Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix [Bug]: Deprecation and security warnings (glob, inflight) during hermes update

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

Operating System

Ubuntu 24.04.4 LTS

Python Version

Python 3.12.3

Hermes Version

Hermes Agent v0.14.0 (2026.5.16)

Additional Logs / Traceback (optional)

Root Cause

Root Cause Analysis (optional)

Code Example

→ Updating Node.js dependencies...

> hermes-agent@1.0.0 postinstall
> echo '✅ Browser tools ready. Run: python run_agent.py --help'

✅ Browser tools ready. Run: python run_agent.py --help

added 1 package in 7s
  ✓ repo root
npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated @babel/plugin-proposal-private-methods@7.18.6: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.
npm warn deprecated glob@7.2.3: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me


It looks like the internal Node.js tools in the project need a dependency bump in their package.json to clear up these warnings and secure the package.

Thanks for your hard work on this project!

### Steps to Reproduce

1.Run hermes update on a Linux environment.
2.Observe the terminal output during the Node.js dependencies update step.

### Expected Behavior

The update completes cleanly without throwing deprecation or security warnings for internal Node.js dependencies.

### Actual Behavior

The update throws npm warn deprecated messages for inflight and glob (security vulnerabilities).

### Affected Component

Setup / Installation

### Messaging Platform (if gateway-related)

_No response_

### Debug Report

---

### Operating System

Ubuntu 24.04.4 LTS 

### Python Version

Python 3.12.3

### Hermes Version

Hermes Agent v0.14.0 (2026.5.16)

### Additional Logs / Traceback (optional)
RAW_BUFFERClick to expand / collapse

Bug Description

Hello,

While running the hermes update command, the Node.js dependencies update step throws several npm warn deprecated messages. Although the update finishes successfully (✅ Browser tools ready), some of these dependencies contain widely publicized vulnerabilities (specifically [email protected]), and others leak memory.

Steps to reproduce: Run hermes update on a Linux environment.

Console Output:

→ Updating Node.js dependencies...

> [email protected] postinstall
> echo '✅ Browser tools ready. Run: python run_agent.py --help'

✅ Browser tools ready. Run: python run_agent.py --help

added 1 package in 7s
  ✓ repo root
npm warn deprecated [email protected]: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated @babel/[email protected]: This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.
npm warn deprecated [email protected]: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting [email protected]


It looks like the internal Node.js tools in the project need a dependency bump in their package.json to clear up these warnings and secure the package.

Thanks for your hard work on this project!

### Steps to Reproduce

1.Run hermes update on a Linux environment.
2.Observe the terminal output during the Node.js dependencies update step.

### Expected Behavior

The update completes cleanly without throwing deprecation or security warnings for internal Node.js dependencies.

### Actual Behavior

The update throws npm warn deprecated messages for inflight and glob (security vulnerabilities).

### Affected Component

Setup / Installation

### Messaging Platform (if gateway-related)

_No response_

### Debug Report

```shell
Not applicable. This is an installation/dependency warning during hermes update, not a runtime crash.

Operating System

Ubuntu 24.04.4 LTS

Python Version

Python 3.12.3

Hermes Version

Hermes Agent v0.14.0 (2026.5.16)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

Internal browser tools dependencies in package.json are outdated.

Proposed Fix (optional)

Bump dependency versions in package.json to clear security and deprecation warnings.

Are you willing to submit a PR for this?

  • I'd like to fix this myself and submit a PR

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING