{"repo":"NousResearch/hermes-agent","public_id":"40126","display_label":"Minimum dependency age rules for supply-chain hardening","summary":"These items discuss adding a minimum publication-age requirement for dependencies before they can be adopted, as a defense against supply-chain attacks. The proposals reference similar features in tools like PNPM and suggest enforcement via cooldown periods or allow-lists.","subsystem":"hermes_cli","counts":{"members":4,"open_issues":2,"open_issues_distinct":2,"open_prs":1,"closed_issues":0,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":75037},"resolution":{"state":"partially_resolved","by":"pr-75037"},"freshness":{"state":"verified","last_verified_at":"2026-07-31T18:07:33+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.3933333333333333},"fix_edges":[{"issue_number":43997,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":50901,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":68736,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":72108,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":73426,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":40126,"title":"[Feature]: Could Hermes Agent support a \"minimum release age\" option similar to PNPM?","url":null,"state":"open"},{"kind":"issue","number":50901,"title":"Harden against supply-chain attacks: 3-day dependency cooldown","url":null,"state":"open"},{"kind":"pr","number":50902,"title":"Harden against supply-chain attacks: 3-day dependency cooldown","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"dce2b0dfa","number":0},{"kind":"commit","value":"d8d57fb2f","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":75037,"title":"fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".npmrc","apps/bootstrap-installer/package.json","apps/desktop/package.json","apps/desktop/src/app/artifacts/index.tsx","apps/desktop/src/app/chat/composer/hooks/use-composer-draft.test.tsx","apps/desktop/src/app/chat/composer/hooks/use-composer-draft.ts","apps/desktop/src/app/chat/composer/status-stack/goal-indicator.test.tsx","apps/desktop/src/app/chat/composer/status-stack/index.tsx","apps/desktop/src/app/chat/index.tsx","apps/desktop/src/app/chat/sidebar/index.tsx","apps/desktop/src/app/chat/sidebar/profile-switcher.tsx","apps/desktop/src/app/command-palette/index.tsx","apps/desktop/src/app/contrib/surfaces.tsx","apps/desktop/src/app/contrib/wiring.tsx","apps/desktop/src/app/hooks/use-keybinds.ts","apps/desktop/src/app/hooks/use-route-enum-param.ts","apps/desktop/src/app/hooks/use-route-overlay-active.ts","apps/desktop/src/app/messaging/index.test.tsx","apps/desktop/src/app/pet-generate/pet-generate-content.tsx","apps/desktop/src/app/session-switcher.tsx","apps/desktop/src/app/session/hooks/use-session-actions/index.ts","apps/desktop/src/app/settings/billing/index.test.tsx","apps/desktop/src/app/settings/config-settings.tsx","apps/desktop/src/app/settings/index.tsx","apps/desktop/src/app/settings/model-settings.test.tsx","apps/desktop/src/app/settings/toolset-config-panel.test.tsx","apps/desktop/src/app/settings/toolset-config-panel.tsx","apps/desktop/src/app/settings/use-deep-link-highlight.ts","apps/desktop/src/app/shell/approval-mode-menu.test.tsx","apps/desktop/src/app/shell/hooks/use-overlay-routing.ts","apps/desktop/src/app/shell/statusbar-controls.tsx","apps/desktop/src/app/shell/statusbar-visibility.test.tsx","apps/desktop/src/app/shell/titlebar-controls.tsx","apps/desktop/src/app/skills/index.test.tsx","apps/desktop/src/app/skills/index.tsx","apps/desktop/src/components/assistant-ui/thread/assistant-message.tsx","apps/desktop/src/components/assistant-ui/thread/use-message-reactions.ts","apps/desktop/src/components/assistant-ui/thread/user-edit-composer.tsx","apps/desktop/src/components/find-bar.test.tsx","apps/desktop/src/components/find-bar.tsx","apps/desktop/src/main.tsx","apps/shared/package.json","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","eslint.config.shared.mjs","hermes_cli/main.py","hermes_cli/npm_engine.py","nix/hermes-agent.nix","package.json","pyproject.toml","tests-js/package.json","tests/hermes_cli/test_npm_engine.py","tests/tools/test_computer_use.py","tools/lazy_deps.py","ui-tui/package.json","ui-tui/packages/hermes-ink/package.json","web/package.json","web/src/App.tsx","web/src/components/ChatSessionList.tsx","web/src/components/SidebarStatusStrip.tsx","web/src/contexts/PageHeaderProvider.tsx","web/src/contexts/ProfileProvider.tsx","web/src/main.tsx","web/src/pages/ChatPage.tsx","web/src/pages/PluginsPage.tsx","web/src/pages/ProfileBuilderPage.tsx","web/src/pages/ProfilesPage.tsx","web/src/pages/SessionsPage.tsx","web/src/pages/SkillsPage.tsx","web/src/pages/SystemPage.tsx","web/vite.config.ts","website/.npmrc","website/package.json"]}],"trust":{"default_tier":"verified","includes_suggested":false}}