{"repo":"NousResearch/hermes-agent","public_id":"116774","display_label":"npm audit fixes reverting after dependency reinstalls","summary":"These issues and PRs concern security vulnerabilities detected by npm audit being reintroduced after Hermes or other dependency updates reinstall Node modules. The work focuses on making audit fixes persist across such updates rather than being silently reverted.","subsystem":"other","counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":2,"attempt_prs":3},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":117599},"resolution":{"state":"resolved","by":"pr-117599"},"freshness":{"state":"verified","last_verified_at":"2026-10-14T04:07:04+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":116774,"pr_number":117599,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true},{"issue_number":116774,"pr_number":138024,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false}],"members":[{"kind":"issue","number":116774,"title":"[Bug]: npm audit fix for agent-browser does not persist across hermes update — vulnerabilities reintroduced by fresh Node dependency reinstall","url":null,"state":"closed"},{"kind":"pr","number":116910,"title":"fix(doctor): stop prescribing audit fixes that updates revert (#116774)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"9aab6ba7d7","number":0},{"kind":"pr","value":"#117599","number":117599}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":117599,"title":"fix(doctor): agent-browser npm advisories stop resurfacing after every hermes update (#116774, salvage #116910)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["hermes_cli/doctor_tools.py","tests/hermes_cli/test_doctor_audit_remedy.py"]},{"kind":"pr","number":125715,"title":"fix(security): resolve high-severity npm advisories","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":137494,"title":"fix(deps): bump pinned packages past their npm audit fix versions","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"cf3f423c3e","number":0},{"kind":"pr","value":"#138024","number":138024}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":138024,"title":"fix(deps): `hermes doctor` npm audits clear for root, web, ui-tui and the WhatsApp bridge (salvage #136789)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".npmrc","apps/desktop/package.json","package.json","tests-js/package.json","ui-tui/package.json","web/package.json"]}],"trust":{"default_tier":"verified","includes_suggested":false}}