@socketsecurity/socket-patch

Socket Patch CLI

Fix known vulnerabilities in the dependencies you already have — without waiting for an upstream release, and without a risky version bump.

Socket's security team backports minimal fixes to the exact versions of packages you have installed. The socket-patch CLI finds which of your dependencies have a patch available and applies it, verifying every changed file by hash. It works across npm, PyPI, Cargo, Go, RubyGems, Maven, Composer, NuGet, and Deno, and it can persist the patches whichever way fits your workflow: re-applied by the CLI, committed to your repo, or pinned in your lockfile. When you're done, it can emit an OpenVEX attestation so your vulnerability scanner stops flagging the CVEs you've already fixed.

Contents: Installation · Five-minute tutorial · How it works · Common tasks · Command reference · OpenVEX · Scripting & CI/CD · Manifest format · Ecosystem support →

Installation

One-line install (macOS / Linux):

curl -fsSL https://raw.githubusercontent.com/SocketDev/socket-patch/main/scripts/install.sh | sh

Detects your platform (macOS/Linux, x64/ARM64), downloads the latest binary, and installs to /usr/local/bin or ~/.local/bin. Use sudo sh instead of sh if /usr/local/bin requires root.

On Windows, install via npm (below) or grab a prebuilt socket-patch--pc-windows-msvc.zip from the latest release.

Or install through your package manager:

| Package manager | Command | |-----------------|---------| | npm | npm install -g @socketsecurity/socket-patch (or one-shot: npx @socketsecurity/socket-patch) | | pip | pip install socket-patch | | cargo | cargo install socket-patch-cli (builds from source with every ecosystem compiled in) | | gem | gem install socket-patch | | composer | composer require socketsecurity/socket-patch (run as vendor/bin/socket-patch) |

The gem and composer packages are thin launchers: on first run they download the prebuilt binary for your platform from the matching GitHub release, verify its SHA-256, cache it, and exec it. Set SOCKETPATCHBIN to an existing binary to skip the download.

<details <summaryManual download</summary

Download a prebuilt binary from the latest release:

# macOS (Apple Silicon)
curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-aarch64-apple-darwin.tar.gz | tar xz

# macOS (Intel)
curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-x86_64-apple-darwin.tar.gz | tar xz

# Linux (x86_64)
curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-x86_64-unknown-linux-musl.tar.gz | tar xz

# Linux (ARM64)
curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-aarch64-unknown-linux-musl.tar.gz | tar xz

The musl builds are fully static and run on any distro; glibc (-gnu) variants are also on the releases page, alongside Windows (socket-patch-x8664-pc-windows-msvc.zip) and other targets.

Then move the binary onto your PATH:

sudo mv socket-patch /usr/local/bin/