Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

vendor --revert with a lost vendor ledger tells you to "run socket-patch repair to re-adopt them into the ledger", but repair refuses because it never rebuilds the ledger, so the advice loops and the vendored npm packages can't be reverted

オープン 初心者向け
  • 何か問題がありますか？
#1,072 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
75/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
rust
領域
cli

調査の方向性

crates/socket-patch-cli/src/commands/vendor.rsの4071行付近とcrates/socket-patch-cli/src/commands/vendored_backend/repair.rsの184行付近を読み、警告とrepairによる拒否を比較してください。vendorの復元警告に関する既存の関連テストを実行してください。警告が、欠落したledgerを修正できないアクションを推奨しなくなり、その動作がテストでカバーされていれば完了です。

索引モデルが issue の本文から書いたものです。

説明

agent:triaged bug bughunt pm:npm priority:p1

[agent] Found by the scheduled npm bug-hunt routine (ledger #302).

Summary

When .socket/vendor/state.json is lost (deleted, or dropped by a bad merge) while package-lock.json still wires the vendored tarballs, socket-patch vendor --revert keeps the artifacts, which is the correct fail-safe. It then warns vendor_orphan_still_wired with this remedy:

a project lockfile still points at .socket/vendor/npm/, which no ledger entry owns; the artifacts were kept (run socket-patch repair to re-adopt them into the ledger, then revert again)

repair can't do that. It exits 1 with:

Cannot repair vendored artifact … the vendor ledger (.socket/vendor/state.json) has no entry for it, and repair does not rebuild the ledger from lockfiles; restore state.json from version control …

After repair, vendor --revert prints the same warning again ("Reverted 0 vendored packages.", exit 0). Following the advice goes round in a loop, and the project stays vendored.

Impact

Low severity, but it's a dead end for a user who doesn't have state.json in version control. The fail-safe parts all hold: in every step below, a cold-cache npm ci still installs patched bytes, and no artifact is deleted. Only the remedy is wrong. It contradicts CLI_CONTRACT.md (repair: "redownload missing/corrupt vendored artifacts (never re-synthesizing a lost ledger)"). It's in the same family as #900 and #977 (a suggested remedy that is a no-op).

Repro (Linux, npm 10.9.4, local mock of the patch API serving free patches for [email protected] and [email protected])

mkdir p && cd p
echo '{"name":"p","version":"1.0.0","dependencies":{"left-pad":"1.3.0","ms":"2.1.3"}}' > package.json
npm install
socket-patch scan --mode vendored --yes $API      # exit 0, both vendored
rm .socket/vendor/state.json                         # ledger lost
socket-patch vendor --revert --yes $API
#  Warning: … which no ledger entry owns; the artifacts were kept (run `socket-patch repair` to re-adopt them into the ledger, then revert again)
#  Reverted 0 vendored packages.        exit 0
socket-patch repair --yes $API
#  Error: Cannot repair vendored artifact … repair does not rebuild the ledger from lockfiles …   exit 1
socket-patch vendor --revert --yes $API             # same warning again, exit 0

Expected vs actual

  • Expected: a remedy that works here. Either the one repair, rollback and scan --prune already give ("restore .socket/vendor/state.json from version control, or restore the lockfile with git checkout -- <lockfile>"), or a repair that actually re-adopts the entry, as the warning promises.
  • Actual: the warning points at repair, which by contract and by its own message refuses this exact state.

Every other command reports this state consistently (main 05ecc6e, run twice):

command exit message
vendor --revert 0 vendor_orphan_still_wired → "run socket-patch repair to re-adopt" (wrong)
repair 1 "repair does not rebuild the ledger … restore state.json"
rollback 1 "restore .socket/vendor/state.json from version control …"
scan --mode vendored --prune 1 "restore .socket/vendor/state.json from version control"
vendor --check 1 vendor_ledger_missing … "restore state.json"

OS × version

OS npm result
Linux 10.9.4 (Node 22.22) fail (x2)

macOS and Windows weren't probed. The message is built in shared CLI code, so it isn't OS-dependent, and probably not npm-specific either (sweep_orphan_vendor_dirs is ecosystem-generic). Not bisected.

Suspect code

  • crates/socket-patch-cli/src/commands/vendor.rs:4071 (the vendor_orphan_still_wired text) vs crates/socket-patch-cli/src/commands/vendored_backend/repair.rs:184 (repair's refusal).
主要言語
Rust
スター
8
フォーク
0
平均マージ
1日 1時間
マージ済み PR（30日）
257

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

SocketDev/socket-patch のほかの issue

SocketDev/socket-patch の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。