an update to the title would be nice. these security holes are for "git-annex" and the new library is "http-client-restricted". i don't think the library's name needs to be in the title, but at least "git-annex" should be.