Bug hunt ledger: Bun

[Mikola Lysenko (mikolalysenko)]

[agent] Progress ledger for the scheduled Bun bug-hunt routine (label pm:bun).

Last updated: 2026-10-01 (run 5), main 61cfb9b, latest release 4.0.0, latest Bun 1.4.2.

Method: real Bun installs (npm @oven/bun-* or GitHub release binaries) and a local Python mock of the patch API: batch, by-package, the patches/package grant, patches/view with blob contents, blob/<hash>, the hosted tarball route, and a /registry/ passthrough for SOCKET_NPM_REGISTRY. Set SOCKET_PATCH_SERVER_URL to the mock. The oracle is the marker bytes after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus byte comparison of the lockfiles and node require where runtime matters. The repo's own matrix (scripts/backtest-bun.py, bun-compatibility.yml) already covers plain hosted and vendored shapes across Bun 0.8.1–1.4.2. It always runs with --ignore-scripts and never in agent mode, and it never runs vex on an isolated-linker tree. This ledger tracks what it doesn't.

Coverage matrix

OS	Bun	Agent: hoisted	Agent: isolated linker	Hosted/vendored: bun patch	Hosted/vendored: default-trusted scripts	Hosted → vex: isolated linker	Hosted rollback/remove byte-exact (text lock)	bun.lockb takeover ⇄ revert
Linux	1.1.45	untested	n/a	untested	pass	n/a	pass (v0)	untested
Linux	1.2.23	pass	fail #366 (opt-in)	fail #367	pass	fail #405 (opt-in)	untested	untested
Linux	1.3.0–1.3.4	untested	untested	untested	pass	untested	untested	untested
Linux	1.3.5–1.3.9	untested	untested	fail #367 (1.3.9)	fail #371	untested	untested	untested
Linux	1.3.14	pass	fail #366 (default for workspaces)	fail #367	fail #371	fail #405	pass (v1, workspace, catalog)	untested
Linux	1.4.2	pass	fail #366 (default for workspaces)	fail #367 (text + lockb)	fail #371	fail #405	pass (v2, alias, overrides)	pass (semantic; not byte-exact, see Known non-bugs)
macOS	1.2.23	pass	fail #366	fail #367	untested	fail #405	untested	untested
macOS	1.3.4 / 1.3.5	untested	untested	untested	pass / fail #371	untested	untested	untested
macOS	1.3.14 / 1.4.2	pass	fail #366	fail #367	fail #371 (1.4.2)	fail #405	untested	untested
Windows	1.2.23	pass	fail #366	fail #367	untested	fail #405	untested	untested
Windows	1.3.4 / 1.3.5	untested	untested	untested	pass / fail #371	untested	untested	untested
Windows	1.3.14 / 1.4.2	pass	fail #366 (bunfig)	fail #367	fail #371 (1.4.2)	fail #405 (bunfig + default workspace)	untested	untested

Global mode (-g, agent; run 3)

OS	Bun	default layout: scan report / apply / vex / rollback / get	BUN_INSTALL_BIN set	BUN_INSTALL_GLOBAL_DIR set	npm-installed bun (shim only)	-g --mode hosted refusal
Linux	1.1.45 / 1.2.23 / 1.3.14 / 1.4.2	pass	fail #443	fail #443	pass (1.4.2)	pass
macOS	1.1.45 / 1.2.23 / 1.3.14 / 1.4.2	pass	fail #443	fail #443	pass	pass
Windows	1.3.14 / 1.4.2	pass	fail #443	fail #443	fail #434 (bun.cmd)	pass
Windows	1.1.45 / 1.2.23	blocked (bun add -g failed in the probe's space+unicode temp path)	blocked	blocked	blocked	untested

Untested: a non-writable global dir, a symlinked BUN_INSTALL, and Bun 1.0.x.

Bundled dependencies (bundled: true lock entries; run 4)

OS	Bun	lock	hosted scan warns/skips	vendored scan warns/skips	bundled copy patched after frozen install	vendored vex	hosted vex	hosted vex --no-verify
Linux	1.1.45	text v0 / lockb	fail #469	fail #469	fail #469	fail #469 (attests)	pass (not_applied)	fail #469
Linux	1.2.23 / 1.3.14	text v1	fail #469	fail #469	fail #469	fail #469	pass	fail #469
Linux	1.4.2	text v2 / lockb	fail #469	fail #469	fail #469	fail #469	pass	fail #469
macOS, Windows	all	all	untested	untested	untested	untested	untested	untested

Non-registry copies of a patched name@version (run 5, Linux)

Bun	lock	URL tgz + nested registry copy: scan warns	root copy patched after frozen install	vendored vex	hosted vex	hosted vex --no-verify	URL-only refusal
1.1.45	text v0	fail #497	fail #497	fail #497 (attests)	pass (not_applied)	fail #497	untested
1.2.23	text v1	fail #497	fail #497	fail #497	pass	fail #497	untested
1.3.14	text v1	fail #497	fail #497	fail #497	pass	untested	untested
1.4.2	text v2 (URL and file: tgz)	fail #497	fail #497	fail #497	pass	fail #497	pass
any	bun.lockb, github: tuples	untested	untested	untested	untested	untested	untested
macOS, Windows	all	untested	untested	untested	untested	untested	untested

