SocketDev
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 8 additions & 1 deletion b/‎.github/workflows/ci.yml‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎CHANGELOG.md‎
Lines changed: 53 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 53 additions & 0 deletions
diff --git a/‎Cargo.lock‎
Lines changed: 53 additions & 0 deletions b/‎Cargo.lock‎
Lines changed: 53 additions & 0 deletions
diff --git a/‎Cargo.toml‎
Lines changed: 2 additions & 0 deletions b/‎Cargo.toml‎
Lines changed: 2 additions & 0 deletions
@@ -326,10 +326,17 @@ jobs:
 
       - name: Run ${{ matrix.ecosystem }} Docker e2e test with coverage
         run: |
+          # Vendor build-proof capstones ride the same image as their
+          # ecosystem's main suite (extend the case as new vendor suites land).
+          EXTRA=""
+          case "${{ matrix.ecosystem }}" in
+            composer) EXTRA="--test docker_e2e_vendor_composer" ;;
+            gem)      EXTRA="--test docker_e2e_vendor_gem" ;;
+          esac
           cargo llvm-cov \
             --features docker-e2e,cargo,golang,maven,composer,nuget,deno \
             --no-report \
-            --test docker_e2e_${{ matrix.ecosystem }}
+            --test docker_e2e_${{ matrix.ecosystem }} $EXTRA
 
       - name: Generate per-ecosystem lcov
         run: |
 
@@ -16,6 +16,50 @@ in this file — see `.github/workflows/release.yml` (`version` job).
 
 ### Added
 
+- **`vendor` now supports every major npm and pypi package manager.** The npm
+  ecosystem gained four lockfile flavors beyond `package-lock.json` — yarn
+  classic (`yarn.lock` v1), yarn berry with the node-modules linker
+  (`resolutions` + a cache-zip `10c0` checksum reproduced offline from the
+  vendored tarball), pnpm (`pnpm.overrides` + `pnpm-lock.yaml` surgery, pnpm 9
+  & 10), and bun (`bun.lock`) — all sharing the one vendored tarball and
+  selected by a content-sniffing probe (yarn-berry PnP and bun's binary
+  `bun.lockb` are refused with pointers to the native flow). The pypi
+  ecosystem gained poetry, pdm, and pipenv (lock-only `[[package]]` / entry
+  splices, like the existing uv/requirements flavors). Every lockfile
+  checksum/reference field for a vendored package is now recomputed
+  coherently (the v2 "update checksums and references" directive); the gem
+  backend handles bundler ≥ 2.6's optional `CHECKSUMS` section; composer's
+  `dist.reference` carries the patch UUID into `installed.json`. Each flavor
+  has a real-package-manager build-proof capstone (fresh-checkout, cold-cache,
+  strictest-install — `--frozen`/`--immutable`/`--deploy`/`--locked` — with
+  byte-identical revert). `vendor --force`/`--revert` accept empty env vars
+  (`SOCKET_FORCE=`) as false, matching the global-flag contract.
+
+- **New `vendor` subcommand: committable vendoring of patched dependencies.**
+  Where `apply` patches installed packages in place (machine-local state),
+  `socket-patch vendor` ejects each patched package into a committed
+  `.socket/vendor/<ecosystem>/<patch-uuid>/<artifact>` and rewires the
+  ecosystem's lockfile so the project consumes the vendored copy — after
+  committing, a fresh checkout builds with the patched dependency on machines
+  with no socket-patch installed and no Socket API access. Per ecosystem
+  (each mechanism validated against the real package manager): npm rewrites
+  `package-lock.json` only (deterministic patched tarball, recomputed
+  integrity, `npm ci`-verified); cargo writes a `[patch.crates-io]` entry in
+  `.cargo/config.toml` plus surgical Cargo.lock edits so `cargo build
+  --locked --offline` works; golang reuses the `replace`-directive engine
+  pointed at the vendor tree; composer rewrites the lock entry to a
+  `dist: path` copy; gem edits the Gemfile + Gemfile.lock pair in bundler's
+  canonical form; pypi rebuilds a valid wheel (regenerated RECORD) wired
+  through uv's `pyproject.toml`/`uv.lock` pair (uv-first) or
+  requirements.txt (`pip` / `uv pip`). The patch UUID is recoverable from the
+  lockfile path string alone (a documented convention for external tools), a
+  committed `.socket/vendor/state.json` ledger records the verbatim original
+  lockfile fragments, and `vendor --revert` restores them byte-exactly.
+  `vendor --vex` mirrors `apply --vex`; VEX generation attests vendored
+  patches by hashing the committed artifacts, and `apply` yields ownership of
+  vendored packages (`vendored` skip reason).
+
+
 - **Cargo support (`cargo` is now a default feature).** `apply` patches a Rust
   dependency **in place** wherever the crawler finds it — the project `vendor/`
   directory or the shared `$CARGO_HOME` registry cache — rewriting the crate's
@@ -59,6 +103,15 @@ in this file — see `.github/workflows/release.yml` (`version` job).
   individually, so one exotic package can't fail a whole scan). Rate limits
   and over-capacity 503s still surface instead of silently degrading. (MINOR)
 
+### Fixed
+
+- **VEX now attests Go `replace`-redirect patches.** `socket-patch vex`
+  previously verified golang patches against the pristine module cache
+  instead of the patched `.socket/go-patches/` copy, so redirect-applied
+  patches were silently omitted from the document (reported `not_applied`,
+  or `package_not_found` on cache-less CI). Verification now follows the
+  managed `replace` directive to the committed copy.
+
 ## [3.2.0] — 2026-05-29
 
 A repo-wide correctness, security, and filesystem-safety hardening pass: every
 
@@ -17,6 +17,7 @@ clap = { version = "=4.5.60", features = ["derive", "env"] }
 serde = { version = "=1.0.228", features = ["derive"] }
 serde_json = { version = "=1.0.149", features = ["preserve_order"] }
 sha2 = "=0.10.9"
+sha1 = "=0.10.6"
 hex = "=0.4.3"
 reqwest = { version = "=0.12.28", features = ["rustls-tls", "json"], default-features = false }
 tokio = { version = "=1.50.0", features = ["full"] }
@@ -32,6 +33,7 @@ once_cell = "=1.21.3"
 qbsdiff = "=1.4.4"
 tar = "=0.4.46"
 flate2 = "=1.1.9"
+zip = { version = "=8.6.0", default-features = false, features = ["deflate"] }
 fs2 = "=0.4.3"
 wiremock = "=0.6.5"
 portable-pty = "=0.9.0"