + } + return Ok(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{name}@{version}"), + name, + version, + resolved: None, + integrity: LockIntegrity::Sha256AnyOf(digests), + }); + } let unit = fragment.as_str().ok_or_else(|| NO_URL.to_string())?; let (url, sha) = pure_wheel_from_uv_unit(unit).ok_or_else(|| NO_URL.to_string())?; Ok(LockfileEntry { diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs index e67a8e22..539a0149 100644 --- a/crates/socket-patch-core/src/vendor/pypi.rs +++ b/crates/socket-patch-core/src/vendor/pypi.rs @@ -463,41 +463,62 @@ pub async fn vendor_pypi( /// bytes hashing to something other than the record's afterHash); an /// already-patched (agent-mode) install and a lock-only checkout stay silent. async fn pipenv_stale_install_warning( - site_packages: &Path, + project_root: &Path, purl: &str, record: &PatchRecord, ) -> Option { + use crate::crawlers::python_crawler::{find_local_venv_site_packages, PythonCrawler}; use crate::patch::apply::{verify_file_patch, VerifyStatus}; - if record.files.is_empty() - || crate::vex::verify::verify_patch_record(site_packages, record) - .await - .is_ok() - { + if record.files.is_empty() { return None; } - let mut stale = false; - for (file, info) in &record.files { - let result = verify_file_patch(site_packages, file, info).await; - if matches!( - result.status, - VerifyStatus::Ready | VerifyStatus::HashMismatch - ) && result.current_hash.is_some() + // Judged over the PROJECT'S venvs (VIRTUAL_ENV, ./.venv, ./venv, Pipenv's + // WORKON_HOME venv) — never the staging dir a lock-only vendor fetched + // the pristine wheel into, and never the global interpreters. + let base = strip_purl_qualifiers(purl).to_string(); + let crawler = PythonCrawler::new(); + let mut stale_dirs: Vec = Vec::new(); + for site in find_local_venv_site_packages(project_root).await { + let found = crawler + .find_by_purls(&site, std::slice::from_ref(&base)) + .await + .unwrap_or_default(); + if !found.contains_key(&base) { + continue; + } + if crate::vex::verify::verify_patch_record(&site, record) + .await + .is_ok() { - stale = true; - break; + continue; + } + for (file, info) in &record.files { + let result = verify_file_patch(&site, file, info).await; + if matches!( + result.status, + VerifyStatus::Ready | VerifyStatus::HashMismatch + ) && result.current_hash.is_some() + { + stale_dirs.push(site.clone()); + break; + } } } - if !stale { + if stale_dirs.is_empty() { return None; } let name = parse_pypi_purl(strip_purl_qualifiers(purl)) .map(|(name, _)| name.to_string()) .unwrap_or_else(|| purl.to_string()); + let listed = stale_dirs + .iter() + .map(|d| d.display().to_string()) + .collect::>() + .join(", "); Some(VendorWarning::new( "pypi_pipenv_stale_install", format!( - "{purl}: the UNPATCHED upstream release is still installed in {}. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the Pipfile: `pipenv run pip uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away; then `socket-patch vex` re-verifies the installed files.", - site_packages.display() + "{purl}: the UNPATCHED upstream release is still installed in {listed}. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the Pipfile: `pipenv run pip uninstall -y {name} && pipenv sync` (`pipenv install --deploy` before Pipenv 2018), or `pipenv --rm && pipenv sync` for a clean virtualenv — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away; then `socket-patch vex` re-verifies the installed files." ), )) } @@ -676,13 +697,20 @@ pub async fn vendor_pypi_with_pipenv_version( version, ) { Ok(PipenvTarget::InSync) => { + // A re-run over an already-wired lock keeps warning while + // the venv still holds the upstream release. + if let Some(stale) = + pipenv_stale_install_warning(project_root, purl, record).await + { + warnings.push(stale); + } wired_pin = pipenv_wired_pin(&project.lock, &uuid_dir_rel); WiringPlan::InSync } Ok(PipenvTarget::Fresh) => { warnings.extend(project.warnings.iter().cloned()); if let Some(stale) = - pipenv_stale_install_warning(site_packages, purl, record).await + pipenv_stale_install_warning(project_root, purl, record).await { warnings.push(stale); } @@ -3692,6 +3720,46 @@ wheels = [ "the user's relocked entry stands" ); + // Pipenv 2023+ relocking an excluded-by-marker entry keeps OUR + // reference but restores the registry hashes/version next to it: + // still ours → the original is restored and the record retires. + tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); + tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); + let (wiring2, _meta2) = wire_pipenv( + &load_pipenv_project(root).await.unwrap_or_else(|e| panic!("{e:?}")), + root, + "six", + &rel_wheel, + &"0".repeat(64), + UUID, + ) + .await + .unwrap_or_else(|_| panic!("rewire")); + let text = tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(); + let mut hybrid: serde_json::Value = serde_json::from_str(&text).unwrap(); + hybrid["default"]["six"]["hashes"] = serde_json::json!(["sha256:upstream-a"]); + hybrid["default"]["six"]["version"] = serde_json::json!("==1.16.0"); + tokio::fs::write( + root.join("Pipfile.lock"), + serde_json::to_string_pretty(&hybrid).unwrap(), + ) + .await + .unwrap(); + let entry = revert_entry("pipenv", &rel_wheel, wiring2); + let outcome = revert_pypi(&entry, root, false).await; + assert!(outcome.success, "{:?}", outcome.error); + assert!(!outcome.drift_skipped() && !outcome.kept_artifact, "{:?}", outcome.warnings); + let restored: serde_json::Value = serde_json::from_str( + &tokio::fs::read_to_string(root.join("Pipfile.lock")) + .await + .unwrap(), + ) + .unwrap(); + assert!(restored["default"]["six"].get("file").is_none(), "{restored}"); + assert_eq!(restored["default"]["six"]["version"], serde_json::json!("==1.16.0")); + // Foreign file reference → still drift, still kept. tokio::fs::create_dir_all(&uuid_dir).await.unwrap(); tokio::fs::write(&wheel, b"wheel bytes").await.unwrap(); diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs index e3f82479..0a11f015 100644 --- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs +++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs @@ -53,6 +53,10 @@ const NON_REGISTRY_KEYS: [&str; 6] = ["path", "git", "hg", "svn", "bzr", "editab pub(super) struct PipenvProject { /// Parsed lock (the edit substrate — re-serialized canonically). pub lock: Value, + /// The lock's line ending (`\r\n` when the checkout carries CRLF — git + /// autocrlf; Pipenv itself preserves it), reapplied on every write so the + /// wired lock and the reverted lock stay byte-comparable to the original. + pub crlf: bool, /// Non-fatal advisories raised during load. ALWAYS contains the /// `vendor_integrity_unverified` warning (spike V4: pipenv never enforces /// hashes on file-ref entries) — the orchestrator must surface these. @@ -137,7 +141,11 @@ pub(super) async fn load_pipenv_project( wheel is protected only by the committed wheel itself; `socket-patch vex --product ` \ verifies the installed files against the patch record", )]; - Ok(PipenvProject { lock, warnings }) + Ok(PipenvProject { + lock, + crlf: lock_text.contains("\r\n"), + warnings, + }) } /// Target-specific guards (also re-run by [`wire_pipenv`] right before @@ -205,6 +213,19 @@ pub(super) fn check_target_guards( ), )) } + // Socket's own HOSTED reference (`scan --mode hosted`): the + // two modes do not take each other over for Pipenv yet — name + // the remedy instead of calling our wiring user-declared. + _ if is_socket_hosted_reference(file_ref) => { + return Err(( + "pypi_pipenv_source_already_exists", + format!( + "{LOCK_FILE} {section}.{key} already carries a HOSTED Socket patch \ + reference; run `socket-patch rollback` to unwind it before vendoring \ + (or keep using `scan --mode hosted`)" + ), + )) + } // A user-authored local file reference. _ => { return Err(( @@ -351,7 +372,7 @@ pub(super) async fn wire_pipenv( } } - let new_text = to_canonical_json(&lock); + let new_text = with_line_ending(to_canonical_json(&lock), p.crlf); atomic_write_bytes_preserving_mode(&root.join(LOCK_FILE), new_text.as_bytes()) .await .map_err(|e| { @@ -447,11 +468,33 @@ pub(super) async fn revert_pipenv( if map.get(name) == rec.original.as_ref() { continue; } - let (Some(new_value), Some(live)) = (rec.new.as_ref(), map.get(name)) else { + let Some(new_value) = rec.new.as_ref() else { warnings.push(drifted()); continue; }; - if live != new_value { + let Some(live) = map.get(name) else { + if rec.action == WiringAction::Rewritten && rec.original.is_some() { + // A relock dropped the entry (`pipenv uninstall `, a Pipfile + // edit + `pipenv lock`): the vendored reference is gone with + // it — retire the record rather than keep the orphan forever. + warnings.push(VendorWarning::new( + "vendor_lock_entry_relocked", + format!("{LOCK_FILE} entry for {:?} was removed by a relock; the vendored reference is already gone, so the record is retired", rec.key), + )); + } else { + warnings.push(drifted()); + } + continue; + }; + // Still OUR reference (`file`/`path` string identical to what we + // wrote) with the rest re-serialized by Pipenv — 2023+ relocks an + // entry excluded by its marker keeping the reference but restoring + // the registry `hashes`/`version`: restore the original like an + // untouched entry. + let same_reference = rec.action == WiringAction::Rewritten + && rec.original.is_some() + && crate::patch::redirect::pipenv_reserialized_around_reference(live, new_value); + if live != new_value && !same_reference { // RELOCKED (not drift): `pipenv lock` / `update` regenerated the // entry to registry shape with a different hash list or key set // than the recorded original (Pipenv 2022 does; 2026 reproduces @@ -498,7 +541,7 @@ pub(super) async fn revert_pipenv( // Only re-serialize when something was restored: a no-op revert must not // churn a lock whose formatting we did not produce. if changed && !dry_run { - let new_text = to_canonical_json(&lock); + let new_text = with_line_ending(to_canonical_json(&lock), lock_text.contains("\r\n")); if let Err(e) = atomic_write_bytes_preserving_mode(&lock_path, new_text.as_bytes()).await { return RevertOutcome { kept_artifact: false, @@ -541,6 +584,27 @@ fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'a str, String, /// at every nesting level, default separators, one trailing newline — /// byte-identical to `json.dumps(obj, indent=4, sort_keys=True) + "\n"` for /// the ASCII content pipenv locks carry. +/// A hosted Socket patch reference as `scan --mode hosted` writes it: +/// `https:///patch/pypi/////[#sha256=…]`. +fn is_socket_hosted_reference(value: &str) -> bool { + let Some(rest) = value.strip_prefix("https://") else { + return false; + }; + let path = rest.split_once('/').map(|(_, path)| path).unwrap_or(""); + let path = path.split('#').next().unwrap_or(""); + let parts: Vec<&str> = path.split('/').collect(); + parts.len() == 7 && parts[0] == "patch" && parts[1] == "pypi" && parts[6].ends_with(".whl") +} + +/// Pipenv preserves a lock's CRLF line endings; so do we, on both writes. +fn with_line_ending(text: String, crlf: bool) -> String { + if crlf { + text.replace('\n', "\r\n") + } else { + text + } +} + fn to_canonical_json(value: &Value) -> String { fn sorted(value: &Value) -> Value { match value { @@ -1241,10 +1305,14 @@ mod tests { new: Some(serde_json::json!