hwloc currently includes hwloc 1.11.12 from Dec 13, 2018 which is the “ultrastable” branch: https://www.open-mpi.org/software/hwloc/v1.11/
The MPI external library on the other hand includes version 2.0.1 as in its sources, and some package managers (homebrew, Debian) have updated to a 2.X version (stable).
Thus it may be good to update the included tarball to the same version (which the ExternalLibrary will then use when it is being compiled). This will break some thorns that use hwloc since 2.X is not API compatible with 1.X. The ET’s thorns support both versions of hwloc.