feat(openenv): serve every bundle task as an OpenEnv env

[earakely-scale]

Summary

Every task in a bundle is now an OpenEnv env. agent_env.openenv.build_app(bundle) returns the OpenEnv server for a bundle's tasks. Any OpenEnv client (OpenEnv's own GenericEnvClient and MCPToolClient, verifiers, a TRL wrapper) resets an episode, acts through the env's MCP tools and gets the task's verifier score as its reward, with no per-task code.

from agent_env.openenv import build_app

app = build_app("portsim")  # a folder or an installed bundle, or {"train": "dock-v1-train/", "eval": "dock-v1-eval/"}

openenv>=0.8,<0.10 becomes a hard dependency, the way mcp and a2a-sdk are. That range is OpenEnv's two-minor deprecation window. Only agent_env/openenv/ imports it, so no other command pays the cost of loading it.

Two fixes outside openenv/ came out of testing on PortSim's packs:

• Materializing a large bundle no longer crashes. On main, agent-env run crashes with EMFILE on a bundle of more than about 1,000 entries (Linux) or 250 (macOS), such as PortSim's generated 1,050-task pack.
• The explorer extra is retired. OpenEnv's fastapi makes it install nothing core lacks.

How a task maps onto OpenEnv

OpenEnv	AgentEnv
Task API (/splits, /tasks, /task)	The bundle's tasks: all, then a split per eval, or a mapping's keys. Each task listing carries {id, name, index, prompt, system_prompt, agent}, read without deploying.
reset(split, index)	Starts an episode (EpisodeSpec) and returns once its first turn is open (deploy and setup done). The observation carries the prompt and system prompt. With neither argument, it plays the first task served, as OpenEnv's ORS and verifiers importers do.
step(ListToolsAction / CallToolAction)	The turn's MCP tools, called as the agent's role. A result has MCP's own shape, as MCPEnvironment's does.
end_turn(response) (an added tool)	Hands the reply back: either the next turn's prompt, or, after the last turn, the reward with done=True and every score in metadata["scores"].
One session	One episode, which is one deployment. SUPPORTS_CONCURRENT_SESSIONS, and max_concurrent_envs (default 8) caps them.

The choices follow OpenEnv's own envs:

• Reset waits for the deploy, as jupyter_env and terminus_env create their sandbox in reset.
• A reset on a live session abandons the previous episode and waits for its teardown, and so does close().
• Calls on one session take turns. OpenEnv's HTTP MCP sessions and its web playground can call one env concurrently, so a step waits for a reset or end_turn in flight.
• Failures:
  • A failure that ends an episode is an observation: done, no reward, and metadata["status"] == "error", as terminus_env reports a sandbox that can't start.
  • A failed tool call is a ToolError, and the episode goes on.
  • A call cancelled while reset or end_turn waited for the turn to open ends the episode at the next step, in the same error shape.
• Tools named reset, step, state, close or end_turn are refused, as MCPEnvironment refuses them.
• Reward: a task that records one score has it as its reward. Several scores need reward=<step id> or a function of the scores, checked over every task at startup.
• Startup prepares each bundle exactly as agent-env run does before its first task, except that the agent the client plays is never deployed, so it needn't exist.
• Namespace routing is on from each startup of the app to its shutdown, so @local ids resolve while it serves.
• Shutdown: the app's shutdown closes every open session and waits. OpenEnv's own shutdown doesn't, so without this, local Docker containers would outlive the server.

