{"repo":"NousResearch/hermes-agent","public_id":"72108","display_label":"High-severity dependency vulnerability fixes and auditing","summary":"These items relate to identifying and addressing high-severity security advisories in locked dependencies. They involve patching vulnerable packages, adding publication-age floors, and restricting npm script execution.","subsystem":"agent","counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":75037,"merged_at":"2026-07-31T18:07:33+00:00"},"resolution":{"state":"resolved","by":"pr-75037"},"freshness":{"state":"verified","last_verified_at":"2026-07-31T18:07:33+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":43997,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-31T18:07:33+00:00"},{"issue_number":50901,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-31T18:07:33+00:00"},{"issue_number":68736,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-31T18:07:33+00:00"},{"issue_number":72108,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-31T18:07:33+00:00"},{"issue_number":73426,"pr_number":75037,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-31T18:07:33+00:00"}],"members":[{"kind":"issue","number":72108,"title":"v0.19.0 security audit reports High advisories in locked dependencies","url":null,"state":"closed"},{"kind":"pr","number":72840,"title":"fix(deps): clear high-severity dependency advisories (#72108)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#73474","number":73474},{"kind":"pr","value":"#73475","number":73475},{"kind":"pr","value":"#73476","number":73476}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":75037,"title":"fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".npmrc","apps/bootstrap-installer/package.json","apps/desktop/package.json","apps/desktop/src/app/artifacts/index.tsx","apps/desktop/src/app/chat/composer/hooks/use-composer-draft.test.tsx","apps/desktop/src/app/chat/composer/hooks/use-composer-draft.ts","apps/desktop/src/app/chat/composer/status-stack/goal-indicator.test.tsx","apps/desktop/src/app/chat/composer/status-stack/index.tsx","apps/desktop/src/app/chat/index.tsx","apps/desktop/src/app/chat/sidebar/index.tsx","apps/desktop/src/app/chat/sidebar/profile-switcher.tsx","apps/desktop/src/app/command-palette/index.tsx","apps/desktop/src/app/contrib/surfaces.tsx","apps/desktop/src/app/contrib/wiring.tsx","apps/desktop/src/app/hooks/use-keybinds.ts","apps/desktop/src/app/hooks/use-route-enum-param.ts","apps/desktop/src/app/hooks/use-route-overlay-active.ts","apps/desktop/src/app/messaging/index.test.tsx","apps/desktop/src/app/pet-generate/pet-generate-content.tsx","apps/desktop/src/app/session-switcher.tsx","apps/desktop/src/app/session/hooks/use-session-actions/index.ts","apps/desktop/src/app/settings/billing/index.test.tsx","apps/desktop/src/app/settings/config-settings.tsx","apps/desktop/src/app/settings/index.tsx","apps/desktop/src/app/settings/model-settings.test.tsx","apps/desktop/src/app/settings/toolset-config-panel.test.tsx","apps/desktop/src/app/settings/toolset-config-panel.tsx","apps/desktop/src/app/settings/use-deep-link-highlight.ts","apps/desktop/src/app/shell/approval-mode-menu.test.tsx","apps/desktop/src/app/shell/hooks/use-overlay-routing.ts","apps/desktop/src/app/shell/statusbar-controls.tsx","apps/desktop/src/app/shell/statusbar-visibility.test.tsx","apps/desktop/src/app/shell/titlebar-controls.tsx","apps/desktop/src/app/skills/index.test.tsx","apps/desktop/src/app/skills/index.tsx","apps/desktop/src/components/assistant-ui/thread/assistant-message.tsx","apps/desktop/src/components/assistant-ui/thread/use-message-reactions.ts","apps/desktop/src/components/assistant-ui/thread/user-edit-composer.tsx","apps/desktop/src/components/find-bar.test.tsx","apps/desktop/src/components/find-bar.tsx","apps/desktop/src/main.tsx","apps/shared/package.json","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","contributors/emails/[redacted:email]","eslint.config.shared.mjs","hermes_cli/main.py","hermes_cli/npm_engine.py","nix/hermes-agent.nix","package.json","pyproject.toml","tests-js/package.json","tests/hermes_cli/test_npm_engine.py","tests/tools/test_computer_use.py","tools/lazy_deps.py","ui-tui/package.json","ui-tui/packages/hermes-ink/package.json","web/package.json","web/src/App.tsx","web/src/components/ChatSessionList.tsx","web/src/components/SidebarStatusStrip.tsx","web/src/contexts/PageHeaderProvider.tsx","web/src/contexts/ProfileProvider.tsx","web/src/main.tsx","web/src/pages/ChatPage.tsx","web/src/pages/PluginsPage.tsx","web/src/pages/ProfileBuilderPage.tsx","web/src/pages/ProfilesPage.tsx","web/src/pages/SessionsPage.tsx","web/src/pages/SkillsPage.tsx","web/src/pages/SystemPage.tsx","web/vite.config.ts","website/.npmrc","website/package.json"]}],"trust":{"default_tier":"verified","includes_suggested":false}}