Lock-shape edge cases (run 5, Linux)

• CRLF bun.lock + CRLF package.json (1.1.45 v0, 1.3.14, 1.4.2): hosted scan → frozen install → rollback, and vendored → vendor --revert. Both byte-exact: pass.
• bun install --yarn (sibling yarn.lock), on 1.1.45 lockb, 1.2.23 and 1.4.2: hosted rewires both locks; lockb rollback refuses and touches neither file: pass.
• [install.scopes] custom-registry scope (1.3.14, 1.4.2): hosted rewrite and byte-exact rollback: pass.
• 1.1.45 binary workspace lock, hosted, read by 1.1.45 / 1.2.23 / 1.3.14 / 1.4.2. Frozen installs are patched, the takeover refuses as documented, and vex is correct: pass.
• bun add after hosted (all four versions; the pins survive) and after vendored (digest-less re-save on < 1.3.10, healed by the re-run): pass.

Takeovers and vendored VEX (run 4, Linux)

• Hosted → vendored on a v1 workspace lock (1.3.14): pass. Refuses before any write; dry-run parity is as documented.
• Vendored + isolated linker, stale tree → vendored_tree_out_of_sync is missing (1.4.2): fail, under With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (comment). Hoisted control: pass.

Other passes (Linux, 1.4.2 unless noted):

• Run 1: agent scan --global, and the (pre-v5) setup hook.
• Run 3: SOCKET_GLOBAL=1 ≡ -g; SOCKET_GLOBAL_PREFIX / --global-prefix scan only that dir; scan -g inside a project with a bunfig setting globalDir doesn't leak project dirs; vex without -g ignores global copies.
• Run 2:
  • Agent scan → vex → rollback, with no cache write-through.
  • remove, repair and list on hosted pins.
  • Hosted bun.lockb idempotency, --dry-run, and the rollback refusal.
  • Vendored catalog: and overrides.
  • Lockfile-only vendored scan on 1.1.45 v0 with a CRLF + BOM package.json.
  • A corrupt served tarball rejected on 1.3.9, 1.3.10 and 1.4.2, text + lockb.

Backlog

0. Maintainer request (partly covered in run 3): global (-g) mode for hosted patches. Still to do: a non-writable global dir must fail loudly; a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path; Bun 1.0.x. Re-test Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 (still reproduces on 61cfb9b) and On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (bun.cmd) once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands. Checklist: the 20261001T040000Z entry.
1. A maintainer needs to delete the probe branches bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs. The sandbox can't delete branches (still denied in run 5), so no new probes until that's fixed.
2. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 variants: github: tuples (unresolvable in the sandbox, needs a probe) and a binary bun.lockb with a URL dependency. Re-test when fixed.
3. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 follow-ups: macOS/Windows cells; bundled inside a workspace member; rollback / remove of a rewired bundled entry; re-test when fixed.
4. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 once .bun joins the crawler walks (Fix npm crawler missing relocated dependency stores (#359, #362) #365 landed without it). Then re-check the With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 vendored warning and Windows agent mode with the isolated linker (junctions).
5. v5 socket.yml policy and per-run limits in a Bun workspace.
6. Hosted rollback on real macOS and Windows checkouts (Linux CRLF analog passes, run 5).
7. Digest boundary with a valid substitute tarball, 1.3.9 text lock vs 1.3.10. Low priority: Bun < 1.3.10 is a documented limitation.

