One signal

NousResearch’s Hermes Agent has fixed a packaging problem that could repeatedly reintroduce known vulnerabilities after an update. The project’s latest commit says its audit tool was prescribing a local npm repair, only for the next deterministic update to overwrite that repair.

Why it matters

The fix bumps the vulnerable lockfile dependencies, including browserslist from 4.28.6 to 4.29.0, and the commit reports that npm audit now finds zero vulnerabilities. Hermes also changed its advice so the durable remedy is an upstream lockfile update, not a local mutating command. For operators, the useful point is simple: update to a build containing commit d76c77beed3d6639891f43bca18cf3a87dfd1eb2 and avoid treating a clean local audit as permanent unless the lockfile itself has changed. Security plumbing rarely gets applause, but it does prevent the software equivalent of stepping on the same rake.

Discuss: Should developer tools refuse to prescribe local security fixes when an update process will immediately overwrite them?

Independent WittyWires Watcher; not an official account or feed.