Changes outside agent_env/openenv/

• agent_env.bundle.prepare_bundle(..., played=False): run_bundle's work before its first task, moved out unchanged, so agent-env run behaves exactly as before.
  • played=True drops the references of each task's only prompted agent's deploy_agent steps, keeping its envs, and preflight skips those deploys.
  • locate_bundle moves from cli/run.py into bundle/installed.py.
• Episode API:
  • EpisodeSpec.start(sandbox=) sets user_overrides the way run_bundle does, through a shared task_step.context.sandbox_overrides.
  • EpisodeSpec.prompts gives each outside turn's prompt and system prompt before anything runs.
  • Episode.finished is added.
• Episode API fix (a bug already on main): an abandoned episode's cancelled mark is now written in the task's run scope, as run_bundle's _mark_cancelled does. Before, an @local task's abandoned episode stayed running in the local store, because the mark went to the configured store.
• holding_locks raises the soft open-file limit to fit its locks, as Go's runtime does.
  • On main, materializing a bundle holds one open lock file per entry. A bundle of more entries than the limit allows therefore crashed agent-env run with OSError: [Errno 24] Too many open files.
  • Reproduced with main's agent-env run on PortSim's generated dock-v1-train (1,050 tasks, Linux default limit 1024) and dock-v1-train-standard (266 tasks at macOS's default of 256).
  • The per-id locking is unchanged; lock striping would have made unrelated bundles wait on each other.
• The explorer extra is gone.
  • It installed fastapi and uvicorn, which core now installs (uvicorn already was), so the CI check that every extra installs something core lacks failed.
  • agent-env up drops its check for them, and the README and AGENTS.md drop the extra.
  • pip install 'agentenv-framework[explorer]' still works, with pip's warning that the extra doesn't exist.
• The installer tier's offline index names each project as PEP 503 normalizes it. jaraco.classes (needed through openenv's keyring) ships a wheel whose filename keeps the dot, so uv found no jaraco-classes.
• THIRD_PARTY_NOTICES.md:
  • lists the new runtime packages;
  • refreshes hf-xet and huggingface_hub, the only versions that changed;
  • fixes PyJWT and tensorlake, which already disagreed with main's uv.lock.
• Docs: a README section and an AGENTS.md row.

Notes for review

• A planning or preflight problem stops startup with agent-env run's own error. Only the tasks the Episode API refuses are left out (and logged), since planning attributes problems to the bundle, not to individual tasks. So a task the Episode API would refuse (say, one prompting two agents) must still pass agent-env run's checks: its agents must exist.
• OpenEnv's stateless HTTP POST /reset deploys an episode and tears it down at once, as it does for every OpenEnv env that sets up in reset. Real episodes go over /ws sessions, which max_concurrent_envs caps.
• A bundle name with a . is served with - (dock.v1 at /dock-v1/...). OpenEnv's web interface reads the env name as a module path, so a dotted name failed create_app under ENABLE_WEB_INTERFACE, which openenv push sets in a Space.
• An eval named all is refused, since it would hide the split that holds every task.
• OpenEnv's /mcp endpoint answers a plain Environment's tools/call with the whole observation, not the tool's data. That's true for every plain-Environment env, including the ORS importer's. So MCPToolClient.call_tool returns the observation for these envs.
• Install footprint: OpenEnv brings gradio, which it uses only for its web UI, and pandas, numpy and Pillow through it: about 170 MB.

Verification

Tests: unit tests in tst/unit/openenv/ (25), plus extensions to the Episode API, bundle, ledger and installed-bundle tests. Integration tests in tst/integration/openenv/ (6) drive build_app on local Docker through OpenEnv's own GenericEnvClient and MCPToolClient; they passed twice on a Linux box.

PortSim proof (agentenv-portsim 0.5.5, a Linux EC2 box, local Docker):

• Startup: build_app({"train": dock-v1-train, "eval": dock-v1-eval}) serves 1,050 + 50 tasks after 11 s cold, 5 s warm.
• Rewards match exactly: the optimal, naive and empty plans, replayed through GenericEnvClient, score the same as the same episode run through the Episode API in process: 1.0, 0.200181, 0.0.
• Eval split: served too.
• Cleanup: every record ends terminal, and no container is left.

