Aug 4, 2026

[cassidyjames]

After the last working group call was cancelled due to travel and TrustCon, today we had got back to our regular working group schedule. Here are the notes.

---

Attendees: @juanmrad, @cassidyjames, Sahil, @serendipty01, @calebmcquaid, @ThisIsMissEm

Notes

High level: what should we be focusing on?

• Dependencies/vulnerabilities first:
  • @serendipty01 has a PR to unify on TypeScript version chore: unify TypeScript on 6.0.3 across all five packages #910
  • fix: Replace bcrypt with Argon2id, upgrading legacy hashes on login #901 to replace bcrypt: why did we choose Argon2id? @serendipty01 to share link to Discord convo
• pnpm: can move to pnpm first, then move to workspaces; but that creates a lot of churn in the lockfile.
  • chore: tighten server/client types ahead of pnpm migration #668 is a prereq for pnpm migration; needs to be updated by @serendipty01
  • Current PR feat: migrate package manager from npm to pnpm #669 does it all in one go
  • Want to split package upgrades from pnpm move
  • Can do staged releases for npm
• chore(client): Migrate client config to esm #545 would be nice, can be post-pnpm
• Refuse queue deletion when routing rules still reference it #808 is approved, but might need some follow up from @reitblatt?
• @calebmcquaid has some open PRs; @calebmcquaid to follow up on those

Others to review

• Some integration tests from @julietshen Add #342 background-jobs integration test (and unbreak rule-anomaly query) #643
• Rename Other tab to Partial Items and relocate its settings #965
• Build and serve client assets from the server container #433 is a good idea
  • Needs work based on review comments
  • @ThisIsMissEm to take a look at continuing this; create a new issue and branch

Idea: more of an onboarding wizard/setup user journey to help with setting things up more correctly

• Something to explore more with @julietshen
• Also: configuration as code to better support types of orgs/platforms (right now we have the seed which is not great because it predefines API keys, etc.)
• Wordpress, Contentful, Shopify etc. CMSes have good onboarding user journeys to look at for inspiration
• Will also help support eventual future goal of one-click deploys if you can set more up from the UI

Advisories:

• GHSA-f952-qfh2-fw85: access control
• Another to be filed: NCMEC job access control
  • Investigate what the Child Safety permission actually does, consider having separate default-NCMEC vs. default queues
• @calebmcquaid working on a feature for Upscrolled, then can jump on to advisories

Actions

• @serendipty01 to share link to Discord convo re: bcrypt → argon2id Link
• @cassidyjames to do some milestone/issue triage
• @serendipty01 to update chore: tighten server/client types ahead of pnpm migration #668
• @ThisIsMissEm to take a look at continuing Build and serve client assets from the server container #433