All issues

Search results

Vendored Maven jar rebuild is not byte-reproducible across OSes (Windows differs)

Status: Open.

#275 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Same-GAV Maven patches are shadowed when a build plugin depends on the same GAV in a reactor build

Status: Open.

#274 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Maven pom edits insert LF lines into CRLF pom.xml files (hosted and vendored)

Status: Open.

#273 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Vendored Maven payload is written under the lowercased GAV, so mixed-case artifacts silently fall through to Central on case-sensitive file systems

Status: Open.

#272 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Hosted Maven redirects cannot be reverted, and remove recommends an unscoped rollback that also fails

Status: Open.

#271 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Maven CI matrix has no Windows leg, a stale 4.0 RC, and no legs at the resolver boundaries

Status: Open.

#267 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Hosted Maven never re-pins: a superseding patch uuid or a rotated grant token leaves the old wiring in place

Status: Open.

#266 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Maven hosted scan pins, and VEX attests, artifacts the project doesn't depend on (the crawler lists all of ~/.m2)

Status: Open.

#265 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Agent-mode apply can't apply Maven patch records keyed by jar member paths, although vendor accepts the same record

Status: Open.

#264 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Vendored Maven silently resolves the unpatched jar when an earlier <repository> or a mirrorOf * mirror serves the same GAV, and VEX still attests

Status: Open.

#263 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Hosted Maven rewriter ignores <classifier> and suffixes sources/tests/native classifier dependencies, which breaks the build

Status: Open.

#262 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026

Hosted Maven mode edits only the root pom of a multi-module build, leaves child literals unpatched, and still attests VEX

Status: Open.

#261 In SocketDev/socket-patch;

· Mikola Lysenko (mikolalysenko) opened on Sep 26, 2026