fix(security): update managed Python dependencies

[senthilr-nv]

Summary

Update the managed Hermes and Deep Agents Code images to aiohttp 3.14.3 and cryptography 50.0.0. These versions contain the fixes for GHSA-cq5v-8q36-5273 and GHSA-g6cj-pr64-35w5 while preserving each image's reviewed dependency and runtime contracts.

Changes

• Patch the pinned Hermes v2026.7.20 lock to select aiohttp 3.14.3 and cryptography 50.0.0, including the compatible optional dependency graph selected by the upstream lock.
• Regenerate the Deep Agents Code hash lock with direct pins for aiohttp 3.14.3 and cryptography 50.0.0.
• Assert the installed versions during both image builds.
• Update the Hermes Teams dependency authority, image-boundary contracts, dependency reviews, and focused tests.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent Codex Desktop review of the current PR commit and effective diff is recorded below.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/hermes-0.19.0-dependency-review.md; agents/langchain-deepagents-code/dependency-review.md; dependency comments and corresponding contract tests
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project integration test/hermes-dependency-review.test.ts test/langchain-deepagents-code-image.test.ts (25 passed); focused messaging contract tests (104 passed); clean Hermes patch application and uv lock --check; exact-package smoke imports
• Applicable broad gate passed — not applicable; this changes image dependency selections and their focused contracts, not broad runtime or test-harness behavior
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warnings
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Security and dependency-migration review receipt

• Reviewed PR commit: 6a1930a50594e3dce52d76deb07b448cf503ee84
• Reviewed base commit: ad26164962eddce3e335fae651b7fb0ee6b95718
• Effective diff SHA-256: dbae1b91e8fee8f090418196b78ac2be9a66b82d9296586a69303efbd376beab
• Product scope: PASS. This remediates existing managed-image dependencies and creates no new supported surface.
• Security result: WARNING for merge readiness, with no identified vulnerability in the proposed code or target dependency graph. The warning remains until the selected E2E gate passes.

The migration crosses four adjacent release ranges and 534 target-side commits: aiohttp 3.14.1→3.14.2 (34 commits) and 3.14.2→3.14.3 (4); cryptography 48.0.1→49.0.0 (198 target-side commits plus one release-branch-only metadata commit) and 49.0.0→50.0.0 (298).

The review confirmed that aiohttp 3.14.3 fixes the malformed chunked-response parser exposure and strengthens cross-origin sensitive-header removal, while cryptography 50.0.0 fixes the PKCS#7 oracle exposure. Cryptography 49 platform-wheel removals, deprecated aliases, ChaCha20 behavior, and stricter X.509 validation do not affect the managed Linux amd64/arm64 Python 3.13 images or the audited AES/AESGCM call sites. Hermes optional Alibaba and MSAL changes are outside the managed anthropic messaging web pty mcp extras.

The Deep Agents lock SHA-256 is 2e9d59768ea20953c184b52220334e969356ac1a684ff334f0f3767c9f859229; all 119 aiohttp and 46 cryptography hashes match PyPI. Hermes updates its source constraints and frozen uv lock together. The aiohttp producer run 29962259677, attempt 12, succeeded for commit 5e392ce0456f5235a4ee6ad46f0e806df2f15873. Cryptography wheel run 30637286238 and publish run 30638316464 succeeded for commit dcb7050b807b00392fa9fe2eac7cb362fcf355cc. PyPI exposes no registry attestation for aiohttp; the artifact hashes and successful producer evidence provide the available binding.

GitHub aggregate checks, security scans, focused tests, and amd64/arm64 managed-image builds passed. E2E / PR Gate and its coordination check must complete successfully before merge. This receipt is valid only while the reviewed PR commit and effective diff remain unchanged.

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Security

  • Updated Hermes and Deep Agents dependencies to patched versions, including aiohttp 3.14.3 and cryptography 50.0.0.
  • Refreshed related packages and lockfiles to address documented security advisories.

