# NousResearch/hermes-agent · Minimum dependency age rules for supply-chain hardening

## Open now

- 2 issues, 1 PR open on GitHub.
- #40126: \[Feature\]: Could Hermes Agent support a "minimum release age" option similar to PNPM?
- #50901: Harden against supply-chain attacks: 3-day dependency cooldown
- PR #50902: Harden against supply-chain attacks: 3-day dependency cooldown

These items discuss adding a minimum publication-age requirement for dependencies before they can be adopted, as a defense against supply-chain attacks. The proposals reference similar features in tools like PNPM and suggest enforcement via cooldown periods or allow-lists.

## TL;DR

- 4 member(s): 2 open issue(s), 0 closed issue(s), 1 open PR(s), 1 merged PR(s), 0 PR(s) closed without merging.
- A fix was merged to main in PR #75037. Verify it addresses your case.
- **Recommended:** read PR #75037 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `partially_resolved` · deciding PR(s): `pr-75037`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.39`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #40126: \[Feature\]: Could Hermes Agent support a "minimum release age" option similar to PNPM?
- #50901: Harden against supply-chain attacks: 3-day dependency cooldown

## Prior & competing PRs

- **#75037: fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `.npmrc`, `apps/bootstrap-installer/package.json`, `apps/desktop/package.json`, `apps/desktop/src/app/artifacts/index.tsx`, `apps/desktop/src/app/chat/composer/hooks/use-composer-draft.test.tsx`, `apps/desktop/src/app/chat/composer/hooks/use-composer-draft.ts`, `apps/desktop/src/app/chat/composer/status-stack/goal-indicator.test.tsx`, `apps/desktop/src/app/chat/composer/status-stack/index.tsx`, `apps/desktop/src/app/chat/index.tsx`, `apps/desktop/src/app/chat/sidebar/index.tsx`, `apps/desktop/src/app/chat/sidebar/profile-switcher.tsx`, `apps/desktop/src/app/command-palette/index.tsx`, `apps/desktop/src/app/contrib/surfaces.tsx`, `apps/desktop/src/app/contrib/wiring.tsx`, `apps/desktop/src/app/hooks/use-keybinds.ts`, `apps/desktop/src/app/hooks/use-route-enum-param.ts`, `apps/desktop/src/app/hooks/use-route-overlay-active.ts`, `apps/desktop/src/app/messaging/index.test.tsx`, `apps/desktop/src/app/pet-generate/pet-generate-content.tsx`, `apps/desktop/src/app/session-switcher.tsx` (+60 more)
- **#50902: Harden against supply-chain attacks: 3-day dependency cooldown**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `dce2b0dfa`, `d8d57fb2f`
  - files: `.npmrc`, `apps/bootstrap-installer/.npmrc`, `apps/bootstrap-installer/package.json`, `apps/desktop/.npmrc`, `apps/desktop/package.json`, `apps/shared/.npmrc`, `apps/shared/package.json`, `package.json`, `plugins/platforms/photon/sidecar/.npmrc`, `plugins/platforms/photon/sidecar/package.json`, `pyproject.toml`, `scripts/whatsapp-bridge/.npmrc`, `scripts/whatsapp-bridge/package.json`, `ui-tui/.npmrc`, `ui-tui/package.json`, `ui-tui/packages/hermes-ink/.npmrc`, `ui-tui/packages/hermes-ink/package.json`, `web/.npmrc`, `web/package.json`, `website/.npmrc` (+1 more)

## Fix status

- Merged to main in PR #75037 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-07-31`.
- Subsystem: `hermes_cli`