NousResearch/hermes-agent

npm dependency audit and override conflict fixes

Cluster 136475 · apps/desktop. Data as of 2026-10-26 12:29 UTC

1 open item. Fix merged in #139963 on 16 Oct 2026. Check it covers your case.

open issue

open PRs

items grouped

Known?: Yes. 4 related items grouped here, 0 issues already closed.
Fix event: A fix was merged to main in PR #139963. Check it covers your case. No release data is tracked.
Tracker: The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open: 1 issue and 0 PRs.

Next step: read #139963, then check whether your report is the one still open.

Read #139963 Pick up a Lab task

These members all concern npm dependency security maintenance: syncing pinned or overridden versions, addressing audit and Dependabot alerts, and an EOVERRIDE conflict involving dompurify during npm audit fix --force. They span several packages and approaches, and the outcomes are not established from the titles alone.

Open issues1

Issue#136475npm audit fix --force aborts with EOVERRIDE: root overrides.dompurify conflicts with apps/desktop direct dependency

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

#138024 fix(deps): `hermes doctor` npm audits clear for root, web, ui-tui and the WhatsApp bridge (salvage #136789)

merged to main

files: .npmrc, apps/desktop/package.json, package.json, tests-js/package.json, ui-tui/package.json, web/package.json
#139963 fix(deps): clear 19 Dependabot alerts (patch/minor-only security bumps)

merged to main

files: .npmrc, apps/desktop/package.json, package.json, plugins/platforms/photon/sidecar/package.json, pyproject.toml, tests/tools/test_mcp_oauth_manager.py, website/.npmrc, website/package.json

1 PR closed without merging

From the close comments: superseded by another PR 1

#136499 fix(deps): sync override-pinned direct deps to fixed versions so npm audit fix runs · superseded by another PR → #138024, #139963

How this cluster was grouped

Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem: apps/desktop
Merged PRs: #138024, #139963
Closed issues: 0
Attempts: 1 PR closed without merging
Fix link checked: 16 Oct 2026

For your agent

The same facts, typed.

cluster/136475.json
cluster/136475.md