# NousResearch/hermes-agent · npm install-script allowlist and security patches

## Open now

- 1 issue, 1 PR open on GitHub.
- #43997: npm 11 allowScripts warnings during Hermes update
- PR #48816: fix(update): approve npm install scripts used by update

These items address npm 11 warnings about unapproved install scripts by adding or updating an allowScripts configuration, alongside related dependency security patching and publication-age constraints.

## TL;DR

- 4 member(s): 1 open issue(s), 0 closed issue(s), 1 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #75037. Verify it addresses your case.
- **Recommended:** read PR #75037 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-75037`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.50`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #43997: npm 11 allowScripts warnings during Hermes update

## Prior & competing PRs

- **#75037: fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`
  - files: `.npmrc`, `apps/bootstrap-installer/package.json`, `apps/desktop/package.json`, `apps/desktop/src/app/artifacts/index.tsx`, `apps/desktop/src/app/chat/composer/hooks/use-composer-draft.test.tsx`, `apps/desktop/src/app/chat/composer/hooks/use-composer-draft.ts`, `apps/desktop/src/app/chat/composer/status-stack/goal-indicator.test.tsx`, `apps/desktop/src/app/chat/composer/status-stack/index.tsx`, `apps/desktop/src/app/chat/index.tsx`, `apps/desktop/src/app/chat/sidebar/index.tsx`, `apps/desktop/src/app/chat/sidebar/profile-switcher.tsx`, `apps/desktop/src/app/command-palette/index.tsx`, `apps/desktop/src/app/contrib/surfaces.tsx`, `apps/desktop/src/app/contrib/wiring.tsx`, `apps/desktop/src/app/hooks/use-keybinds.ts`, `apps/desktop/src/app/hooks/use-route-enum-param.ts`, `apps/desktop/src/app/hooks/use-route-overlay-active.ts`, `apps/desktop/src/app/messaging/index.test.tsx`, `apps/desktop/src/app/pet-generate/pet-generate-content.tsx`, `apps/desktop/src/app/session-switcher.tsx` (+60 more)
- **#44017: fix(npm): add allowScripts to suppress npm 11 install-script warnings**. closed without merge
  - maintainer direction: category `uncategorized`; implication `needs_llm`
- **#48816: fix(update): approve npm install scripts used by update**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `#51471`
  - files: `package.json`

## Fix status

- Merged to main in PR #75037 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-07-31`.
- Subsystem: `hermes_cli`