Hi! This PR upgrades the agent canvas to use a new version of extensions, and the reviewer flagged it as supply chain risk. I’d appreciate a maintainer review! https://github.com/OpenHands/agent-canvas/pull/1451