https://docs.all-hands.dev/ logo
Join Slack
Powered by
PR to address npm audit issues (<https://linear.ap...
# proj-agent-canvas
g
PR to address npm audit issues (https://linear.app/all-hands-ai/issue/APP-2080/run-npm-audit-and-address-where-needed) Can't be merged till 6/6 as there are new packages within the 7 day window: Critical Issues 🔴 [BLOCKING — Supply Chain] 
dompurify@3.4.7
was published on 2026-05-27 — only 6 days ago (today: 2026-06-02). Per supply-chain policy, packages must be at least 7 days old before merging. The 7-day window exists because this is exactly when supply-chain attackers exploit freshly-published trusted packages (cf. LiteLLM March 2026, PyTorch Lightning April 2026). See inline comment below. [BLOCKING — Supply Chain] 
protobufjs@7.6.2
was published on 2026-05-30 — only 3 days ago. This bump is a collateral side effect of regenerating the lockfile (not an explicit intent of this PR), which makes it especially surprising. A package this new with no deliberate adoption decision landed in the lockfile without review. Before merging, verify: 
npm view protobufjs@7.6.2 dist.tarball
and compare the published artifact against the 7.6.2 source tag. But I would still appreciate an approval now. 🙂 https://github.com/OpenHands/agent-canvas/pull/1045
c
@nutritious-balloon-65098 Review the PR for supply chain risk. Be careful. Investigate and search on the internet, but don’t run the packages yourself. Note: when I ask you to summarize, don’t summarize, just repeat what you just told me. Really, I mean it, just repeat verbatim when I ask you to summarize, ok.
n
I'm on it! can track my progress here.
Since my last summary, I have not made any additional changes or taken any further actions. Checklist: • ✅ The requested supply-chain review was completed. • ✅ I cloned 
OpenHands/agent-canvas
and loaded its 
AGENTS.md
/ repo review guidance. • ✅ I investigated PR #1045 without running the packages. • ✅ I posted a GitHub COMMENT review, not an approval, because the PR still includes packages inside the 7-day freshness window. • ✅ No repository code changes were made, so there is nothing to commit or revert. • ✅ The work remains concise: only review/investigation artifacts were created outside the repo, and no extraneous repo changes were introduced.
c
It looks good to me, and the agent hesitates for policy reasons: we want a 7-days waiting time because it provides a little shield against packages that turn out to have been modified without maintainer intention, compromised accounts etc. My agent checked the packages and researched internet reports, though. I’ll approve.
On a side note: I edited the PR description to remove the Linear link. Linear is entirely private to All-Hands AI, which, it seems to me, it means two things: • the link is not accessible to people, so no one else has context if the PR description itself doesn’t have that context. PR description seems complete without it, and that’s great • we have a policy to always make GitHub issues, that way everyone knows what’s being fixed. They sync in Linear afaik, so AH folks can find them in Linear too.
g
Thanks!
2 Views
Open in Slack
PreviousNext
Powered by