Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new FormulaAuditor audit to detect disallowed npm dependencies (starting with @anthropic-ai/claude-agent-sdk) in installed node_modules trees for core formulae, with accompanying RSpec coverage.
Changes:
- Introduce
FormulaAuditor#audit_node_modulesto scanlibexec/lib/node_modulesfor incompatible npm packages in homebrew/core. - Emit an audit problem directing maintainers to Homebrew’s license guidelines when a rejected package is found.
- Add unit tests covering direct, nested, and dot-directory (
.pnpm-style) locations, plus core/non-core behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| Library/Homebrew/formula_auditor.rb | Adds a new audit_node_modules audit that searches installed node_modules for a rejected package and reports a license-guidelines error. |
| Library/Homebrew/test/formula_auditor_spec.rb | Adds specs validating detection/skip behavior for the new audit_node_modules audit across common directory layouts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
bevanjkay
approved these changes
Mar 23, 2026
krehel
approved these changes
Mar 23, 2026
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
brew lgtm(style, typechecking and tests) with your changes locally?Audit to detect
@anthropic-ai/claude-agent-sdkhomebrew-core#273635Example output after
brew install promptfoowith timing (run in Linux container):Using an array to extend this with other npm packages.
Future ideas
In future, may consider moving this to a JSON file we store in Homebrew/core so it can be implemented as a tap-specific blacklist. Then can also be used in 3rd-party taps to detect unwanted dependencies.
And in further future, may want to analyze SPDX licenses of all installed npm packages to automatically detect disallowed licenses. May need a whitelist in this case when an npm package doesn't use SPDX.