("x")), }); - // Drift: someone replaced our hash in the vendored entry. - let drifted = read_lock(tmp.path()) - .await - .replace(WHEEL_SHA, &"0".repeat(64)); + // Drift: someone hand-edited the vendored entry's marker (a hash-only + // change next to our intact reference is what a Pipenv relock does + // and is restored, not drift — see `reserialized_around_reference`). + let drifted = { + let mut live: Value = serde_json::from_str(&read_lock(tmp.path()).await).unwrap(); + live["default"]["six"]["markers"] = serde_json::json!("python_version >= '3.99'"); + to_canonical_json(&live) + }; tokio::fs::write(tmp.path().join("Pipfile.lock"), &drifted) .await .unwrap(); @@ -1506,10 +1574,14 @@ mod tests { let outcome = revert_pipenv(&entry_for(vec![record], meta), tmp.path(), false).await; assert!(outcome.success, "{label}: {:?}", outcome.error); assert_eq!(outcome.warnings.len(), 1, "{label}: {:?}", outcome.warnings); - assert_eq!( - outcome.warnings[0].code, "vendor_lock_entry_drifted", - "{label}" - ); + // An entry a relock REMOVED retires the record (the reference is + // gone with it); every other mismatch is drift. + let expected = if label.contains("entry removed") { + "vendor_lock_entry_relocked" + } else { + "vendor_lock_entry_drifted" + }; + assert_eq!(outcome.warnings[0].code, expected, "{label}"); assert!( outcome.warnings[0].detail.contains(key), "{label}: {}", diff --git a/docs/testing/hosted-production-e2e.md b/docs/testing/hosted-production-e2e.md index b0817063..5f5021a7 100644 --- a/docs/testing/hosted-production-e2e.md +++ b/docs/testing/hosted-production-e2e.md @@ -71,7 +71,7 @@ failure instead of N confusing ones that look like CLI regressions. | Ecosystem | Hosted mode | Free patches in production | Suite coverage | |-----------|-------------|----------------------------|----------------| | npm | ✅ | ✅ many | ✅ npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun | -| PyPI | ✅ (requirements.txt + uv.lock only) | ✅ many | ✅ requirements.txt, uv.lock | +| PyPI | ✅ (requirements.txt, uv.lock, Pipfile.lock) | ✅ many | ✅ requirements.txt, uv.lock, Pipfile.lock | | RubyGems | ✅ | ✅ (this suite pins one purl/UUID: `activestorage@6.0.3`; the 2026-08-18 republish covers more versions) | ✅ full bundler install proof | | Cargo | ✅ | ❌ **none** (tier emptied 2026-08-28) | canary only | | Maven | ✅ | ❌ **none** | canary only | @@ -101,7 +101,7 @@ history of this demotion shows every piece to restore (catalog constants, preflight registration, the install-proof leg, and these tables) in both production suites. -PyPI's poetry / pdm / pipenv locks are **not** rewritten by hosted mode (see the +PyPI's poetry / pdm locks are **not** rewritten by hosted mode; Pipenv's `Pipfile.lock` is (see [Pipenv compatibility](pipenv-compatibility.md)) (see the [matrix](../ecosystems.md#mode--ecosystem-matrix)); those flavors are vendored-mode only, so there is no hosted leg to write for them. diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md index 9a46bd8e..2c6f0c68 100644 --- a/docs/testing/pipenv-compatibility.md +++ b/docs/testing/pipenv-compatibility.md @@ -53,13 +53,18 @@ import on modern Pythons); 2018–2022 on Python 3.8; 2023+ on Python 3.12. regenerates the redirected entry to its registry reference on every major, hosted and vendored — a silent unpatch. Re-run Socket Patch afterwards; `rollback` retires the stale record cleanly (2026 reproduces the original - entry byte for byte, 2022 writes a different hash list — both are the - desired end state, not drift). + entry byte for byte, 2022 writes a different hash list, `pipenv uninstall` + removes the entry — all are the desired end state, not drift). Pipenv 2023+ + keep a hosted reference on an entry excluded by its marker and re-serialize + it; that is still ours and rolls back. - **Reference key by release.** Pipenv 7–11 install only `path` references (`file` fails); 2018 and later install `file`. The CLI probes `pipenv --version` on absolute `PATH` entries (every release prints `pipenv, version X`) only when a patch targets the lock; `SOCKET_PIPENV_MAJOR=` pins the answer for CI images without pipenv. +- **Line endings.** Pipenv preserves a CRLF lock (git autocrlf); so do both + rewriters and both rollbacks, and a checkout that converted the file + between the redirect and the rollback still restores. - **Vendored refusal for 7–11.** Those releases cannot reliably consume vendored wheel references; hosted mode covers them. - **Command availability.** `--ignore-pipfile` and `--venv` arrive with @@ -75,9 +80,11 @@ import on modern Pythons); 2018–2022 on Python 3.8; 2023+ on Python 3.12. case-insensitive-filesystem fallback) so a bare `scan`/`rollback` sees the project's venv; before, it fell through to the global interpreter and reported success while the venv stayed unpatched. -- **CLI scope.** The CLI is scoped to its working directory (`--cwd`), while - Pipenv walks up to `PIPENV_MAX_DEPTH` (3) parents for a Pipfile: run the - CLI in the project directory (or pass `--cwd`). +- **CLI scope.** The CLI reads `/Pipfile.lock` and discovers the + project's venv from that directory; it does not walk up to a parent + Pipfile the way Pipenv does (`PIPENV_MAX_DEPTH`) and does not follow + `PIPENV_PIPFILE` to another project's lock. Run it in the project + directory (or pass `--cwd`). ## Running the matrix diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index 04463028..f6acfc7d 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -646,6 +646,16 @@ def cli_run(penv_, *rest, log): # --------------------------------------------------------- agent-oot if mode == "agent-oot": + if major == 7: + # Pipenv 7 creates its out-of-tree venv through pew + virtualenv + # 16, whose seeding fails inside the python:3.6.15-slim harness + # image ("Can not use any platform or abi specific options"); + # its in-project agent leg and the 8–11 out-of-tree legs cover + # the crawler on the legacy layout. + row["supported"] = False + row["expected"] = "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image" + row["passed"] = True + return row if major < 3: row["supported"] = False row["expected"] = "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover" @@ -1015,10 +1025,8 @@ def cli_run(penv_, *rest, log): # preview runs no backend guard. informational = {"warmInstallReplacesUpstream"} if mode == "vendored": - # The vendored backend re-serializes the whole lock with Pipenv's - # own `json.dumps` (LF), so a git-autocrlf CRLF lock comes back - # LF — exactly what `pipenv lock` would do; recorded, not required. - informational.update({"dryRunParity", "crlfPreserved"}) + # The vendored --dry-run preview is ledger-only by design; recorded. + informational.add("dryRunParity") row["passed"] = all(val for k, val in checks.items() if k not in informational) return row From 32008087ae9883e12eea9030f46334e4d1fcf20b Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:05:44 -0400 Subject: [PATCH 20/27] fix(pypi): keep Socket's own Pipfile.lock references discoverable, never query PyPI for private-index locks, honour USERPROFILE on Windows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - The CI re-run shape — `scan --mode hosted --vex` on a checkout whose Pipfile.lock already carries the committed Socket reference — saw zero packages (the inventory skipped every `file`/`path` entry, ours included), so the same-run `--vex` exited 1 `no_applicable_patches` and a vendored re-scan went through the ledger only. A hosted URL (`…/patch/pypi///…/`) or a vendored `.socket/vendor/pypi//` path now yields a discovery-only entry for the package it replaces, so re-scans re-confirm and attest it. - A lock whose `_meta.sources` name no public PyPI index keeps its entries discovery-only: the digest-set lookup must not leak private package names to pypi.org (it would not find their files there either). - Pipenv's default `WORKON_HOME` on Windows comes from `USERPROFILE` (`HOMEDRIVE`+`HOMEPATH`, then `HOME`), like Python's `expanduser`; a Git-Bash `HOME=/c/Users/u` no longer wins. - The probe's `SOCKET_PIPENV_MAJOR` test mutated the process environment under a parallel test runner (a hermeticity race); `parse_override` is unit-tested instead. The ledger-recovery test now expects the Pipenv digest set to be fetchable. Co-Authored-By: Claude Fable 5.1 --- .../src/crawlers/python_crawler.rs | 28 ++- crates/socket-patch-core/src/utils/pipenv.rs | 13 -- .../src/vendor/lock_inventory.rs | 178 ++++++++++++++++-- 3 files changed, 189 insertions(+), 30 deletions(-) diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs index 70c9305e..12498c34 100644 --- a/crates/socket-patch-core/src/crawlers/python_crawler.rs +++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs @@ -394,11 +394,24 @@ fn pipenv_workon_home(var: &impl Fn(&str) -> Option) -> Option Some(data_home.join("virtualenvs")) } +/// `os.path.expanduser("~")` as Pipenv's Python sees it: `USERPROFILE` (then +/// `HOMEDRIVE`+`HOMEPATH`) on Windows — Python 3.8+ ignores `HOME` there, so a +/// Git-Bash `HOME=/c/Users/u` must not win — and `HOME` elsewhere. fn pipenv_home_dir(var: &impl Fn(&str) -> Option) -> Option { - var("HOME") - .or_else(|| var("USERPROFILE")) - .filter(|v| !v.trim().is_empty()) - .map(PathBuf::from) + let non_empty = |v: String| (!v.trim().is_empty()).then_some(v); + if cfg!(windows) { + var("USERPROFILE") + .and_then(non_empty) + .or_else(|| { + let drive = var("HOMEDRIVE").and_then(non_empty)?; + let path = var("HOMEPATH").and_then(non_empty)?; + Some(format!("{drive}{path}")) + }) + .or_else(|| var("HOME").and_then(non_empty)) + .map(PathBuf::from) + } else { + var("HOME").and_then(non_empty).map(PathBuf::from) + } } /// `os.path.expanduser(os.path.expandvars(raw))`: `$NAME` / `${NAME}` (and @@ -1159,6 +1172,13 @@ mod tests { assert_eq!