Add npm dependency cooldown - #914
Conversation
Delay npm package resolution for seven days, including transitive dependencies of the pinned Steady CLI invocation.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Castiron custom code✅ No new custom-code files detected. 61 mixed files remain; 0 existing customizations changed. Compared 61 existing customizations unchanged
21 more in the full report. A changed generated baseline means this report cannot reliably identify which handwritten lines changed. Inspect the custom-code diffDownload the exact patch produced by this run (requires repository access): gh run download 32389033138 --repo openai/openai-java \
--name castiron-custom-code-32389033138-1 --dir /tmp/castiron-custom-code-32389033138-1
git apply --stat /tmp/castiron-custom-code-32389033138-1/custom-code.patch
cat /tmp/castiron-custom-code-32389033138-1/custom-code.patchOr reproduce it from an SDK checkout containing the vendored reporter: git fetch --no-tags origin 4615e4e53f50f3106ded091c97f9f51b7457116d 931135d071ccaef71f8100e222d9430bd973d985
python3 scripts/castiron/custom_code_report.py report \
--base 4615e4e53f50f3106ded091c97f9f51b7457116d \
--head 931135d071ccaef71f8100e222d9430bd973d985 --fetch --require-head-hash --public \
--out /tmp/castiron-custom-code-931135d071cc
cat /tmp/castiron-custom-code-931135d071cc/custom-code.patchThis is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 931135d071
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1 @@ | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
Whenever scripts/mock invokes npm exec, npm ignores this setting: with npm 11.4.2, npm config ls -l emits Unknown project config "min-release-age", and the npm v11 configuration reference documents no such option (its related before option accepts a fixed date). Consequently, the pinned Steady CLI's transitive dependencies are still resolved without the intended seven-day gate, so this change provides none of the stated supply-chain protection.
AGENTS.md reference: AGENTS.md:L24-L26
Useful? React with 👍 / 👎.
1 participant
Minor, just aligns any local dev flows with Dependabot's cooldown.
Delay npm package resolution for seven days, including transitive dependencies of the pinned Steady CLI invocation.