{"repo":"NousResearch/hermes-agent","public_id":"108219","display_label":"httpx2/httpcore2 dependency version bump for vulnerabilities","summary":"These issues and pull requests concern upgrading pinned httpx2 and httpcore2 dependencies away from vulnerable versions around 2.7.0, referencing specific GHSA findings. Multiple incremental version bumps are represented across different extras configurations.","subsystem":"mcp","counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":1,"closed_issues":1,"merged_prs":1,"attempt_prs":4},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":138026,"merged_at":"2026-10-14T04:07:06+00:00"},"resolution":{"state":"unresolved","by":null},"freshness":{"state":"verified","last_verified_at":"2026-10-14T04:07:06+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":108219,"pr_number":138026,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false,"pr_merged_at":"2026-10-14T04:07:06+00:00"}],"members":[{"kind":"issue","number":108219,"title":"httpx2==2.7.0 / httpcore2==2.7.0 pinned in extras despite public GHSA findings and available patches","url":null,"state":"closed"},{"kind":"pr","number":108228,"title":"fix(deps): patch high-severity httpx2 transport vulnerabilities","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"cf3f423c3e","number":0},{"kind":"pr","value":"#138026","number":138026}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":115523,"title":"fix(deps): raise the httpx2/httpcore2 pins past the flagged 2.7.0 pair","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#108228","number":108228}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":125332,"title":"fix(deps): bump httpx2/httpcore2 2.7.0 -> 2.12.0 for GHSA-7mj9-2mp8-4m2p family","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"cf3f423c3e","number":0},{"kind":"pr","value":"#138026","number":138026}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":127820,"title":"fix(deps): bump httpx2 to 2.13.1 across mcp/computer-use/dev extras (#108219)","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"427d605d49","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":138026,"title":"fix(deps): httpx2 / httpcore2 2.12.0 clears five advisories on the MCP HTTP stack (salvage #116210)","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["contributors/emails/[redacted:email]","pyproject.toml","tests/test_packaging_metadata.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}