
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@circleci/agents
Advanced tools
A simple toolkit for CircleCI agents, including tools for analyzing and fixing flaky tests and automating pull request workflows.
pnpm install
pnpm build
This script analyzes CircleCI test failures and suggests (and can apply) fixes for flaky tests.
pnpm cli fix-flaky-tests --git-url https://github.com/circleci-petri/quality-agent-target.git
you will have to setup in the target workspace the expected flaky test api output - url to fetch it would look something like this:
https://circleci.com/api/v2/insights/github/circleci-petri/quality-agent-target/flaky-tests
Environment variables required:
GITHUB_TOKEN (GitHub personal access token for PR creation and private repo access)ANTHROPIC_API_KEY (Anthropic Claude API key) -OR-OPENAI_API_KEY (OpenAI API key for Codex fallback)Optional environment variables:
CCI_AGENT_OPENAI_MODEL (OpenAI model to use, defaults to 'o3')To deploy and test the canary version of the flaky tests pipeline:
pipeline-definitionsfix-flaky-tests pipeline definitionfile_path parameter in the request body to:
"file_path": "circleci-agents/configs/fix-flaky-tests/canary.yml"
After completing the above steps, triggering the pipeline using the "Fix Flaky Tests" button will now use the canary configuration instead of the standard one.
testing rollbar functionality locally:
pnpm cli report-fix-flaky-tests
This should make a failed to run error in rollbar.
FAQs
CircleCI AI Agents
The npm package @circleci/agents receives a total of 740 weekly downloads. As such, @circleci/agents popularity was classified as not popular.
We found that @circleci/agents demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 84 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.