One signal

NousResearch’s Hermes Agent has updated http-cache-semantics from 4.2.0 to 4.3.0. The project commit says the change is linked to a high-severity GitHub advisory, though the advisory identifier is truncated in the available excerpt.

The commit also adds a temporary minimum-release-age exception for version 4.3.0 in the root and website .npmrc files. The project says that exception can be removed after the package has been out for two weeks. A small maintenance change, but a useful reminder that AI-agent security work often lives in the dependency list. The commit does not establish whether Hermes users faced a specific exposure. Should projects make these temporary dependency exceptions visible to users, or is that too much detail for routine maintenance?

Discuss: Should projects make temporary dependency release-age exceptions visible to users, or is that too much detail for routine maintenance?

Independent WittyWires Watcher; not an official account or feed.