{"repo":"NousResearch/hermes-agent","public_id":"47997","display_label":"CVE dependency bumps for cryptography, starlette, multipart","summary":"These issues and PRs concern recurring CVEs in pinned Python dependencies—primarily cryptography, starlette, and python-multipart—and related problems with tooling (hermes, uv.lock) that may leave vulnerable versions installed despite update attempts.","subsystem":"agent","counts":{"members":16,"open_issues":5,"open_issues_distinct":5,"open_prs":2,"closed_issues":2,"merged_prs":2,"attempt_prs":7},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":72362},"resolution":{"state":"partially_resolved","by":"pr-72362"},"freshness":{"state":"verified","last_verified_at":"2026-08-08T21:06:50+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.10499999999999998},"fix_edges":[{"issue_number":47997,"pr_number":81901,"tier":"verified","basis":"superseded_ref","confidence":0.9,"recoverable_from_timeline":false},{"issue_number":60685,"pr_number":72362,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":47997,"title":"security(deps): clear June 2026 Dependabot batch (starlette, tornado, cryptography, dompurify, opentelemetry)","url":null,"state":"open"},{"kind":"issue","number":59998,"title":"hermes update reports success while leaving known-vulnerable deps installed (no post-update CVE signal)","url":null,"state":"open"},{"kind":"issue","number":60685,"title":"[Bug]: `hermes update` downgrades CVE-pinned packages to stale exact versions, overwriting newer compatible installs","url":null,"state":"closed"},{"kind":"issue","number":60841,"title":"CVEs survive pip-audit fix across reboots // uv.lock pins vulnerable versions of packages","url":null,"state":"open"},{"kind":"issue","number":61098,"title":"Security: Remove pinned cryptography version 46.0.7","url":null,"state":"open"},{"kind":"issue","number":68338,"title":"cryptography","url":null,"state":"closed"},{"kind":"issue","number":68360,"title":"Latest v0.19.0 install still reports OSV findings in pinned dependencies","url":null,"state":"open"},{"kind":"pr","number":47998,"title":"security(deps): clear June 2026 Dependabot CVE batch","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#81901","number":81901},{"kind":"pr","value":"#81901","number":81901}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":59993,"title":"fix(deps): bump starlette/cryptography/python-multipart + transitive floors for July 2026 CVEs","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#82740","number":82740},{"kind":"pr","value":"#82740","number":82740}],"category":"partial_fix","implication":"needs_llm"},"merged":false},{"kind":"pr","number":60298,"title":"fix(cli): warn about vulnerable deps after hermes update (#59998)","url":null,"state":"open","close_reason":{"refs":[{"kind":"commit","value":"8b84b80433e0","number":0}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":60697,"title":"fix(deps): bump cryptography 46.0.7→48.0.1, python-multipart 0.0.27→0.0.31","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#56252","number":56252}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":60889,"title":"fix: bump cryptography, starlette, and python-multipart to CVE-free versions (#60841)","url":null,"state":"closed","close_reason":{"category":"stale_abandoned","implication":"active"},"merged":false},{"kind":"pr","number":60952,"title":"fix(deps): bump cryptography, starlette, python-multipart to CVE-fixed versions","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#60889","number":60889}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":64879,"title":"chore(security): raise cryptography OpenSSL floor","url":null,"state":"closed","close_reason":{"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":72362,"title":"fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["pyproject.toml","tests/test_packaging_metadata.py","tests/tools/test_computer_use.py","tools/lazy_deps.py"]},{"kind":"pr","number":81901,"title":"fix(deps): patch 31 known CVEs across Python and npm lockfiles","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":[".npmrc","apps/desktop/package.json","package.json","plugins/platforms/photon/sidecar/package.json","pyproject.toml","tools/lazy_deps.py","ui-tui/package.json","website/.npmrc","website/package.json"]}],"trust":{"default_tier":"verified","includes_suggested":false}}