{"repo":"NousResearch/hermes-agent","public_id":"54794","display_label":"Cap OSV response body reads to prevent OOM","summary":"Multiple issues and fixes address unbounded HTTP response body reads in OSV client and MCP OSV malware preflight checks, with an additional fix for scoped npm package tag handling in OSV checks.","subsystem":"agent","counts":{"members":6,"open_issues":2,"open_issues_distinct":2,"open_prs":3,"closed_issues":0,"merged_prs":0,"attempt_prs":4},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.29066666666666663},"fix_edges":[],"members":[{"kind":"issue","number":54794,"title":"Security audit OSV client reads response bodies without a cap","url":null,"state":"open"},{"kind":"issue","number":54828,"title":"MCP OSV malware preflight reads response bodies without a cap","url":null,"state":"open"},{"kind":"pr","number":17716,"title":"fix(osv_check): ignore latest tag for scoped npm packages","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":54795,"title":"fix(security): bound OSV response reads","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":54829,"title":"fix(security): bound MCP OSV response reads","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#54795","number":54795}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":57462,"title":"fix(security-audit): cap OSV response body size to prevent OOM (#54794)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#54795","number":54795},{"kind":"pr","value":"#54794","number":54794}],"category":"superseded_by_pr","implication":"superseded"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true}],"trust":{"default_tier":"verified","includes_suggested":false}}