Known non-bugs

• patches-api.socket.dev is blocked by the sandbox proxy. Mock the API. Also, the CLI's reqwest can't reach registry.npmjs.org from the sandbox (curl can), so hosted rollback/remove need SOCKET_NPM_REGISTRY pointed at a local passthrough. Without it you get cannot restore … error sending request, which is a sandbox artifact.
• Agent rollback → missing_blob when the mock serves no before-blob (fixture limit).
• v5 rollback removes the rolled-back entries from .socket/manifest.json, so a later apply is a success no-op (CLI_CONTRACT rollback row).
• Hosted bun.lockb pins: rollback / remove refuse with the git checkout -- bun.lockb remedy (documented). After a hosted → vendored → vendor --revert round trip, bun.lockb is semantically identical (same bun pm hash and yarn dump) but not byte-identical: its string buffer keeps the dead URLs. The doc promises a byte-exact registry record, not the whole file.
• Bun 1.2.23 workspaces default to the hoisted layout (isolated only via linker = "isolated"). From Bun 1.3.x a fresh workspace lock defaults to isolated.
• setup was removed in v5 (v5 prerelease: scan → vex → vendor workflow, hosted by default #277). The run-1 setup pass is obsolete.
• esbuild after rewiring is listed by bun pm untrusted but has no observable effect. Use better-sqlite3 to observe On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371.
• Documented refusals (docs/testing/bun-compatibility.md): a version-0 workspace lock in hosted mode (redirect_bun_workspace_unsupported), a pre-v2 workspace lock in vendored mode (vendor_bun_workspace_unsupported), and missing digest enforcement for text-lock URL/local tuples on Bun < 1.3.10.
• Agent-mode npm aliases under Bun are npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm-owned).
• --global-prefix must name the node_modules dir itself (~/.bun/install/global/node_modules). Its parent scans 0 packages; the flag is documented as the packages root.
• -g combined with --mode hosted is a clap-level conflict: plain-text error, exit 2, no JSON envelope even with --json. Consistent with other usage errors.
• Vendored scan --dry-run exits 0 with status: success and would_refuse while the real run exits 1 with partial_failure, for the same Bun preflight refusal. Documented (CLI_CONTRACT would_refuse).
• Vendored vex attests from the committed artifact even when the installed tree is stale. By design: only a vendored_tree_out_of_sync warning is owed.
• Hosted default vex on a bundled-copy project correctly refuses (not_applied). Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 is about vendored mode and --no-verify.
• bun pm bin -g ignores a project-local bunfig.toml, so scan -g inside a project can't be redirected by the project.
• Vendored, then bun add, on Bun < 1.3.10 re-saves the local tuples without sha512. That's documented ("Digest-less re-saves"): the vendored re-run reports already_vendored and re-pins the digest.
• Bun records "" as the registry field of a tuple even when it came from an [install.scopes] or custom default registry, so rollback restoring "" is correct.
• On a bun install --yarn project, hosted rollback restores bun.lock byte-exact but adds a #<sha1> fragment to Bun's yarn.lock resolved lines. It's semantically equivalent and yarn-classic's rewriter, so it isn't filed as a Bun bug.
• Mock fixture: build the patched tarball with a fixed gzip mtime. Otherwise a mock restart changes its sha512 and later installs fail IntegrityCheckFailed.
• link: deps need bun link registration, and github: deps don't resolve in the sandbox. Both are environment limits.

[github-actions[bot]]

[agent] 2026-09-30: Bun bug-hunt run

Tested: main f6b7fb9 (CLI 4.0.0 workspace version). Latest release 4.0.0 and previous release 3.3.0, both from npm @socketsecurity/socket-patch, for regression checks. Bun 1.1.38, 1.1.45, 1.2.23, 1.3.0, 1.3.2, 1.3.4, 1.3.5, 1.3.6, 1.3.9, 1.3.10, 1.3.14, 1.4.0 and 1.4.2 (the current latest) from GitHub releases, on Node 22 in the sandbox. Probes ran on ubuntu, macOS and Windows.

Method: the patch API is unreachable from the sandbox (patches-api.socket.dev is proxy-denied), so I used a ~70-line Python mock with these routes: batch, by-package, the patches/package grant, patches/view with blobContent, and the hosted tarball route. Patched tarballs are built from the real registry tarball with a marker prepended to the main file, gzipped with mtime 0 so the sha512 is stable. The oracle is the marker in the installed file after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus node require for the native-module case.

This is the first run: there was no earlier ledger and no pm:bun issues to re-triage.

Cells

• fail Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: agent mode with Bun's isolated linker. Transitive packages under node_modules/.bun/ are treated as lockfile-only: scan --mode agent exits 0 with success and doesn't patch or record them. This happens by default in fresh workspaces on Bun 1.3.14 and 1.4.2, and with linker = "isolated" on 1.2.23+. Reproduced on Linux, macOS and Windows. Releases 3.3.0 and 4.0.0 behave the same.
• fail Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367: hosted and vendored mode silently discard the project's own bun patch (patchedDependencies). The fresh frozen install exits 0 with Socket's patch but without the user's. Reproduced on Bun 1.2.23, 1.3.9, 1.3.14 and 1.4.2, text lock and bun.lockb, on all 3 OSes. 3.3.0 and 4.0.0 behave the same. rollback restores it (pass).
• fail On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: hosted and vendored rewiring loses Bun's default trust, so better-sqlite3's install script is blocked and require fails after a fresh frozen install. The first bad Bun release is 1.3.5 (1.3.4 passes). Confirmed on all 3 OSes. trustedDependencies works around it.
• commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (npm-owned): agent-mode npm aliases under Bun 1.4.2. The mixed project patches only left-pad, not lp, and VEX attests not_affected.
• pass: agent mode with the hoisted linker (direct and transitive), on Bun 1.2.23 / 1.3.14 / 1.4.2 × 3 OS.
• pass: hosted + bun update unwires the redirect, and vex then reports redirect_unwired (Bun 1.4.2).
• pass: agent scan --global on bun add -g packages (~/.bun/install/global/node_modules, Bun 1.4.2).
• pass: the setup hook (npx …) in a Bun-only PATH with no node/npx. Bun maps npx itself, and bun install exits 0 (1.4.2).
• pass: agent writes break Bun's cache hardlinks (rename-over write, code-verified; the cache is not written through).

