Fix remediation setup for pnpm and Python lockfiles

.github/workflows/vuln-remediation.yml

@@ -254,6 +254,42 @@ jobs:
         if: steps.check.outputs.skip != 'true' && inputs.setup-bun
         run: bun install
 
+      - name: Setup pnpm for Socket fixes
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          PNPM_VERSION=$(python3 - <<'PY'
+          import json
+          from pathlib import Path
+
+          ignored = {"node_modules", ".git"}
+          for package_json in Path(".").rglob("package.json"):
+              if any(part in ignored for part in package_json.parts):
+                  continue
+              try:
+                  package_manager = json.loads(package_json.read_text()).get("packageManager", "")
+              except Exception:
+                  package_manager = ""
+              if package_manager.startswith("pnpm@"):
+                  print(package_manager.removeprefix("pnpm@"))
+                  break
+              if (package_json.parent / "pnpm-lock.yaml").exists():
+                  print("latest")
+                  break
+          else:
+              for lockfile in Path(".").rglob("pnpm-lock.yaml"):
+                  if not any(part in ignored for part in lockfile.parts):
+                      print("latest")
+                      break
+              else:
+                  print("")
+          PY
+          )
+          if [ -n "$PNPM_VERSION" ]; then
+            npm install -g "pnpm@${PNPM_VERSION}"
+          else
+            echo "No pnpm workspace detected."
+          fi
+
       - name: Setup Python
         if: steps.check.outputs.skip != 'true' && inputs.setup-python
         uses: actions/setup-python@v5

scripts/test_vuln_remediation.py

@@ -238,6 +238,19 @@ def test_accepts_clean_socket_planned_dependency_change(self) -> None:
 
         self.assertTrue(result.ok, result.errors)
 
+    def test_accepts_python_requirements_lockfiles(self) -> None:
+        write(self.root / "pyproject.toml", "[project]\ndependencies = ['aiohttp==3.13.3']\n")
+        write(self.root / "requirements.lock", "aiohttp==3.13.3\n")
+        write(self.root / "requirements-dev.lock", "aiohttp==3.13.3\n")
+        self.commit_all()
+        write(self.root / "pyproject.toml", "[project]\ndependencies = ['aiohttp==3.13.4']\n")
+        write(self.root / "requirements.lock", "aiohttp==3.13.4\n")
+        write(self.root / "requirements-dev.lock", "aiohttp==3.13.4\n")
+
+        result = vr.validate_diff(self.root, ["pyproject.toml", "requirements.lock", "requirements-dev.lock"])
+
+        self.assertTrue(result.ok, result.errors)
+
 
 class ConfirmationTests(RemediationFixture):
     def test_confirmation_fails_when_old_vulnerable_version_remains(self) -> None:

scripts/vuln_remediation.py

@@ -49,7 +49,7 @@
     "Pipfile.lock",
 }
 
-REQUIREMENTS_RE = re.compile(r"(^|/)requirements[^/]*\.txt$")
+REQUIREMENTS_RE = re.compile(r"(^|/)requirements[^/]*\.(?:txt|lock)$")
 MAX_ALLOWED_FILE_SIZE = 5 * 1024 * 1024