Socket Certified Patches
Delete your CVEs
Socket Certified Patches surgically removes CVEs from your dependencies—no version updates, no supply chain surprises. Patches live in your repo, not our servers.
Why Socket Certified Patches?
A direct path to zero exploitable risk
Reachability tells you what needs fixing. Certified Patches fix it instantly with surgical, validated changes committed into your repo.
One command, done
Run a single CLI command after install, or let safe-npm/safe-pnpm apply patches automatically. No manifest file changes, no weird plugins.
Human-reviewed, AI-validated
Every patch is reviewed by domain experts (like TC39 delegates for npm) and validated against hundreds of AI-generated test cases to guarantee it won't break your build.
Audit everything
Patches are plain text and human-readable. Review exactly what's changing before you apply it.
How it works
Socket Certified Patches integrates seamlessly into your existing workflow, providing surgical CVE fixes with minimal overhead.
Identify vulnerable packages
Socket's Reachability Analysis identifies which CVEs are actually exploitable in your codebase.
Apply certified patches
Run a single command to apply human-reviewed, AI-validated patches that surgically fix the vulnerabilities.
Commit and deploy
Patches are stored in your repo as plain text. Review, commit, and deploy with confidence.
Powerful Features
Built for security teams and developers
Socket Certified Patches gives you the control and transparency you need to secure your dependencies without disrupting your workflow.
Own your patches forever
Patches get committed alongside your code. Keep them forever, even if you cancel Socket or we disappear. Zero vendor lock-in.
Update dependencies on your schedule
Stop being forced into risky upgrades just to fix a CVE in a transitive dependency. Patch it now, update when you're ready.
Protect legacy systems
Patch even unmaintained or abandoned packages where no upstream fix will ever be published.
Reduce operational risk
Keep your current dependency graph stable, with no version churn or unexpected regressions from 'just update it' workflows.
Stops malicious updates cold
Because patches apply in place, you avoid compromised upstream releases entirely.
No special infrastructure
Patches run locally during your build—no registry proxies, mirrors, or external services required.
Free patches for critical CVEs
No Socket subscription required to patch the most dangerous npm vulnerabilities. Premium patches available for comprehensive coverage.
We help security teams work more efficiently
Cut through the noise and focus on real threats.
Get actionable alerts for the supply chain risks that matter. Socket highlights risky dependencies directly within the developer workflow.