• Documentation

  • Updated dependency reviews, audit metadata, and remediation notes for the refreshed package sets.

• Tests

  • Expanded verification to confirm approved dependency versions and reject superseded vulnerable versions.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 6a1930a in the codex/security-agent... branch remains at 96%, unchanged from commit e31a23a in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 6a1930a in the codex/security-agent... branch remains at 81%, unchanged from commit e31a23a in the main branch.

Show a code coverage summary of the most impacted files.

File	main e31a23a	codex/security-agent... 6a1930a	+/-
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/m...-acquisition.ts	75%	75%	0%
src/lib/private-networks.ts	90%	93%	+3%
src/lib/policy/...ne-exclusion.ts	92%	96%	+4%

---

_{Updated August 04, 2026 07:51 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-8203.docs.buildwithfern.com/nemoclaw

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR refreshes Hermes and Deep Agents Code security dependencies, lockfile metadata, audit records, image version checks, and messaging integration expectations. It updates aiohttp, cryptography, and related dependency chains.

Changes

Security dependency refresh

Layer / File(s)	Summary
Hermes dependency graph and audit agents/hermes/security-dependencies.patch, agents/hermes/Dockerfile.base, docs/security/..., test/hermes-dependency-review.test.ts	Updates security pins, lock metadata, optional dependency chains, audit records, and installed-version assertions.
Deep Agents Code dependency checks agents/langchain-deepagents-code/requirements.in, agents/langchain-deepagents-code/Dockerfile.base, agents/langchain-deepagents-code/dependency-review.md, test/langchain-deepagents-code-image.test.ts	Pins aiohttp==3.14.3 and cryptography==50.0.0, then updates audit and image checks.
Hermes messaging version propagation scripts/check-messaging-plan-image-boundary.mts, src/lib/messaging/..., test/messaging-*.test.ts	Propagates aiohttp==3.14.3 through Hermes manifests, image validation, build expectations, and tests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• NVIDIA/NemoClaw#5823: Shares Deep Agents Code image and dependency validation changes.

Suggested labels: dependencies, integration: hermes, area: messaging

Suggested reviewers: apurvvkumaria, cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the primary change: updating managed Python dependencies for security fixes.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/security-agent-python-dependencies

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• define — Python security refresh at docs/security/hermes-0.19.0-dependency-review.md:10: Define this term on first use if later text refers to this update separately from the broader review.
• justified — compatibility-only lock changes at docs/security/hermes-0.19.0-dependency-review.md:184: Retain the modifier because the following sentence states the installed-runtime contrast.
• define — selected-runtime audit at docs/security/hermes-0.19.0-dependency-review.md:187: Define the selection boundary on first use to preserve the audit-scope interpretation.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, security-posture, channels-add-remove, channels-stop-start, ubuntu-repo-cloud-langchain-deepagents-code

2 optional E2E recommendations

• rebuild-hermes
• rebuild-openclaw

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (3)

test/langchain-deepagents-code-image.test.ts (1)

1046-1047: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Assert the Dockerfile pins per key instead of as one ordered substring.

This assertion requires three keys to appear contiguously, in this order, with this exact spacing, inside the Python dict literal on agents/langchain-deepagents-code/Dockerfile.base line 320. Reordering the keys or reformatting the line breaks the test without changing build behavior. The property under test is that each pin is asserted by the image build, not that the keys sit next to each other.

♻️ Assert each pin independently

-    expect(readAgentFile("Dockerfile.base")).toContain(
-      "'aiohttp': '3.14.3', 'cryptography': '50.0.0', 'deepagents-code': '0.1.34'",
+    const dockerfileBase = readAgentFile("Dockerfile.base");
+    for (const [name, expectedVersion] of [
+      ["aiohttp", "3.14.3"],
+      ["cryptography", "50.0.0"],
+      ["deepagents-code", "0.1.34"],
+    ] as const) {
+      expect(dockerfileBase).toContain(`'${name}': '${expectedVersion}'`);
+    }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/langchain-deepagents-code-image.test.ts` around lines 1046 - 1047,
Update the Dockerfile.base assertion in the relevant test to verify the aiohttp,
cryptography, and deepagents-code pins independently rather than as one ordered
contiguous substring. Keep each expected version tied to its specific key while
allowing key reordering or formatting changes.