(with(Some("~/envs"), None), Some(PathBuf::from("/home/u/envs"))); if cfg!(windows) { assert_eq!(with(None, None), Some(PathBuf::from("/home/u").join(".virtualenvs"))); + // USERPROFILE wins over a Git-Bash style HOME, like Python's expanduser. + let var = |name: &str| match name { + "HOME" => Some("/c/Users/u".to_string()), + "USERPROFILE" => Some(r"C:\Users\u".to_string()), + _ => None, + }; + assert_eq!(pipenv_workon_home(&var), Some(PathBuf::from(r"C:\Users\u").join(".virtualenvs"))); } else { assert_eq!( with(None, None), diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs index 32e23b93..e0e50225 100644 --- a/crates/socket-patch-core/src/utils/pipenv.rs +++ b/crates/socket-patch-core/src/utils/pipenv.rs @@ -246,17 +246,4 @@ mod tests { assert_eq!(found, bin.join("pipenv.bat")); assert!(is_batch_shim(&found)); } - - #[tokio::test] - async fn override_env_short_circuits_the_probe() { - // Serialized on the env var by name; the value is process-global. - let saved = std::env::var(MAJOR_OVERRIDE_ENV).ok(); - std::env::set_var(MAJOR_OVERRIDE_ENV, " 11 "); - let forced = installed_major(Path::new(".")).await; - match saved { - Some(v) => std::env::set_var(MAJOR_OVERRIDE_ENV, v), - None => std::env::remove_var(MAJOR_OVERRIDE_ENV), - } - assert_eq!(forced, Some(11)); - } } diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 6f8a6d24..89c2e2bb 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -1374,6 +1374,52 @@ async fn inventory_poetry_lock(project_root: &Path) -> Option Some(dedup_prefer_integrity(out)) } +/// `https://pypi.org/simple`, `https://pypi.python.org/simple`, +/// `https://files.pythonhosted.org/…`: the public index PyPI's JSON API +/// describes. +fn is_public_pypi_url(url: &str) -> bool { + let host = url + .split("://") + .nth(1) + .and_then(|rest| rest.split(['/', '?', '#']).next()) + .unwrap_or("") + .to_ascii_lowercase(); + let host = host.rsplit('@').next().unwrap_or(&host); + matches!( + host, + "pypi.org" | "www.pypi.org" | "pypi.python.org" | "files.pythonhosted.org" + ) +} + +/// The `(canonical name, version)` a Socket-written Pipfile.lock reference +/// stands for: a hosted URL +/// `https:///patch/pypi/////[#…]` +/// (coordinates from the path) or a vendored path +/// `[./].socket/vendor/pypi//--…whl` (coordinates from +/// the wheel filename). `None` for a user's own file/path reference. +fn socket_reference_coords(reference: &str) -> Option<(String, String)> { + let reference = reference.split('#').next().unwrap_or(reference); + if let Some(rest) = reference.strip_prefix("https://") { + let path = rest.split_once('/')?.1; + let parts: Vec<&str> = path.split('/').collect(); + if parts.len() == 7 && parts[0] == "patch" && parts[1] == "pypi" && parts[6].ends_with(".whl") { + return Some((canonicalize_pypi_name(parts[2]), parts[3].to_string())); + } + return None; + } + let rel = reference.trim_start_matches("./"); + let rest = rel.strip_prefix(".socket/vendor/pypi/")?; + let (_uuid, wheel) = rest.split_once('/')?; + let stem = wheel.strip_suffix(".whl")?; + let mut fields = stem.split('-'); + let name = fields.next()?; + let version = fields.next()?; + if name.is_empty() || version.is_empty() || !version.starts_with(|c: char| c.is_ascii_digit()) { + return None; + } + Some((canonicalize_pypi_name(name), version.to_string())) +} + /// Pipfile.lock (pipfile-spec 6): every category other than `_meta` holds /// `name: {"version": "==X", "hashes": ["sha256:", …], …}` entries. /// Registry pins (`==` version) become entries whose integrity is the SET of @@ -1388,8 +1434,25 @@ async fn inventory_pipfile_lock(project_root: &Path) -> Option Option/` path) stay DISCOVERABLE + // as the package they replace, so a re-scan of an already + // redirected lock-only checkout still lists (and re-confirms / + // attests) it instead of reporting zero packages. + if let Some(reference) = entry + .get("file") + .or_else(|| entry.get("path")) + .and_then(serde_json::Value::as_str) + { + if let Some((n, v)) = socket_reference_coords(reference) { + if path_safety::is_safe_single_segment(&n) + && path_safety::is_safe_single_segment(&v) + { + out.push(LockfileEntry { + ecosystem: "pypi", + purl: format!("pkg:pypi/{n}@{v}"), + name: n, + version: v, + resolved: None, + integrity: LockIntegrity::None, + }); + } + } + continue; + } + if ["git", "hg", "svn", "bzr", "editable"] .iter() .any(|key| entry.contains_key(*key)) { @@ -1433,7 +1522,7 @@ async fn inventory_pipfile_lock(project_root: &Path) -> Option = entries.iter().map(|e| e.name.as_str()).collect(); names.sort_unstable(); - // requirements.txt is read alongside the Pipfile.lock, not hidden by it. - assert_eq!(names, vec!["flask", "six", "urllib3"], "{entries:?}"); + // requirements.txt is read alongside the Pipfile.lock, not hidden by + // it; our own vendored reference stays discoverable (discovery-only). + assert_eq!(names, vec!["flask", "six", "urllib3", "wired"], "{entries:?}"); + assert_eq!(entry(&entries, "wired").integrity, LockIntegrity::None); + assert_eq!(entry(&entries, "wired").purl, "pkg:pypi/wired@1.0"); let urllib3 = entry(&entries, "urllib3"); assert_eq!(urllib3.purl, "pkg:pypi/urllib3@1.26.18"); assert_eq!(urllib3.resolved, None); @@ -3489,6 +3582,49 @@ source = { editable = "." } assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None); } + /// Socket's own references in a Pipfile.lock (a hosted URL, a vendored + /// path) keep the package discoverable on a lock-only re-scan; a lock + /// whose sources are private indexes only never carries a fetchable + /// digest set (no pypi.org lookups for it). + #[tokio::test] + async fn pipfile_lock_inventory_keeps_socket_references_discoverable_and_respects_private_indexes() { + let hosted = r#"{"_meta": {"pipfile-spec": 6, "sources": [{"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]}, +"default": { + "urllib3": {"file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/grant/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=cc", "hashes": ["sha256:cc"], "markers": "x"}, + "Six": {"file": "./.socket/vendor/pypi/00000000-0000-4000-8000-000000000000/six-1.16.0-py2.py3-none-any.whl", "hashes": ["sha256:dd"]}, + "fork": {"file": "./forks/fork-1.0-py3-none-any.whl"}, + "requests": {"version": "==2.31.0", "hashes": ["sha256:%s"]} +}}"#.replace("%s", &"a".repeat(64)); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &hosted).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + let mut names: Vec<&str> = entries.iter().map(|e| e.name.as_str()).collect(); + names.sort_unstable(); + assert_eq!(names, vec!["requests", "six", "urllib3"], "{entries:?}"); + assert_eq!(entry(&entries, "urllib3").purl, "pkg:pypi/urllib3@1.26.18"); + assert_eq!(entry(&entries, "urllib3").integrity, LockIntegrity::None, "a hosted reference is discovery-only"); + assert_eq!(entry(&entries, "six").purl, "pkg:pypi/six@1.16.0"); + assert_eq!(entry(&entries, "six").integrity, LockIntegrity::None); + assert!(matches!(entry(&entries, "requests").integrity, LockIntegrity::Sha256AnyOf(_))); + + // Private index only → the registry pin is discovery-only. + let private = hosted.replace("https://pypi.org/simple", "https://pypi.internal.example/simple"); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &private).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert_eq!(entry(&entries, "requests").integrity, LockIntegrity::None, "no pypi.org lookup for a private-index lock"); + // A mirror listed next to PyPI keeps the digest set. + let mixed = hosted.replace(r#"[{"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]"#, r#"[{"name": "mirror", "url": "https://mirror.example/simple", "verify_ssl": true}, {"name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true}]"#); + let tmp = tempfile::tempdir().unwrap(); + write(tmp.path(), "Pipfile.lock", &mixed).await; + let entries = inventory_pypi_locks(tmp.path()).await.unwrap(); + assert!(matches!(entry(&entries, "requests").integrity, LockIntegrity::Sha256AnyOf(_))); + assert!(is_public_pypi_url("https://user:tok@pypi.org/simple")); + assert!(!is_public_pypi_url("https://pypi.org.evil.example/simple")); + assert_eq!(socket_reference_coords("./forks/fork-1.0-py3-none-any.whl"), None); + assert_eq!(socket_reference_coords("https://example.org/patch/pypi/a/1/g/u/a-1-py3-none-any.whl"), Some(("a".into(), "1".into()))); + } + /// A lock that lists a pure-Python wheel carries its sha256 (lock 2.x /// `files`, lock 1.x `[metadata.files]`), so a lock-only checkout can /// vendor like uv does; platform wheels only, or 0.12's bare @@ -4465,20 +4601,36 @@ mod recover_tests { assert!(!err.contains("uv.lock fragment recorded"), "{kind}: {err}"); } - // pipenv records a JSON object (hashes + version), not a string unit. + // pipenv records a JSON object (hashes + version), not a string unit: + // its digest set IS fetchable (PyPI JSON API lookup by digest), so a + // lock-only checkout of an already-vendored project recovers. let pipenv = entry( "pypi", "pkg:pypi/six@1.16.0", vec![rec( "pipenv_lock_entry", serde_json::json!({ - "hashes": [format!("sha256:{}", "a".repeat(64))], + "hashes": [format!("sha256:{}", "a".repeat(64)), format!("sha256:{}", "B".repeat(64))], "version": "==1.16.0", }), )], ); - let err = recover_lock_entry(tmp.path(), &pipenv).await.unwrap_err(); - assert!(err.contains("no fetchable registry URL"), "pipenv: {err}"); + let recovered = recover_lock_entry(tmp.path(), &pipenv).await.unwrap(); + assert_eq!(recovered.purl, "pkg:pypi/six@1.16.0"); + assert_eq!(recovered.resolved, None); + assert_eq!( + recovered.integrity, + LockIntegrity::Sha256AnyOf(vec!["a".repeat(64), "b".repeat(64)]), + "lowercased digest set" + ); + // …but a pipenv fragment without digests has nothing to fetch by. + let digestless = entry( + "pypi", + "pkg:pypi/six@1.16.0", + vec![rec("pipenv_lock_entry", serde_json::json!({"version": "==1.16.0"}))], + ); + let err = recover_lock_entry(tmp.path(), &digestless).await.unwrap_err(); + assert!(err.contains("no sha256 digests"), "pipenv: {err}"); // A ledger with no pypi fragment at all is still a hard error. let bare = entry("pypi", "pkg:pypi/six@1.16.0", vec![]); From 9f4b4b73e07cc107910892d2050307818c75bdaf Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:08:45 -0400 Subject: [PATCH 21/27] fix(vendor): let the ledger recover a lock rewired to Socket's own reference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With Socket's own Pipfile.lock reference now inventoried (discovery-only), the vendored re-scan of a lock-only checkout fetched by that entry — which carries no registry integrity — and reported `vendor_fetch_unverifiable` + `package_not_installed` (exit 1) instead of `already_vendored`. A discovery-only inventory entry now defers to the ledger's pre-vendor fragment (digest set) when one exists; without a ledger it behaves as before. Measured: three consecutive lock-only vendored scans → applied, already_vendored, already_vendored, lock and wheel intact. The harness checks this re-run shape for both modes (`lockOnlyRescanGreen`). Co-Authored-By: Claude Fable 5.1 --- .../socket-patch-cli/src/commands/vendor.rs | 41 +++++++++++-------- scripts/backtest-pipenv.py | 11 +++++ 2 files changed, 36 insertions(+), 16 deletions(-) diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs index 3725b81b..24a4b6f1 100644 --- a/crates/socket-patch-cli/src/commands/vendor.rs +++ b/crates/socket-patch-cli/src/commands/vendor.rs @@ -677,23 +677,32 @@ pub(crate) async fn fetch_pristine_package( purl: &str, ledger_entry: Option<&VendorEntry>, ) -> PristineFetch { - let entry = match lock_inventory::lookup(inventory, purl) { - Some(e) => e.clone(), - None => { - let Some(le) = ledger_entry else { - return PristineFetch::NoSource; - }; - match lock_inventory::recover_lock_entry(project_root, le).await { - Ok(rec) => rec, - Err(e) => { - return PristineFetch::Unverifiable(format!( - "the lockfile no longer records a registry resolution for {purl} \ - (rewired to the vendored artifact) and the ledger cannot recover \ - one: {e}" - )) - } + // A lock entry that carries an integrity is the registry resolution to + // fetch. A DISCOVERY-ONLY entry (the lock is rewired to OUR reference, + // whose recorded hashes are the patched wheel's — nothing PyPI serves) + // cannot be fetched by itself: the ledger's pre-vendor fragment can, so + // an already-vendored lock-only checkout re-scans green. + let inventory_entry = lock_inventory::lookup(inventory, purl).cloned(); + let fetchable = inventory_entry + .as_ref() + .filter(|e| e.integrity != lock_inventory::LockIntegrity::None) + .cloned(); + let entry = match (fetchable, ledger_entry) { + (Some(e), _) => e, + (None, Some(le)) => match lock_inventory::recover_lock_entry(project_root, le).await { + Ok(rec) => rec, + Err(e) => { + return PristineFetch::Unverifiable(format!( + "the lockfile no longer records a registry resolution for {purl} \ + (rewired to the vendored artifact) and the ledger cannot recover \ + one: {e}" + )) } - } + }, + (None, None) => match inventory_entry { + Some(e) => e, + None => return PristineFetch::NoSource, + }, }; match registry_fetch::fetch_and_stage(&entry, client).await { Ok(fetched) => PristineFetch::Fetched(fetched), diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index f6acfc7d..3bb69cee 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -813,6 +813,17 @@ def cli_run(penv_, *rest, log): codes0 = sorted({(w.get("code") or w.get("errorCode")) for w in envelope_warnings(mode, e0) if (w.get("code") or w.get("errorCode"))}) info["lockOnly"] = {"exit": r0.rc, "applied": applied_count(mode, e0), "lockfileOnlyPackages": e0.get("lockfileOnlyPackages"), "codes": codes0} check("lockOnlyApplies", applied_count(mode, e0) == 1, info["lockOnly"]) + if applied_count(mode, e0) == 1: + # The CI re-run shape: the checkout already carries the committed + # reference and nothing is installed — the re-scan must stay green + # (hosted re-confirms; vendored reports already_vendored), not + # `package_not_installed`, and the lock must not change. + lock1 = (project / "Pipfile.lock").read_bytes() + r1 = cli_run(penv, "scan", "--mode", mode, log="scan-lockonly-rescan.log") + e1 = r1.json_or_empty() + codes1 = sorted({(w.get("code") or w.get("errorCode")) for w in envelope_warnings(mode, e1) if (w.get("code") or w.get("errorCode"))}) + ok1 = r1.ok() and e1.get("status") == "success" and (project / "Pipfile.lock").read_bytes() == lock1 and "package_not_installed" not in codes1 + check("lockOnlyRescanGreen", ok1, {"exit": r1.rc, "status": e1.get("status"), "codes": codes1}) shutil.rmtree(project / ".socket", ignore_errors=True) shutil.rmtree(venv, ignore_errors=True) (project / "Pipfile.lock").write_bytes(pristine_lock) From 323724b88bd3f83528712f38fbde2b679a6e1bc4 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:09:19 -0400 Subject: [PATCH 22/27] docs(pipenv): describe lock-only discovery, re-scan idempotency and the private-index rule Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 5 ++++- crates/socket-patch-cli/CLI_CONTRACT.md | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dccf4677..734cd13d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -72,7 +72,10 @@ into the new version's section — see docs/releasing.md. lock's recorded digests (`LockIntegrity::Sha256AnyOf`, resolved through PyPI's JSON API and verified against the same digest) and agent/scan list them as lockfile-only packages. Previously they discovered nothing and - exited 0. + exited 0. Socket's own references stay discoverable, so a re-scan of an + already-redirected or already-vendored lock-only checkout re-confirms it; + a lock that resolves only from private indexes is never looked up on + pypi.org. - **Pipenv's out-of-tree virtualenv is discovered.** Agent mode (bare `scan`, `rollback`, `vex`) now finds `$WORKON_HOME/-[-]` (the `.venv` file pointer, `PIPENV_CUSTOM_VENV_NAME` and `PIPENV_PIPFILE` diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md index ac566cb3..dd436566 100644 --- a/crates/socket-patch-cli/CLI_CONTRACT.md +++ b/crates/socket-patch-cli/CLI_CONTRACT.md @@ -124,7 +124,7 @@ The rewriter reads a fixed set of candidate files from the project root: the npm **Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using ` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract. -**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and warns `redirect_pipenv_stale_install` naming the site-packages dir and the verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry, compared as parsed JSON (a whole-file CRLF/LF conversion or a Pipenv re-serialization that kept our reference and hashes is not drift; the original is spliced back in the live file's line ending); an entry a relock removed retires the edit; a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. +**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "#sha256=", "hashes": ["sha256:"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and warns `redirect_pipenv_stale_install` naming the site-packages dir and the verified remedy: `pipenv run pip uninstall -y && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry, compared as parsed JSON (a whole-file CRLF/LF conversion or a Pipenv re-serialization that kept our reference and hashes is not drift; the original is spliced back in the live file's line ending); an entry a relock removed retires the edit; a relock (`pipenv lock`, `update`, `install ` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. **Discovery**: `Pipfile.lock` is part of the lockfile inventory (every category's `==` pins, with the lock's digest set as `Sha256AnyOf` integrity so a lock-only checkout can be vendored by fetching the pure wheel through PyPI's JSON API — only when `_meta.sources` name the public index; a private-index lock stays discovery-only and never reaches pypi.org), and Socket's own hosted / vendored references stay discoverable as the package they replace, so a re-scan of an already-redirected or already-vendored lock-only checkout re-confirms it (`--vex` attests, vendored reports `already_vendored`) instead of finding nothing. **Mode ledgers (contract surfaces).** Each committable mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write these files, so path + schema are part of the contract: From bb2ea80657223edee39187019d4c6817542b0a9f Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:09:56 -0400 Subject: [PATCH 23/27] ci(pipenv): cover the relock and line-ending shapes and every Pipenv code path in the trigger Co-Authored-By: Claude Fable 5.1 --- .github/workflows/pipenv-compatibility.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pipenv-compatibility.yml b/.github/workflows/pipenv-compatibility.yml index d7a24be5..7345146b 100644 --- a/.github/workflows/pipenv-compatibility.yml +++ b/.github/workflows/pipenv-compatibility.yml @@ -17,6 +17,10 @@ on: - 'crates/socket-patch-core/src/crawlers/python_crawler.rs' - 'crates/socket-patch-core/src/utils/pipenv.rs' - 'crates/socket-patch-cli/src/commands/scan/hosted.rs' + - 'crates/socket-patch-cli/src/commands/vendor.rs' + - 'crates/socket-patch-cli/src/commands/rollback.rs' + - 'crates/socket-patch-cli/src/commands/vex.rs' + - 'crates/socket-patch-core/src/patch/redirect/replay.rs' - 'scripts/backtest-pipenv.py' - '.github/workflows/pipenv-compatibility.yml' push: @@ -32,10 +36,17 @@ jobs: fail-fast: false matrix: include: + # Every 2018+ major, plus the shapes that exercise the relock and + # line-ending paths on the newest and the last Python-3.8 release. - os: ubuntu-latest versions: 2018.11.26 2020.11.15 2021.11.23 2022.12.19 2023.12.1 2024.4.1 2025.1.3 2026.8.0 + shapes: direct + - os: ubuntu-latest + versions: 2022.12.19 2026.8.0 + shapes: crlf marker-excluded extras category - os: macos-latest versions: 2018.11.26 2022.12.19 2023.12.1 2026.8.0 + shapes: direct runs-on: ${{ matrix.os }} timeout-minutes: 60 steps: @@ -67,6 +78,7 @@ jobs: BACKTEST_PY38: '3.8' BACKTEST_PY312: '3.12' PIPENV_VERSIONS: ${{ matrix.versions }} + PIPENV_SHAPES: ${{ matrix.shapes }} run: | # shellcheck disable=SC2086 python3 scripts/backtest-pipenv.py \ @@ -74,13 +86,13 @@ jobs: --socket-patch-revision "$GITHUB_SHA" \ --output "$RUNNER_TEMP/pipenv-compat" \ --versions $PIPENV_VERSIONS \ - --shapes direct \ + --shapes $PIPENV_SHAPES \ --modes hosted vendored agent agent-oot \ --jobs 4 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 if: always() with: - name: pipenv-compat-${{ matrix.os }} + name: pipenv-compat-${{ matrix.os }}-${{ strategy.job-index }} path: | ${{ runner.temp }}/pipenv-compat/summary.json ${{ runner.temp }}/pipenv-compat/summary.md From ba8dc383e3a14573e393c953838f23397deab08d Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:25:05 -0400 Subject: [PATCH 24/27] test(pipenv): re-read a missing file a few times in the Docker-side oracle The pre-2018 legs run the byte oracle in a fresh container over a bind mount the host CLI just wrote through (stage + rename); Docker Desktop's shared file cache occasionally shows the directory without the renamed entry for a moment (seen twice in ~900 cells, always right after a host write). A genuinely absent file stays absent across the retries. Co-Authored-By: Claude Fable 5.1 --- scripts/backtest-pipenv.py | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index bae3f80d..67b98a6d 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -47,6 +47,7 @@ import subprocess import sys import threading +import time import traceback import uuid as uuid_mod from datetime import datetime, timezone @@ -420,8 +421,21 @@ def uninstall_urllib3(version, python, cwd, penv, log): require(run_python(version, python, ["-c", ABSENT], cwd, penv, str(log) + ".absent"), "urllib3 uninstall") def oracle(version, python, names, cwd, penv, log): - r = run_python(version, python, ["-c", ORACLE, json.dumps(list(names))], cwd, penv, log) - return json.loads(r.out.strip().splitlines()[-1]) if r.ok() and r.out.strip() else {} + # For the pre-2018 releases the oracle runs in a fresh container over a + # bind mount the host CLI just wrote through (stage + rename): Docker + # Desktop's shared file cache occasionally shows the directory without + # the renamed entry for a moment, so a missing file is re-read a few + # times before it counts (a real absence stays absent). + attempts = 4 if is_legacy(version) else 1 + result = {} + for attempt in range(attempts): + r = run_python(version, python, ["-c", ORACLE, json.dumps(list(names))], cwd, penv, log) + result = json.loads(r.out.strip().splitlines()[-1]) if r.ok() and r.out.strip() else {} + if result and all(v is not None for v in result.values()): + return result + if attempt + 1 < attempts: + time.sleep(1.5) + return result def urllib3_absent(version, python, cwd, penv, log): return run_python(version, python, ["-c", ABSENT], cwd, penv, log).ok() From 6b6005f283a9c5a7aa00b4aaba6367b93c3463e5 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:41:14 -0400 Subject: [PATCH 25/27] fix(inventory): satisfy clippy's unnecessary_map_or on the public-index gate `cargo clippy --workspace --all-features -- -D warnings` (CI's invocation) rejected the `.map_or(true, ..)` on the `_meta.sources` lookup; use `Option::is_none_or`, which spells the same rule (no sources block means the public index). Co-Authored-By: Claude Fable 5.1 --- crates/socket-patch-core/src/vendor/lock_inventory.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/socket-patch-core/src/vendor/lock_inventory.rs b/crates/socket-patch-core/src/vendor/lock_inventory.rs index 89c2e2bb..786453a4 100644 --- a/crates/socket-patch-core/src/vendor/lock_inventory.rs +++ b/crates/socket-patch-core/src/vendor/lock_inventory.rs @@ -1444,7 +1444,7 @@ async fn inventory_pipfile_lock(project_root: &Path) -> Option Date: Fri, 18 Sep 2026 10:47:32 -0400 Subject: [PATCH 26/27] test(pipenv): expect the relocked hybrid entry to roll back to the original Pipenv 2023+ relock a marker-excluded entry into a hybrid that keeps our `file` reference and restores the upstream hashes and version around it. That entry is still ours, and `rollback` restores the pristine registry entry (the matrix captured byte-identical locks on 2023.12.1 through 2026.8.0, hosted and vendored). The harness demanded the relocked bytes be kept, which is right only for a registry-shaped relock; judge the two outcomes separately and compare the urllib3 entries semantically. Co-Authored-By: Claude Fable 5.1 --- docs/testing/pipenv-compatibility.md | 4 +++- scripts/backtest-pipenv.py | 26 ++++++++++++++++++++++---- 2 files changed, 25 insertions(+), 5 deletions(-) diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md index add11bac..69d3371f 100644 --- a/docs/testing/pipenv-compatibility.md +++ b/docs/testing/pipenv-compatibility.md @@ -116,7 +116,9 @@ the stale-install warning over a warm venv, whether Pipenv reinstalls a warm venv (recorded), the lock-driven install into an emptied venv with the installed bytes checked against the patch record's Git blob SHA-256 hashes, a fresh clone of the committed state, `pipenv verify` / `requirements`, tamper -rejection, what `pipenv lock` does to the entry, rollback after that relock, +rejection, what `pipenv lock` does to the entry, rollback after that relock +(a registry-shaped entry is kept and only the ledger retires; the Pipenv 2023+ +hybrid that still carries our reference rolls back to the original entry), `vex`, and a byte-exact `rollback`. Agent mode additionally checks that repeat installs and `sync` keep the in-place patch, and the out-of-tree leg requires the bare scan to see Pipenv's venv. diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py index 67b98a6d..a6620686 100755 --- a/scripts/backtest-pipenv.py +++ b/scripts/backtest-pipenv.py @@ -208,6 +208,13 @@ def tail(self, n=400): return (self.out + self.err)[-n:] +def urllib3_entries(lock_bytes): + """Every category's urllib3 entry of a Pipfile.lock, parsed, for a + semantic (key-order- and whitespace-insensitive) comparison.""" + data = json.loads(lock_bytes.decode("utf-8-sig")) + return {cat: entries["urllib3"] for cat, entries in data.items() if cat != "_meta" and isinstance(entries, dict) and "urllib3" in entries} + + def require(r, what): if not r.ok(): raise RuntimeError(f"{what} failed (exit {r.rc}):\n{(r.out + r.err)[-4000:]}") @@ -1012,9 +1019,14 @@ def cli_run(penv_, *rest, log): relocked = (project / "Pipfile.lock").read_bytes() marker = b"patch.socket.dev" if mode == "hosted" else b".socket/vendor/pypi" info["relock"] = {"exit": rl.rc, "lockBytesUnchanged": relocked == lock_after, "patchSourceKept": marker in relocked, "pipfileUnchanged": (project / "Pipfile").read_bytes() == pristine_pipfile, "tail": rl.tail(300) if not rl.ok() else None} - # A relock regenerated the entry to registry shape: `rollback` must - # retire the redirect cleanly (exit 0, ledger cleared) instead of - # refusing forever — judged in a copy so the main flow keeps its state. + # A relock regenerated the entry: `rollback` must retire the redirect + # cleanly (exit 0, ledger cleared) instead of refusing forever — judged + # in a copy so the main flow keeps its state. Two relock outcomes exist: + # registry shape (the reference is gone; the relocked lock is the desired + # end state and must be kept) and the Pipenv 2023+ hybrid of a + # marker-excluded entry (our reference kept, upstream hashes + version + # restored around it); that entry is still ours and must roll back to + # the original registry entry, leaving no Socket reference behind. if rl.ok() and relocked != lock_after: relocked_dir = case / "relocked" shutil.copytree(project, relocked_dir, ignore=shutil.ignore_patterns(".venv", "__pycache__")) @@ -1024,7 +1036,13 @@ def cli_run(penv_, *rest, log): ledger2 = relocked_dir / ".socket/vendor/redirect-state.json" state2 = relocked_dir / ".socket/vendor/state.json" cleared = (not ledger2.exists() or not json.loads(ledger2.read_text()).get("records")) and (not state2.exists() or not json.loads(state2.read_text()).get("entries")) - check("rollbackAfterRelockRetires", rrb.ok() and cleared and (relocked_dir / "Pipfile.lock").read_bytes() == relocked, {"exit": rrb.rc, "cleared": cleared, "lockKeptRelocked": (relocked_dir / "Pipfile.lock").read_bytes() == relocked, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None}) + post = (relocked_dir / "Pipfile.lock").read_bytes() + hybrid = marker in relocked + if hybrid: + lock_ok = marker not in post and urllib3_entries(post) == urllib3_entries(pristine_lock) + else: + lock_ok = post == relocked + check("rollbackAfterRelockRetires", rrb.ok() and cleared and lock_ok, {"exit": rrb.rc, "cleared": cleared, "hybridRelock": hybrid, "lockKeptRelocked": post == relocked, "lockRestoredOriginal": post == pristine_lock, "referenceLeft": marker in post, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None}) (project / "Pipfile.lock").write_bytes(lock_after) (project / "Pipfile").write_bytes(pristine_pipfile) From 4e5d9ffe790fdc5ccc8e85fdde68768e9c3f9680 Mon Sep 17 00:00:00 2001 From: Mikola Lysenko Date: Fri, 18 Sep 2026 10:49:41 -0400 Subject: [PATCH 27/27] docs(pipenv): record the final compatibility matrix on the merged head macOS: 470/470 cells over the last stable release of all 18 Pipenv majors x 8 lock shapes x {hosted, vendored, agent, out-of-tree agent} (103 expected refusals, 36 installer skips). Linux: 32/32 (release binary in a container, 2018+ majors, 4 modes). Invocation variants (--cwd, nested --cwd, symlinked project directory): 48/48. Per-case checks and measured flags in docs/testing/pipenv-compatibility/results.json (log tails stripped). Co-Authored-By: Claude Fable 5.1 --- docs/testing/pipenv-compatibility.md | 61 +- .../testing/pipenv-compatibility/results.json | 72046 ++++++++++++++++ 2 files changed, 72106 insertions(+), 1 deletion(-) create mode 100644 docs/testing/pipenv-compatibility/results.json diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md index 69d3371f..d758b72a 100644 --- a/docs/testing/pipenv-compatibility.md +++ b/docs/testing/pipenv-compatibility.md @@ -126,5 +126,64 @@ requires the bare scan to see Pipenv's venv. ## Results -_Pending: regenerated from `summary.json` after the final matrix run._ +### macOS — full matrix (18 majors × 8 shapes × 4 modes) + +CLI revision `e521093`: **470 cases, 470 pass** (103 expected refusals, 36 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| 0.2.8 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover) | none | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 3.6.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 4.1.4 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 5.4.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 6.2.9 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a | +| 7.9.10 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image) | none | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 8.3.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 9.1.0 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 10.1.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 11.10.4 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a | +| 2018.11.26 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2020.11.15 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2021.11.23 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2022.12.19 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 0 / 0 | +| 2023.12.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2024.4.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2025.1.3 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | +| 2026.8.0 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 | + +### Linux — release binary in a container (2018+ majors, direct shape, 4 modes) + +CLI revision `e521093`: **32 cases, 32 pass** (0 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) | +| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | +| 2018.11.26 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2020.11.15 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2021.11.23 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 | +| 2022.12.19 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 0 / 0 | +| 2023.12.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2024.4.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2025.1.3 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | +| 2026.8.0 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 | + +### Invocation variants (`--cwd`, nested `--cwd`, symlinked project directory; direct shape, 4 modes) + +CLI revision `e521093`: **48 cases, 48 pass** (3 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors). + +| Pipenv | invocation | hosted | vendored | agent | agent-oot | +| --- | --- | --- | --- | --- | --- | +| 11.10.4 | `--cwd ` | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 11.10.4 | `--cwd` from a nested directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 11.10.4 | symlinked project directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass | +| 2018.11.26 | `--cwd ` | pass | pass | pass | pass | +| 2018.11.26 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2018.11.26 | symlinked project directory | pass | pass | pass | pass | +| 2022.12.19 | `--cwd ` | pass | pass | pass | pass | +| 2022.12.19 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2022.12.19 | symlinked project directory | pass | pass | pass | pass | +| 2026.8.0 | `--cwd ` | pass | pass | pass | pass | +| 2026.8.0 | `--cwd` from a nested directory | pass | pass | pass | pass | +| 2026.8.0 | symlinked project directory | pass | pass | pass | pass | + +Every `pass` cell verified the installed `urllib3/response.py` against the patch record's Git blob SHA-256 after a real Pipenv install. Columns: `warm venv re-installed` and `relock keeps patch` are measured Pipenv boundaries (see above), not requirements; `pipenv verify` exit 2 means the subcommand does not exist on that release. Per-case checks, notes and harness provenance: [`results.json`](pipenv-compatibility/results.json). diff --git a/docs/testing/pipenv-compatibility/results.json b/docs/testing/pipenv-compatibility/results.json new file mode 100644 index 00000000..755e0c00 --- /dev/null +++ b/docs/testing/pipenv-compatibility/results.json @@ -0,0 +1,72046 @@ +{ + "capturedOn": "2026-09-18", + "cliRevision": "e521093", + "runs": { + "invocations": { + "errors": [], + "platform": "macOS 15 (arm64), native CLI", + "provenance": { + "capturedAt": "2026-09-18T14:21:08.543839+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "cwd-flag", + "subdir", + "symlink" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "2026.8.0", + "2022.12.19", + "2018.11.26", + "11.10.4" + ], + "shapes": [ + "direct" + ] + }, + "results": [ + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-cwd-flag/venvs/project-wAwCAktN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-subdir/venvs/app-4oK9yKve-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-symlink/venvs/project-RoaKTazg-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages stil" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still di" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-cwd-flag/venvs/project-uP3pTgYV-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-subdir/venvs/app-ABVCOMdn-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-symlink/venvs/project-Xepy222U-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.ve" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so " + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/l" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-cwd-flag/venvs/project-4nuNhCus-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-subdir/venvs/app-ePSOQNAV-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-symlink/venvs/project-q4pR13ah-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.ve" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-subdir/nested/app/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so " + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/l" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "cwd-flag", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "subdir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "symlink", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-cwd-flag/venvs/project-PAsYMkTS-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "cwd-flag", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-subdir/venvs/app-bSlpRn1y-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "subdir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-symlink/venvs/project-GgQxs9OK-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "symlink", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages st" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026" + } + ] + }, + "invocation": "cwd-flag", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byt" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026" + } + ] + }, + "invocation": "subdir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still " + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026" + } + ] + }, + "invocation": "symlink", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "cwd-flag", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "subdir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "symlink", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + } + ] + }, + "linux": { + "errors": [], + "platform": "Debian 12 (arm64) container, release CLI", + "provenance": { + "capturedAt": "2026-09-18T14:23:15.899056+00:00", + "cliRevision": "e521093", + "cliSha256": "dea3c3fdf39512216dc382aaca5f07ce88eeeef1b7cf38683068956a71c42c04", + "host": "Linux aarch64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "direct" + ] + }, + "results": [ + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2018.11.26-direct-agent-oot/venvs/project-mF2HGUnO-/out/tools/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2020.11.15-direct-agent-oot/venvs/project-69ycha_K-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2021.11.23-direct-agent-oot/venvs/project-Gx4HxHSi-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2022.12.19-direct-agent-oot/venvs/project-0g61h4-J-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///out/final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2023.12.1-direct-agent-oot/venvs/project-PVj1ALdm-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2024.4.1-direct-agent-oot/venvs/project-Q1XxEGgw-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2025.1.3-direct-agent-oot/venvs/project-ZiSwsYIx-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/out/final/captures/2026.8.0-direct-agent-oot/venvs/project-X5QLZv1w-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + } + ] + }, + "macos": { + "errors": [], + "platform": "macOS 15 (arm64), native CLI; Pipenv 0.2.8-11.10.4 inside python:3.6.15-slim", + "provenance": { + "capturedAt": "2026-09-18T14:21:06.520127+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "mergedFrom": [ + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-a/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:17.630925+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent" + ], + "pipenvVersions": [ + "0.2.8" + ], + "shapes": [ + "dev" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:31.872148+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent-oot" + ], + "pipenvVersions": [ + "5.4.2" + ], + "shapes": [ + "dev", + "direct" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:45:49.934581+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "agent-oot" + ], + "pipenvVersions": [ + "4.1.4" + ], + "shapes": [ + "transitive" + ] + } + }, + { + "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-d/summary.json", + "provenance": { + "capturedAt": "2026-09-18T14:47:07.046287+00:00", + "cliRevision": "e521093", + "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f", + "host": "Darwin arm64", + "invocations": [ + "in-dir" + ], + "legacyImage": "python:3.6.15-slim", + "modes": [ + "hosted", + "vendored" + ], + "pipenvVersions": [ + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "marker-excluded" + ] + } + } + ], + "modes": [ + "hosted", + "vendored", + "agent", + "agent-oot" + ], + "pipenvVersions": [ + "0.2.8", + "3.6.2", + "4.1.4", + "5.4.2", + "6.2.9", + "7.9.10", + "8.3.2", + "9.1.0", + "10.1.2", + "11.10.4", + "2018.11.26", + "2020.11.15", + "2021.11.23", + "2022.12.19", + "2023.12.1", + "2024.4.1", + "2025.1.3", + "2026.8.0" + ], + "shapes": [ + "direct", + "dev", + "category", + "marker", + "marker-excluded", + "extras", + "transitive", + "crlf" + ] + }, + "results": [ + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 0 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash", + "info": {}, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "0.2.8", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-dev-agent-oot/venvs/project-le2Kar3x", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-direct-agent-oot/venvs/project-Vi8Y6k5P", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-extras-agent-oot/venvs/project-Hdy1kYbO", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-marker-agent-oot/venvs/project-mSh7SIOh", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-transitive-agent-oot/venvs/project-bkGR-pKq", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "10.1.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-dev-agent-oot/venvs/project-EuBgobiP-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-direct-agent-oot/venvs/project-p4uodGuH-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-extras-agent-oot/venvs/project-c6zJSbVZ-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-marker-agent-oot/venvs/project-TLOj7X4t-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-transitive-agent-oot/venvs/project-TPz-ubcN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "11.10.4", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-dev-agent-oot/venvs/project-rvumQJR7-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-direct-agent-oot/venvs/project-rRD3ZqKE-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-extras-agent-oot/venvs/project-oO1dqUUx-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-marker-agent-oot/venvs/project-p-7NMJlC-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-transitive-agent-oot/venvs/project-uDoo2NrU-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python", + "ootVenvNameMatchesWorkon": false, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2018.11.26", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-dev-agent-oot/venvs/project-WBeaWwaZ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-direct-agent-oot/venvs/project-_BmhyZkL-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-extras-agent-oot/venvs/project-usOBprOu-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-marker-agent-oot/venvs/project-P5aQHRYw-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-transitive-agent-oot/venvs/project-RHhZLWm9-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2020.11.15", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-dev-agent-oot/venvs/project-jotSn62P-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-direct-agent-oot/venvs/project-7YJlTv1q-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-extras-agent-oot/venvs/project-O9SEazj5-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-marker-agent-oot/venvs/project-hximekEn-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-transitive-agent-oot/venvs/project-avsbOHLg-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2021.11.23", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-agent-oot/venvs/project-VPPSdrXF-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-agent-oot/venvs/project-Oe79nwd5-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-agent-oot/venvs/project-xrFY7ef0-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "tamper": { + "expectsReject": false, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-extras-agent-oot/venvs/project-fj5TX4um-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 1, + "lockBytesUnchanged": true, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3#egg=urllib3[socks]" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl[socks]" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-agent-oot/venvs/project-3kF_SAjR-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-excluded-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-agent-oot/venvs/project-4b8AKKsv-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ] + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2022.12.19", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-category-agent-oot/venvs/project-xEc6rJSO-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-dev-agent-oot/venvs/project-PtTzFqFB-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-direct-agent-oot/venvs/project-0UeNFdlr-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-extras-agent-oot/venvs/project-xkdemobK-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-marker-agent-oot/venvs/project-DDR4ZCp_-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-transitive-agent-oot/venvs/project-7-es0NIB-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2023.12.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-category-agent-oot/venvs/project--fnruCrf-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-dev-agent-oot/venvs/project-xsC0u6dL-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-direct-agent-oot/venvs/project-Nlq3YoNQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-extras-agent-oot/venvs/project-Jsn3tijM-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-marker-agent-oot/venvs/project-Vj1hhlg6-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-transitive-agent-oot/venvs/project-yDGP0fUF-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2024.4.1", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-category-agent-oot/venvs/project-yAeGV-DD-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-dev-agent-oot/venvs/project-Fdze9eCY-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-direct-agent-oot/venvs/project-UDidtARQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-extras-agent-oot/venvs/project-wKfQ5P1A-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-marker-agent-oot/venvs/project-Ua-x4uOM-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-transitive-agent-oot/venvs/project-sqNtW4tO-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2025.1.3", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-category-agent-oot/venvs/project-jp5oYRPn-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "tests", + "urllib3" + ] + ], + "rewritten": [ + [ + "tests", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "tests" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "category", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-dev-agent-oot/venvs/project-XetQvjsN-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-direct-agent-oot/venvs/project-QZo5Ld-I-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "tamper": { + "expectsReject": false, + "installExit": 0, + "installedPatchedAnyway": true + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 3, + "urllib3Listed": true, + "venvDistributions": 3 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-extras-agent-oot/venvs/project-Pb7pwpA2-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "extras": [ + "socks" + ], + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'", + "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 2, + "urllib3Listed": true, + "venvDistributions": 2 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-marker-agent-oot/venvs/project-Z_FGngEQ-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": true, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "hybridRelock": true, + "lockKeptRelocked": false, + "lockRestoredOriginal": true, + "referenceLeft": false + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true, + "survivesSync": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 6, + "urllib3Listed": true, + "venvDistributions": 6 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-transitive-agent-oot/venvs/project-tFo0iv7w-python", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "survivesSync": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasVendoredRef": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsVendorState": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRemovesVendoredWheel": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "vendoredWheelPresent": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "file", + "got": [ + "file" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [ + "vendor_fetched_missing", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [ + "already_vendored", + "vendor_fetched_missing" + ], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "requirementsExport": { + "exit": 0, + "exportsPatchRef": true, + "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl", + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "scanExit": 0, + "sourceKeys": [ + "file" + ], + "staleInstallWarned": { + "codes": [ + "pypi_pipenv_stale_install", + "vendor_integrity_unverified", + "vendor_prebuilt_downloaded" + ], + "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 0 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + }, + "sync": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "action": "applied", + "files": [ + { + "path": "urllib3/response.py", + "verified": true + } + ], + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + }, + { + "action": "skipped", + "errorCode": "vendor_integrity_unverified", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product ` verifies the installed files against the patch record" + }, + { + "action": "skipped", + "errorCode": "pypi_pipenv_stale_install", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026" + }, + { + "action": "skipped", + "errorCode": "vendor_prebuilt_downloaded", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "2026.8.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-dev-agent-oot/venvs/project-H7fL1xTY", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-direct-agent-oot/venvs/project-SjHJBH5g", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-transitive-agent-oot/venvs/project-R9KbIlov", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "3.6.2", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-dev-agent-oot/venvs/project-156NY79G", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-direct-agent-oot/venvs/project-S8Z-YEC3", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/captures/4.1.4-transitive-agent-oot/venvs/project-hOJKMBk9", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "4.1.4", + "pipfileSpec": null, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-dev-agent-oot/venvs/project-HHSeGvEK", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-direct-agent-oot/venvs/project-75euv67j", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/5.4.2-transitive-agent-oot/venvs/project-PWzNFRQ1", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "5.4.2", + "pipfileSpec": 1, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-dev-agent-oot/venvs/project-WccTvFLA", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-direct-agent-oot/venvs/project-96LD91ty", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "direct", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "extras", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker", + "supported": false + }, + { + "checks": {}, + "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries", + "info": {}, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-transitive-agent-oot/venvs/project-NnL-gs-7", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": true, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)", + "info": { + "applied": 0, + "dryRun": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 0, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "redirect_pipenv_skipped" + ], + "exit": 0 + }, + "rollbackHarmless": { + "exit": 1 + }, + "scanExit": 0, + "warnings": [ + { + "code": "redirect_pipenv_skipped", + "detail": "only pipfile-spec 6 supports patch file references" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported", + "vendor_fetched_missing" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_spec_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested", + "errorCode": "pypi_pipenv_spec_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "6.2.9", + "pipfileSpec": 3, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": {}, + "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image", + "info": {}, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "7.9.10", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-dev-agent-oot/venvs/project-Iq5OMDdg", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-direct-agent-oot/venvs/project-RW6cQyoM", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-extras-agent-oot/venvs/project-qCX_4SXE", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-marker-agent-oot/venvs/project-tk6-Ud0l", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-transitive-agent-oot/venvs/project-iGJfHZ9t", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "8.3.2", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "crlfPreserved": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "crlf", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-dev-agent-oot/venvs/project-9NPbAK7d", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "develop", + "urllib3" + ] + ], + "rewritten": [ + [ + "develop", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "develop" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "dev", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-direct-agent-oot/venvs/project-zwilhVJE", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRestoredAfterTamper": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "tamperRejected": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "tamper": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "tamperRejected": { + "expectsReject": true, + "installExit": 1, + "installedPatchedAnyway": false + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "direct", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 5, + "urllib3Listed": true, + "venvDistributions": 5 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-extras-agent-oot/venvs/project-VoTeUWTM", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 2 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 2 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "extras", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 4, + "urllib3Listed": true, + "venvDistributions": 4 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-marker-agent-oot/venvs/project-KTlWVSq1", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version < '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker", + "supported": false + }, + { + "checks": { + "excludedStaysAbsent": true, + "lockUntouched": true, + "nothingApplied": true + }, + "expected": "marker excludes urllib3: nothing installed, nothing to patch", + "info": { + "nothingApplied": { + "applied": 0, + "exit": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "excludedStaysAbsent": true, + "expectedSourceKey": true, + "freshCloneKeepsExcluded": true, + "freshCloneLockUnchanged": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "excludedStaysAbsent": { + "urllib3/response.py": null + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneKeepsExcluded": { + "exit": 0 + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 1 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "markers": "python_version > '4'", + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 1, + "statements": 0 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 1 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "marker-excluded", + "supported": false + }, + { + "checks": { + "appliedExactlyOne": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rescanIdempotent": true, + "rollbackClearsManifest": true, + "rollbackExit0": true, + "rollbackKeepsLock": true, + "rollbackRestoresUpstreamBytes": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "appliedExactlyOne": { + "applied": 1, + "patches": [ + { + "action": "added", + "description": "", + "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT", + "license": "", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl", + "severity": "HIGH", + "tier": "free", + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vulnerabilities": [ + { + "cves": [ + "CVE-2025-66418" + ], + "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026", + "id": "GHSA-gm62-xv2j-4w53", + "severity": "HIGH", + "summary": "urllib3 allows an unbounded number of links in the decompression chain" + } + ] + } + ], + "status": "success" + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "rescanIdempotent": { + "applied": 0, + "exit": 0, + "status": "success" + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ] + }, + "rolledBack": 1, + "status": "success", + "vendoredReverted": [] + }, + "rollbackRestoresUpstreamBytes": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + }, + "scanExit": 0, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "vex": { + "exit": 1, + "statements": 0 + } + }, + "invocation": "in-dir", + "mode": "agent", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "bareScanSeesPipenvVenv": true, + "installedBytesPatched": true, + "lockUntouched": true, + "rollbackClearsManifest": true, + "rollbackRestoresUpstream": true, + "scanApplied": true, + "survivesRepeatInstall": true + }, + "expected": null, + "info": { + "applyPath": "bare", + "bareScan": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "bareScanSeesPipenvVenv": { + "exit": 0, + "foreignInterpreterHit": false, + "found": 1, + "paths": [], + "scannedPackages": 8, + "urllib3Listed": true, + "venvDistributions": 8 + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-transitive-agent-oot/venvs/project-xNX_V925", + "ootVenvNameMatchesWorkon": true, + "rollbackRestoresUpstream": { + "exit": 0, + "oracle": { + "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06" + } + }, + "scanApplied": { + "applied": 1, + "exit": 0, + "path": "bare" + }, + "survivesRepeatInstall": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + } + }, + "invocation": "in-dir", + "mode": "agent-oot", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "allCategoriesRewritten": true, + "appliedExactlyOne": true, + "dryRunParity": true, + "expectedSourceKey": true, + "freshCloneInstallsPatch": true, + "freshCloneLockUnchanged": true, + "installedBytesPatched": true, + "lockHasPatchUrl": true, + "lockOnlyApplies": true, + "lockOnlyRescanGreen": true, + "lockRewritten": true, + "lockStillJson": true, + "lockUnchangedByInstall": true, + "markersExtrasPreserved": true, + "metaUnchanged": true, + "noCrlfIntroduced": true, + "pipenvInstallExit0": true, + "pipfileUnchanged": true, + "pipfileUnchangedByInstall": true, + "recordHasFiles": true, + "rescanIdempotent": true, + "rollbackAfterRelockRetires": true, + "rollbackClearsManifest": true, + "rollbackClearsRedirectLedger": true, + "rollbackExit0": true, + "rollbackKeepsPipfile": true, + "rollbackRestoresLockBytes": true, + "staleInstallWarned": true, + "warmInstallReplacesUpstream": false + }, + "expected": null, + "info": { + "allCategoriesRewritten": { + "pristine": [ + [ + "default", + "urllib3" + ] + ], + "rewritten": [ + [ + "default", + "urllib3" + ] + ] + }, + "applied": 1, + "appliedExactlyOne": { + "applied": 1, + "exit": 0, + "status": "success", + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "expectedSourceKey": { + "expected": "path", + "got": [ + "path" + ] + }, + "freshCloneInstallsPatch": { + "exit": 0, + "oracle": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + } + }, + "installedBytesPatched": { + "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730" + }, + "lockOnly": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 1, + "codes": [], + "exit": 0, + "lockfileOnlyPackages": 5 + }, + "lockOnlyRescanGreen": { + "codes": [], + "exit": 0, + "status": "success" + }, + "relock": { + "exit": 0, + "lockBytesUnchanged": false, + "patchSourceKept": false, + "pipfileUnchanged": true + }, + "rescanIdempotent": { + "applied": 1, + "exit": 0, + "status": "success" + }, + "rewrittenEntries": [ + { + "entry": { + "hashes": [ + "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + ], + "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6" + }, + "key": "urllib3", + "section": "default" + } + ], + "rollbackAfterRelockRetires": { + "cleared": true, + "envelope": { + "failed": 0, + "hosted": { + "editedFiles": 0, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "status": "success", + "vendoredReverted": [] + }, + "exit": 0, + "lockKeptRelocked": true + }, + "rollbackEnvelope": { + "failed": 0, + "hosted": { + "editedFiles": 1, + "failed": [], + "reverted": [ + "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + ], + "unsupported": [] + }, + "manifest": { + "preserved": false, + "removedEntries": [] + }, + "rolledBack": 0, + "status": "success", + "vendoredReverted": [] + }, + "scanExit": 0, + "sourceKeys": [ + "path" + ], + "staleInstallWarned": { + "codes": [ + "redirect_pypi_stale_install" + ], + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)" + }, + "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98", + "verify": { + "exit": 2 + }, + "vex": { + "exit": 0, + "statements": 1 + }, + "warmInstallReplacesUpstream": { + "install": { + "exit": 0, + "patched": false + } + }, + "warmReinstalled": { + "install": { + "exit": 0, + "patched": false + } + }, + "warnings": [ + { + "code": "redirect_pypi_stale_install", + "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026" + } + ] + }, + "invocation": "in-dir", + "mode": "hosted", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": true + }, + { + "checks": { + "dryRunParity": false, + "lockOnlyApplies": false, + "lockUnchanged": true, + "noLedger": true, + "pipfileUnchanged": true, + "refusedWithCode": true, + "rollbackHarmless": true + }, + "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)", + "info": { + "applied": 0, + "dryRun": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "dryRunParity": { + "applied": 1, + "exit": 0, + "untouched": true + }, + "lockOnly": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "lockOnlyApplies": { + "applied": 0, + "codes": [ + "package_not_installed", + "vendor_fetch_unverifiable" + ], + "exit": 1, + "lockfileOnlyPackages": 5 + }, + "refusedWithCode": { + "applied": 0, + "codes": [ + "pypi_pipenv_installer_unsupported" + ], + "exit": 1 + }, + "rollbackHarmless": { + "exit": 0 + }, + "scanExit": 1, + "warnings": [ + { + "action": "failed", + "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode", + "errorCode": "pypi_pipenv_installer_unsupported", + "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl" + } + ] + }, + "invocation": "in-dir", + "mode": "vendored", + "passed": true, + "pipenv": "9.1.0", + "pipfileSpec": 6, + "shape": "transitive", + "supported": false + } + ] + } + } +}