Issues

• Filed Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366
• Filed Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367: Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367
• Filed On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371
• Commented on npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356: npm agent-mode apply never patches an npm-aliased install (lp@npm:left-pad), yet VEX attests the package not_affected #356 (comment)

False positives ruled out

• Agent rollback failing with missing_blob came from my mock, which serves no before-blob. It's a fixture limit, not a bug.
• The esbuild postinstall that became "untrusted" after rewiring has no observable effect (its binary comes via optionalDependencies), so I used better-sqlite3 to prove the On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371 impact.
• On Windows, the default-linker workspace cell had bun install exit 1 on the runner. That cell is inconclusive there; the explicit linker = "isolated" cell reproduces Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366.
• On Bun 1.2.23, a new workspace defaults to the hoisted layout, so agent mode passes there. That's expected, not a fix.

Probe

• bughunt/bun/20260930-isolated-bunpatch, run https://github.com/SocketDev/socket-patch/actions/runs/36765789215 (3 OS × Bun 1.2.23 / 1.3.14 / 1.4.2)
• bughunt/bun/20260930-default-trust, run https://github.com/SocketDev/socket-patch/actions/runs/36766578001 (3 OS × Bun 1.3.4 / 1.3.5 / 1.4.2)
• Neither branch could be deleted. git push --delete failed through the git proxy ("remote end hung up", three tries each), so a maintainer needs to delete both.

Next

1. Agent mode on Windows with the isolated linker (junction layout) once Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 is fixed. Also re-test the Windows default-workspace bun install exit 1.
2. The hosted ⇄ vendored takeover and scoped rollback / remove on bun.lockb with two patched packages, one of them workspace-only (1.2.23 vs 1.4.2).
3. bun install --frozen-lockfile after a hosted run on Bun 1.3.9 vs 1.3.10 with a tampered hosted tarball in a lockb project (digest enforcement for binary locks).
4. overrides / resolutions targeting the patched package (text and lockb), and catalog: specs in workspaces (Bun 1.3+).
5. Lockfile-only checkout + vendored scan on Bun 1.1.45 (lockfileVersion 0, no workspaces) with CRLF + BOM package.json.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 2463257 ("feat!: consolidate the v5 patching workflow", #277). It's a big rewrite: scan is now hosted by default, setup is gone, hosted mode keeps no ledger, and VEX works without a manifest. Latest release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for regression checks. Bun 1.1.45, 1.2.23, 1.3.9, 1.3.10, 1.3.14 and 1.4.2 (still the current latest), from npm @oven/bun-linux-x64, on Linux. Probes ran on ubuntu, macOS and Windows.

Method: same as run 1, with the mock rebuilt (mkpatch.py + mock.py). I added a /registry/<name>/<ver> passthrough and set SOCKET_NPM_REGISTRY to it, because the CLI's reqwest can't reach registry.npmjs.org from this sandbox even though curl can. Hosted rollback needs that registry lookup. I also set SOCKET_PATCH_SERVER_URL to the mock, so its URLs count as hosted pins. The oracle: marker bytes after a fresh-checkout bun install --frozen-lockfile with an empty cache, plus byte comparison of the lockfiles.

Re-triage (on 2463257)

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces. With the isolated linker and Bun 1.4.2, scan --mode agent gives package_not_installed for is-number under .bun/, exit 0. No comment, since nothing is new.
• Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367 / On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: v5 still has no handling for patchedDependencies or trustedDependencies (grep over crates/ and docs/ finds nothing). I didn't re-run the runtime repro this time (see Blocked). No change, no comment.

Cells

• fail With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (new): hosted scan (now the default) → vex with Bun's isolated linker. vex attests a transitive package under node_modules/.bun/ as verified / not_affected while the installed copy is unpatched (a stale tree before reinstall) or tampered (after a fresh install). The same project with the hoisted linker gives not_applied. Reproduced on Linux, macOS and Windows × Bun 1.2.23 (linker=isolated), 1.3.14 and 1.4.2, both with the bunfig setting and as a default workspace. Regression: 4.0.0 omits the purl (package_not_found).
• pass: hosted rollback <purl> and unscoped rollback, with two packages, on text locks version 0 (1.1.45), 1 (1.3.14) and 2 (1.4.2). The lock comes back byte-identical and the frozen install is OK.
• pass: hosted rollback byte-exact for an npm alias (lp@npm:left-pad), a v1 workspace (1.3.14), catalog: (1.3.14), and overrides forcing the patched transitive (1.4.2). Vendored catalog: and overrides on 1.4.2 also pass, rollback included.
• pass: remove <purl> × 2 restores the hosted text lock byte-exact. repair and list on a hosted project work.
• pass: bun.lockb hosted → vendored takeover → vendor --revert with two packages (1.4.2). Every fresh frozen install is correct, and bun pm hash and the bun ./bun.lockb dump match the original. The file isn't byte-identical: it's 1997 → 2301 bytes, because its string buffer keeps the dead hosted and vendored URLs. That isn't a bug: semantics are preserved, and the doc only promises a byte-exact registry record. Logged under Known non-bugs.
• pass: hosted bun.lockb idempotency (a second scan leaves it unchanged, --dry-run writes nothing), and rollback refuses with the documented git checkout -- bun.lockb remedy.
• pass: lockfile-only vendored scan on Bun 1.1.45 (lockfileVersion 0) with a CRLF + BOM package.json. The manifest isn't touched, the frozen install is patched, and rollback is byte-exact.
• pass: a corrupt served tarball is rejected on 1.3.9, 1.3.10 and 1.4.2, text and bun.lockb. Note that bun.lockb enforces the sha512 already on 1.3.9 ("Integrity check failed"). My tamper corrupted the gzip, so a 1.3.9 text lock failed with ZlibError instead. That isn't a digest-boundary test; it's still in the backlog.
• pass: agent scan → vex → rollback with the mock serving before-blobs (1.4.2). A warm-cache reinstall after apply gives pristine bytes, so the Bun cache isn't written through.
• pass, Windows: a default-workspace bun install on 1.3.14 and 1.4.2 exited 0 on windows-latest this time (inconclusive in run 1).

Issues

• Filed With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405

False positives ruled out

• Hosted rollback → partial_failure "error sending request for url (https://registry.npmjs.org/…)" was a sandbox artifact: reqwest can't connect to npmjs here. With SOCKET_NPM_REGISTRY pointed at a passthrough, the restore succeeds.
• apply after agent rollback is a success no-op. v5 rollback deliberately removes manifest entries (CLI_CONTRACT rollback row), so this is expected.

Probe

• bughunt/bun/20261001-vex-isolated: runs https://github.com/SocketDev/socket-patch/actions/runs/36800886824 (failed on pipefail in my script) and https://github.com/SocketDev/socket-patch/actions/runs/36801259018 (9/9 jobs, all results reported in With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405).

Blocked

• Deleting branches is still impossible from this sandbox. In run 1, git push --delete went through the git proxy and got "remote end hung up". This run the first attempt failed the same way, and a later command was refused by the session's permission classifier ("Git Destructive"), so I didn't retry. A maintainer needs to delete three branches: bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch and bughunt/bun/20261001-vex-isolated.
• I didn't re-run the Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367 runtime repro (bun patch --commit) because that command was refused by the same classifier. I re-triaged it by code inspection only.

Next

1. Digest boundary with a valid substitute tarball (a different but well-formed tgz) on a 1.3.9 text lock vs 1.3.10, in hosted and vendored mode. Confirm bun.lockb enforces on 1.3.9.
2. vex with a vendored project under the isolated linker: does the vendored_tree_out_of_sync warning fire when the .bun/ copy is stale?
3. A Windows agent run with the isolated linker (junction layout) once Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 is fixed. Also VEX on Windows after a real frozen hosted install.
4. A hosted → vendored takeover on a v1 workspace lock (1.3.14). It must refuse vendor_bun_workspace_unsupported and leave the hosted pin byte-untouched. Check --dry-run parity too.
5. v5 socket.yml policy and per-run limits in a Bun workspace with two patched packages (Bun 1.4.2).

[github-actions[bot]]

[agent] 2026-10-01: maintainer note: test global (-g) mode for hosted patches

This is a maintainer request, not a run report. Add it to the top of the backlog and keep it there until the cells below are covered.

Ask: make sure we correctly scan global installs when -g / --global is passed, on every major Bun version and on Linux, macOS and Windows.

Where Bun puts global installs: bun add -g; discovery via bun pm bin -g (~/.bun/install/global/node_modules, BUN_INSTALL). Cover Bun 1.0 through latest, and Windows %USERPROFILE%\.bun.

What to check (prove each with a real global install, not by reading source):

1. socket-patch scan -g (no --mode) is report-only. It must find every globally installed Bun package that has a hosted patch: none missing, no project packages leaking in, correct versions. Also check --json.
2. scan -g run from inside a Bun project versus outside one: -g must scan only the global location, and a scan without -g must never touch it.
3. scan -g --mode hosted and scan --global-prefix <dir> --mode hosted must refuse loudly, as designed ("global installs have no project lockfile to redirect"). They must exit non-zero and write nothing.
4. get -g defaults to agent mode. Check scan -g --apply, apply -g, rollback -g and vex -g: the globally installed copy is actually patched (run the installed tool or import it), rollback restores it byte for byte, and vex only attests what's applied.
5. --global-prefix <dir> and SOCKET_GLOBAL=1 behave the same as -g. That covers custom prefixes, version managers, paths with spaces or unicode, and a non-root user's prefix.
6. A global directory you can't write to (root-owned prefix, Windows Program Files) must fail loudly with a clear error, never exit 0 unpatched.

Add OS × Bun version cells for -g (scan report / apply / rollback) to the coverage matrix, and use probe branches for macOS and Windows.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 2463257 (unchanged since run 2) and latest release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for regression checks. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2, from npm @oven/bun-*, on Linux, plus a probe on ubuntu, macOS and Windows. This run focused on the maintainer request: global (-g) mode.

Method: real bun add -g semver@7.6.0 is-number@7.0.0 into an isolated BUN_INSTALL, with a Python mock of the public proxy (SOCKET_PROXY_URL: /patch/batch, view, by-package, blob) serving free patches for both packages. The oracle: marker bytes in the real global copy, node require() of the global package, VEX statements, and sha256 of the original files after rollback. Paths in the probe contain a space and ü.

Re-triage (on 2463257)

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces. With the isolated linker and Bun 1.4.2, to-regex-range → transitive is-number gives scan --mode agent → [skip] … not installed, exit 0, unpatched. Direct deps under .bun/ do patch. Nothing new, no comment.
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405, Hosted and vendored Bun rewiring silently discards the project's own bun patch (patchedDependencies): fresh frozen installs drop the user's patch with exit 0 #367, On Bun ≥ 1.3.5, hosted and vendored rewiring drops Bun's default trust, so install scripts of patched packages (better-sqlite3, esbuild, sharp…) are silently blocked #371: main is unchanged since run 2, so I didn't re-check them.

Global-mode cells (scan -g report / hosted refusal / scan -g --mode agent / runtime import / vex -g / vex -g omits an unapplied patch / apply -g / rollback -g byte-exact / get -g)

• pass, default layout ($BUN_INSTALL/bin + $BUN_INSTALL/install/global): Linux, macOS and Windows × 1.1.45, 1.2.23, 1.3.14 and 1.4.2. The exception is Windows 1.1.45/1.2.23, where bun add -g itself failed in the space + unicode temp dir (blocked, not ours).
• pass: scan -g --mode hosted, --global-prefix … --mode hosted, SOCKET_GLOBAL=1 --mode hosted and SOCKET_GLOBAL_PREFIX … --mode hosted all exit 2 with "global installs have no project lockfile to redirect" and write nothing.
• pass: SOCKET_GLOBAL=1 matches -g, and SOCKET_GLOBAL_PREFIX / --global-prefix <bun global node_modules> scan only that directory.
• pass: scan -g from inside a Bun project, even one with a project bunfig.toml setting globalDir / globalBinDir, scans only the real global dir. bun pm bin -g ignores the project bunfig, so nothing leaks from the project.
• pass: vex -g attests applied global patches and omits a reverted one with not_applied. Without -g, vex doesn't touch the global copy (package_not_found).
• fail Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 (new): with BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR set, scan -g finds no Bun globals (exit 0, success). scan -g --mode agent exits 0 unpatched, get -g exits 1, and vex -g has nothing to attest. This holds on every OS × version tested and on release 4.0.0 (not a regression). The cause is parse_bun_bin_output guessing <bin>/../install/global/node_modules.
• fail On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (commented): on Windows, an npm-installed Bun (only bun.cmd on PATH) gives scan -g empty, on 1.3.14 and 1.4.2. It's the bare-bun spawn already covered by On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 / PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442. macOS and Linux pass the same layout.

Issues

• Filed Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443
• Commented on On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (npm-owned, bughunt) with the Bun evidence: On Windows, scan -g / get -g / vex -g find no global npm packages because npm root -g is spawned as bare npm, which never resolves to npm.cmd #434 (comment)

False positives ruled out

• --global-prefix ~/.bun/install/global (the parent, not node_modules) scans 0 packages. The flag is documented as the packages root, so that's user error.
• scan -g --mode hosted --json prints plain text on stderr with exit 2 and no JSON envelope. That's a clap-level argument conflict, consistent with other usage errors.
• A bunfig globalDir in ~/.bunfig.toml wasn't honoured by bun add -g in my sandbox setup. Bun ignored it, so it isn't socket-patch's problem. The env vars are the reproducible trigger.
• scan -g also scans npm's own global root (/opt/node22/lib/node_modules). That's by design: global mode covers every package manager's globals.

Probe

• bughunt/bun/20261001-global-dirs: https://github.com/SocketDev/socket-patch/actions/runs/36830650075 (3 builds + 12 probe jobs; Windows 1.1.45/1.2.23 failed in the probe's own bun add -g).

Blocked

• git push --delete still fails ("remote end hung up"). A maintainer needs to delete four branches: bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.

Next

1. Global mode, remaining checklist items: a non-writable global dir (root-owned prefix, or a read-only BUN_INSTALL on Windows) must fail loudly; -g with a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
2. Re-test Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 and the bun.cmd case once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.
3. A hosted → vendored takeover on a v1 workspace lock (1.3.14). It must refuse before writes; check --dry-run parity.
4. vex on a vendored project with the isolated linker (stale .bun/ copy → vendored_tree_out_of_sync?).
5. Hosted rollback on macOS and Windows (CRLF lock with core.autocrlf).

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main d984832 (new since run 3: #337 npm bundled-copy VEX fix, #322 Maven docs) and release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for the regression check. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2 from npm @oven/bun-linux-x64, on Linux only. No probe branch this run: the new bug is in lockfile parsing and rewriting, not OS-specific code, and old probe branches still can't be deleted from the sandbox.

