Cairn

CVE dependency bumps for cryptography, starlette, multipart

NousResearch/hermes-agent · cluster 47997 · agent

Data as of

7 open items. Fix merged in #72362. Check it covers your case.

The short answer

5open issues
2open PRs
16items grouped
Known?
Yes. 16 related items grouped here, 2 issues already closed.
Fix event
A fix was merged to main in PR #72362. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this partially resolved, deciding PR #72362. That is separate from the fix event.
Still open
5 issues and 2 PRs.

These issues and PRs concern recurring CVEs in pinned Python dependencies—primarily cryptography, starlette, and python-multipart—and related problems with tooling (hermes, uv.lock) that may leave vulnerable versions installed despite update attempts.

Open issues5

  • Issue#47997security(deps): clear June 2026 Dependabot batch (starlette, tornado, cryptography, dompurify, opentelemetry)
  • Issue#59998hermes update reports success while leaving known-vulnerable deps installed (no post-update CVE signal)
  • Issue#60841CVEs survive pip-audit fix across reboots // uv.lock pins vulnerable versions of packages
  • Issue#61098Security: Remove pinned cryptography version 46.0.7
  • Issue#68360Latest v0.19.0 install still reports OSV findings in pinned dependencies

Open PRs2

  • PR#59993fix(deps): bump starlette/cryptography/python-multipart + transitive floors for July 2026 CVEs
  • PR#60298fix(cli): warn about vulnerable deps after hermes update (#59998)

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #72362 fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32)

    merged to main

    files: pyproject.toml, tests/test_packaging_metadata.py, tests/tools/test_computer_use.py, tools/lazy_deps.py

  • #81901 fix(deps): patch 31 known CVEs across Python and npm lockfiles

    merged to main

    files: .npmrc, apps/desktop/package.json, package.json, plugins/platforms/photon/sidecar/package.json, pyproject.toml, tools/lazy_deps.py, ui-tui/package.json, website/.npmrc, website/package.json

5 PRs closed without merging

From the close comments: done elsewhere 2 · duplicate 1 · stale or abandoned 1 · superseded by another PR 1

  • #47998 security(deps): clear June 2026 Dependabot CVE batch · done elsewhere → #81901
  • #60697 fix(deps): bump cryptography 46.0.7→48.0.1, python-multipart 0.0.27→0.0.31 · superseded by another PR → #56252
  • #60889 fix: bump cryptography, starlette, and python-multipart to CVE-free versions (#60841) · stale or abandoned
  • #60952 fix(deps): bump cryptography, starlette, python-multipart to CVE-fixed versions · duplicate → #60889
  • #64879 chore(security): raise cryptography OpenSSL floor · done elsewhere
Closed issues · 2
  • Closed#60685[Bug]: `hermes update` downgrades CVE-pinned packages to stale exact versions, overwriting newer compatible installs
  • Closed#68338cryptography
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.10: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#72362, #81901
Closed issues
2
Attempts
5 PRs closed without merging
Fix link checked
8 Aug 2026

For your agent

The same facts, typed.

cluster/47997.json
cluster/47997.md