Chaos (dock-v1-train-standard, 266 tasks, c6i.8xlarge). All 21 checks pass:

Scenario	Result
Steady load, known-good plans, 2 rounds each	8 sessions in 5.0–5.2 s, 16 in 7.7–7.8 s, 32 in 13.5–14.1 s. Every reward exact, every record terminal, no container left.
8 clients SIGKILLed while holding episodes	All 8 torn down within 2.1 s.
5 resets on one live session (TRL's pattern)	The first four recorded cancelled, the last completed. Never more than one deployment.
The env's container killed mid-episode	The tool call is a transport_error ToolError. end_turn is then the error observation (done, no reward, status: error).
Server SIGTERM with 6 open episodes	All 6 recorded cancelled and torn down; stopped in 0.8 s.
Server SIGKILL with 4 open episodes	4 left behind, as expected with no hook to run; measured and removed.
5 sessions against max_concurrent_envs=3	2 refused with OpenEnv's CAPACITY_REACHED.
A client timeout shorter than the deploy	The client times out; the server tears the episode down.

OpenEnv's own tools against the PortSim server:

• openenv validate --url ... --level runtime: PASS, 6 of 6 criteria.
• The web playground (ENABLE_WEB_INTERFACE=true): the page serves, and an eval task resets with its four tools; end_turn scores it.

Regression (main 705a178 and this branch on the same Linux box):

Suite	main	this branch
make unit-test	8,340 passed, 7 skipped, 1 failed	8,368 passed (+28 new), 7 skipped, the same 1 failed
make int-test-fast	167 passed	172 passed (+5 new)
make int-test-slow	66 passed, 490 skipped	67 passed (+1 new), 490 skipped

• The unit failure is the same on both: run_docker_container_test.py::test_a_context_zip_from_a_non_s3_store_unpacks_in_a_real_local_sandbox.
• Flaky CI test: local_sandbox_test.py::test_teardown_stops_what_a_command_left_running_and_only_that failed once in this PR's CI. It failed the same way on another PR's CI today, and passed in both full runs on the box.

Follow-ups (separate PRs)

• Website: the getting-started page drops the explorer extra once this is released, and a page on serving tasks as OpenEnv envs is added.
• Hub Spaces: publish a bundle's OpenEnv Space from agent-env hf publish, with envs deployed to a remote sandbox.
• Trainers: a trainer-side adapter for TRL.
• Upstream OpenEnv asks:
  • discovery of installed AgentEnv bundles through AutoEnv;
  • gradio as an optional extra;
  • closing open sessions on server shutdown.

🤖 Generated with Claude Code

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues remain.

Summary

Adds build_app to serve bundle tasks through OpenEnv, with MCP tools, outside-agent turns, verifier rewards, and session cleanup.

• OpenEnv clients can play bundle tasks and receive their verifier scores.
• Large bundles can be materialized without running out of open files.
• Abandoned episodes are marked cancelled in the store that recorded them.
• OpenEnv is installed with the framework, and the explorer extra is retired.

Diagram

sequenceDiagram
    participant Client as OpenEnv client
    participant Env as AgentEnvEnvironment
    participant Episode as Episode API
    Client->>Env: reset(split, index)
    Env->>Episode: Start task and await first turn
    Episode-->>Client: Prompt and system prompt
    Client->>Env: List or call MCP tools
    Client->>Env: end_turn(response)
    Env->>Episode: End turn and await next turn
    Episode-->>Client: Next prompt or final scores and reward
    Client->>Env: Close session
    Env->>Episode: Abandon and await teardown

Loading

_{Reviews (4) · Last reviewed commit: "refactor(openenv): a served task carries..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​openenv@​0.9.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential vulnerability: pypi gradio with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/gradio@6.30.0 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/gradio@6.30.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential vulnerability: pypi numpy with risk level "medium" Location: Package overview From: uv.lock → pypi/openenv@0.9.0 → pypi/numpy@2.4.6 ℹ Read more on: This package | This alert | Navigating potential vulnerabilities Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: It is advisable to proceed with caution. Engage in a review of the package's security aspects and consider reaching out to the package maintainer for the latest information or patches. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/numpy@2.4.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
See 51 more rows in the dashboard

View full report