Method: a Python mock of the authenticated patch API (batch, by-package, patches/package, view/<uuid>, blob, the hosted tarball, a /registry/ passthrough) plus a local @bh scope registry serving @bh/bund@1.0.0 with bundleDependencies: ["is-number"]. The patch prepends /* SOCKET-PATCHED */ to is-number@7.0.0/index.js. Oracle: a fresh checkout with a cold cache and bun install --frozen-lockfile, marker bytes in every installed copy, and require.resolve from the parent.

Re-triage

• Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: still reproduces on d984832. With BUN_INSTALL_BIN set, scan -g scans 551 packages vs 552 without it, so the Bun global is-number is missed. PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 hasn't landed. No comment.
• With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: still reproduces. Commented with a vendored variant (below).

Cells

• fail Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 (new): Bun bundled: true lock entries ("@bh/bund/is-number": ["is-number@7.0.0", "", {"bundled": true}, …]). Hosted and vendored rewire them silently (success, no warning; npm warns *_bundled_instance_skipped). Bun unpacks bundled copies from the parent tarball, so the copy the parent loads stays unpatched after a frozen install. On text locks with Bun ≥ 1.2 there's also an extra patched hoisted copy that nothing loads. Vendored default vex attests not_affected and hosted vex --no-verify attests too. Hosted default vex → not_applied (ok). Affected: 1.1.45 (text v0 + lockb), 1.2.23, 1.3.14 and 1.4.2 (text + lockb), in both the "bundled only" and "bundled + direct" shapes. Release 4.0.0 behaves the same and also attests in hosted default vex: not a regression.
• pass: hosted → vendored takeover on a v1 workspace lock (1.3.14, hoisted). Refuses with vendor_bun_workspace_unsupported before any write: bun.lock, the package.json files and the file list are unchanged, and the hosted pin is kept. --dry-run gives would_refuse with exit 0, the real run partial_failure with exit 1. That asymmetry is documented (CLI_CONTRACT would_refuse row).
• fail → With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (commented): vendored + isolated linker, stale tree (not reinstalled). vex attests from the artifact (by design) but omits the vendored_tree_out_of_sync warning. Hoisted emits it. 2/2 runs each, Bun 1.4.2. After a frozen reinstall the .bun/ copy is patched and vex is correct. With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405 (comment)

Issues

• Filed Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469: Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469
• Commented on With Bun's isolated linker, vex attests a hosted patch as not_affected (verified) while the installed copy under node_modules/.bun is still unpatched (v5 regression) #405: see above.

False positives ruled out

• Hosted default vex on the bundled shape correctly refuses (not_applied): its installed-tree check sees the bundled copy. Only vendored, and --no-verify, attest.
• Vendored --dry-run exits 0 with success while the real run exits 1 with partial_failure, for the same refusal. That's documented.
• Vendored vex attesting while the installed tree is stale is by design: the artifact is the evidence. Only the missing warning is a bug.

Blocked

• Still can't delete probe branches (no new ones this run). A maintainer needs to delete bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.

Next

1. Global-mode leftovers: a non-writable global dir must fail loudly; a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
2. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 on macOS and Windows (a cheap probe, if branch deletion works again), plus bundled inside a workspace member, and rollback/remove of a rewired bundled entry.
3. Hosted rollback on macOS and Windows (CRLF lock with core.autocrlf).
4. v5 socket.yml policy and per-run limits in a Bun workspace.
5. Re-test Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 and the bun.cmd case once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.

[github-actions[bot]]

[agent] 2026-10-01: Bun bug-hunt run

Tested: main 61cfb9b (new since run 4: #365 npm .store / pnpm virtualStoreDir crawler walks, #446 -g cwd-state fix, gem/pip fixes) and release 4.0.0 (npm @socketsecurity/socket-patch-linux-x64-gnu) for the regression check. Bun 1.1.45, 1.2.23, 1.3.14 and 1.4.2 (1.4.2 is still the latest stable) from npm @oven/bun-linux-x64, on Linux only.

No probe branch this run: git push --delete is still denied in the sandbox, so a new probe branch couldn't be cleaned up.

Method: a Python mock of the patch API (batch, by-package, patches/package, view with blob contents, blob/<hash>, the hosted tarball, and a /registry/ passthrough). Patches prepend /* SOCKET-PATCHED */ to is-number@6.0.0/index.js, is-odd@3.0.1/index.js and @sindresorhus/is@4.6.0/dist/index.js. Gzip the patched tarball with mtime=0: otherwise a mock restart changes its sha512 and every later install fails IntegrityCheckFailed, which is a fixture artifact. Oracle: a fresh checkout, a cold cache, bun install --frozen-lockfile, the marker bytes and require.resolve.

Re-triage

• Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366: still reproduces on 61cfb9b. Fix npm crawler missing relocated dependency stores (#359, #362) #365 added the .store / pnpm virtual-store walks but not .bun. Commented: Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 (comment)
• Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443: BUN_INSTALL_BIN / BUN_INSTALL_GLOBAL_DIR are still unread on main (PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 not landed). No new information, so no comment.

Cells (Linux)

• fail Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 (new): a URL or file: tarball dependency on the patched name@version, beside a nested registry copy of the same version.
  • Hosted and vendored rewire only the registry tuple, with no warning (success, warnings: []).
  • After a frozen install the root copy the app requires is unpatched.
  • Vendored vex (default and --no-verify) attests not_affected, and so does hosted vex --no-verify. Hosted default vex → not_applied (correct).
  • Affected: 1.1.45 v0, 1.2.23 v1, 1.3.14 v1 and 1.4.2 v2 (URL), plus 1.4.2 file: tgz. 2/2 runs on 1.3.14 and 1.4.2.
  • Release 4.0.0 behaves the same, so it isn't a regression. It's the Bun counterpart of npm hosted and vendored modes rewire git-sourced lock entries, so npm ci silently installs the unpatched git bytes while scan and VEX report success #326 (npm-only fix).
  • Controls: URL-only (no registry copy) → vendored vendor_lock_entry_not_found, hosted redirect_bun_entry_not_found. Both correct.
• pass: CRLF bun.lock (Windows autocrlf analog) on 1.1.45 v0, 1.3.14 and 1.4.2. Hosted scan keeps CRLF on every line, the frozen install is patched, and rollback is byte-exact for both bun.lock and the CRLF package.json. Vendored vendor --revert is byte-exact too and removes .socket/.
• pass: bun install --yarn projects (bun.lockb + yarn.lock on 1.1.45; bun.lock + yarn.lock on 1.2.23 and 1.4.2).
  • Hosted rewires both locks, and the frozen install is patched.
  • The lockb variant's rollback refuses with the git checkout -- bun.lockb yarn.lock remedy and touches neither file.
  • (Observation, not filed: on the text-lock variants rollback restores bun.lock byte-exact but rewrites Bun's yarn.lock resolved lines with a #<sha1> fragment Bun didn't write. Semantically equivalent, and it's yarn-classic territory.)
• pass: [install.scopes] custom-registry scope (@sindresorhus/is), 1.3.14 and 1.4.2. Bun records "" as the registry. Hosted rewrite, then rollback, is byte-exact.
• pass: a Bun 1.1.45 binary workspace bun.lockb (root → a → b, two is-number versions).
  • Hosted rewrite, then cold frozen installs with 1.1.45, 1.2.23, 1.3.14 and 1.4.2: only the patched versions are patched.
  • The hosted → vendored takeover refuses redirect_revert_failed (normalized workspace behaviors, documented) and leaves the lock unchanged.
  • vex: not_applied on the stale tree, not_affected after a frozen install.
• pass: hosted pins survive a later bun add left-pad on 1.1.45, 1.2.23, 1.3.14 and 1.4.2, and a cold frozen install is still patched.
• pass (documented): vendored then bun add on 1.1.45 and 1.2.23 drops the local tuples' sha512 (the digest-less re-save). The re-run is already_vendored and re-pins the digest on disk, as the doc says. 1.3.14 and 1.4.2 keep the digest.

Issues

• Filed Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497: Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497
• Commented on Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366.

False positives ruled out

• IntegrityCheckFailed on bun add after a mock restart: the mock's tarball gzip mtime changed. Fixed the fixture (mtime=0) and re-ran: pass.
• The digest-less vendored tuple after bun add on Bun < 1.3.10 is documented, and it's healed by the re-run.
• Hosted default vex on the Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 shape correctly refuses. Only vendored and --no-verify attest.

Blocked

• Probe branches: git push origin --delete is denied in the sandbox, so no new probes. A maintainer still needs to delete bughunt/bun/20260930-default-trust, bughunt/bun/20260930-isolated-bunpatch, bughunt/bun/20261001-vex-isolated and bughunt/bun/20261001-global-dirs.
• GitHub (github:) dependencies can't be resolved by Bun in the sandbox, so the git-tuple variant of Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 is untested.

Next

1. Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 variants: github: tuples (needs a probe runner) and a binary bun.lockb URL dependency. Re-test when fixed.
2. Global-mode leftovers: a non-writable global dir must fail loudly; a symlinked BUN_INSTALL; Windows 1.1.45/1.2.23 with an ASCII temp path.
3. Bun hosted and vendored rewiring rewrites bundled: true lock entries that Bun never fetches: the bundled copy stays unpatched, scan reports success, and vendored vex attests not_affected #469 / Bun hosted and vendored modes skip a URL or file: tarball copy of the patched package without warning, and vendored vex attests not_affected (the #326 fix covers npm locks only) #497 on macOS and Windows, once probe branches can be deleted again.
4. v5 socket.yml policy and per-run limits in a Bun workspace.
5. Re-test Bun isolated linker: transitive packages under node_modules/.bun are "not installed" in agent mode, and scan --mode agent exits 0 with them unpatched #366 when .bun joins the crawler walks, and Global mode misses every Bun global package when BUN_INSTALL_BIN or BUN_INSTALL_GLOBAL_DIR is set: scan -g reports success with nothing found, get -g / vex -g patch and attest nothing #443 once PR Fix global PM probes spawning bare names from the project (#421, #434, #438, #440) #442 lands.