Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix Pinned Python deps carry known CVEs (urllib3 2.6.3, python-multipart 0.0.26, PyJWT 2.12.1, idna 3.13) — bump to patched releases

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

hermes security (OSV.dev audit) flags several pinned Python dependencies that carry known advisories with patched releases available. The two HIGH-severity ones — urllib3 and python-multipart — are the priority. These are resolved via uv.lock (managed pins), so a plain hermes update does not move them; the lock needs refreshing to the patched versions.

Reporting so the pins can be bumped durably for all installs.

Root Cause

hermes security (OSV.dev audit) flags several pinned Python dependencies that carry known advisories with patched releases available. The two HIGH-severity ones — urllib3 and python-multipart — are the priority. These are resolved via uv.lock (managed pins), so a plain hermes update does not move them; the lock needs refreshing to the patched versions.

Reporting so the pins can be bumped durably for all installs.

Fix Action

Fix / Workaround

hermes security (OSV.dev audit) flags several pinned Python dependencies that carry known advisories with patched releases available. The two HIGH-severity ones — urllib3 and python-multipart — are the priority. These are resolved via uv.lock (managed pins), so a plain hermes update does not move them; the lock needs refreshing to the patched versions.

Refresh uv.lock to pull the patched releases (at minimum urllib3>=2.7.0 and python-multipart>=0.0.27 for the two HIGH items), then re-run the OSV audit to confirm the HIGH count drops to zero.

RAW_BUFFERClick to expand / collapse

Summary

hermes security (OSV.dev audit) flags several pinned Python dependencies that carry known advisories with patched releases available. The two HIGH-severity ones — urllib3 and python-multipart — are the priority. These are resolved via uv.lock (managed pins), so a plain hermes update does not move them; the lock needs refreshing to the patched versions.

Reporting so the pins can be bumped durably for all installs.

HIGH severity

PackageInstalledFixed inAdvisories
urllib32.6.32.7.0GHSA-mf9v-mfxr-j63j (decompression-bomb safeguards bypassed in streaming API); GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins in proxied redirects); PYSEC-2026-141/142
python-multipart0.0.260.0.27GHSA-pp6c-gr5w-3c5g (DoS via unbounded multipart part headers)

Moderate / other

PackageInstalledFixed inAdvisories
PyJWT[crypto]2.12.12.13.0PYSEC-2026-175/177/178/179
idna3.133.15GHSA-65pc-fj4g-8rjx (crafted input to idna.encode())

pip (24.0) in the bundled venv also trails several advisories (GHSA-4xh5-x5gv-qwph and others; fixed in 25.3+), if the bundled tooling version is in scope.

Already tracked (not re-reporting)

  • PyNaCl advisory → #37373
  • aiohttp 3.13.x → #31817 (and the aiohttp==3.13.3 pin in the messaging/slack/homeassistant/sms extras; fixed in 3.14.0: GHSA-hg6j-4rv6-33pg, GHSA-jg22-mg44-37j8)

Suggested remediation

Refresh uv.lock to pull the patched releases (at minimum urllib3>=2.7.0 and python-multipart>=0.0.27 for the two HIGH items), then re-run the OSV audit to confirm the HIGH count drops to zero.

Detection

hermes security against the bundled venv (v0.15.1, 2026.5.29): 18 findings / 3 HIGH before bumping urllib3+python-multipart locally; 13 / 0 HIGH after. This issue asks for the same bump upstream so it is durable.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING