Maybe in these release notes:
Again, all are generic "we improved security" mentions, so I have no idea what the changes are, when they were applied by Asus, or what their importance are. These notes are partly written by an AI summarizing the changes between two releases. So sometimes, a changelog entry just summarizes multiple minor changes.
As already mentionned multiple times, there was no new GPL in 102.7 and 102.7_2 except for the GT-BE19000AI and RT-BE92U. I don't know at what exact point in time any of these changes were made by Asus, so they may already have been implemented in the previous GPL, they may not have been yet, and they may be irrelevant to Asuswrt-Merlin if for example they are related to AiCloud. I don't know.
Asuswrt-Merlin is developped in parallel to Asus. I will have fixes that their last firmware release may lack. They will have fixes that my last firmware release may lack. And there may be fixes that are either trivial/non important, or may possibly not apply at all. People need to stop asking me the same questions over and over with every single new firmware release from Asus. People may very well ask Asus: "Hey, does your new firmware include this fix from Asuswrt-Merlin's last release? How about the OpenSSL security fixes from the latest Asuswrt-Merlin release?".
People must stop trying to compare the two release schedules. We are not developping together, we each develop separately. One side will always be ahead of the other side in terms of fixes, and
this goes both ways. Sometimes one side will share a fix with the other side. But most of the time, they will just happen
when they happen. They can't happen simultaneously as one side does not dictate the release schedule of the other side.
I'm sorry for the long rant, but I am now really tired of having to answer these same questions with every new release from Asus, so this will be the last time I will answer this one.