Source: Path instructions

agents/hermes/security-dependencies.patch (1)

87-88: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep the advisory reference on the web extra pin.

The mcp, dev, and computer-use extras each keep an explicit GHSA-82w8-qh3p-5jfq reference on the same starlette==1.3.1 pin. The web extra now records only "the latest reviewed request parsing and URL fixes". That wording does not state a security floor, so a future reader cannot tell whether the pin is a security constraint or a preference. FastAPI pulls Starlette transitively, which is the reason the original comment gave for pinning it in every Starlette-backed extra.

♻️ Restore the advisory reference and the transitive-resolution rationale

-# starlette==1.3.1 includes the latest reviewed request parsing and URL fixes.
+# starlette==1.3.1 pinned for GHSA-82w8-qh3p-5jfq — fastapi pulls Starlette
+# transitively, so pin the patched floor here too. See the mcp extra above.
 web = ["fastapi==0.133.1", "uvicorn[standard]==0.41.0", "starlette==1.3.1", "python-multipart==0.0.27"]

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@agents/hermes/security-dependencies.patch` around lines 87 - 88, Update the
comment on the web extra pin to include the explicit GHSA-82w8-qh3p-5jfq
advisory reference and the transitive-resolution rationale, matching the pattern
established in the mcp, dev, and computer-use extras. The comment should clarify
that this starlette==1.3.1 pin is a security constraint due to FastAPI's
transitive pull of Starlette, not merely a preference for the latest reviewed
fixes.

test/hermes-dependency-review.test.ts (1)

154-156: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Version-bump guards in both test files are positive-only, so a leftover superseded pin still passes. Each site asserts only that the new version string is present. Neither asserts that the replaced version string is gone. The pins appear in several places per artifact — pyproject.toml extras, uv.lock package entries and requires-dist metadata, the lock file, and the Dockerfile assertion dict — so a partial edit is a realistic failure mode that these tests would not catch. The shared fix is to add absence assertions for the superseded versions alongside each presence assertion.

• test/hermes-dependency-review.test.ts#L154-L156: add expect(securityDependenciesPatch).not.toContain(...) for "aiohttp==3.14.1", the superseded cryptography pin, and "alibabacloud-dingtalk==2.2.42"; add the matching expect(dockerfileBase).not.toContain(...) checks for the L165-166 pins.
• test/langchain-deepagents-code-image.test.ts#L1040-L1045: add expect(requirementsLock).not.toContain(...) for aiohttp==3.14.1 and the superseded cryptography pin, so a stale or incompletely recompiled requirements.lock fails the test.

Confirm the superseded cryptography version before you use it; see the related comment on docs/security/hermes-0.19.0-dependency-review.md line 175, which records 48.0.1 while the patch replaces 46.0.7.

As per path instructions: "Migration tests must prove the superseded path is unreachable or removed, not merely prove that the new path also works."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/hermes-dependency-review.test.ts` around lines 154 - 156, The
version-bump tests use only positive assertions (checking new versions exist)
without confirming old versions are absent, so partial edits would pass. At
test/hermes-dependency-review.test.ts lines 154-156, add
expect(securityDependenciesPatch).not.toContain(...) assertions to confirm the
absence of the superseded versions aiohttp==3.14.1, cryptography==46.0.7, and
alibabacloud-dingtalk==2.2.42 alongside the existing presence checks; also add
matching expect(dockerfileBase).not.toContain(...) assertions for the pins
referenced at lines 165-166. At test/langchain-deepagents-code-image.test.ts
lines 1040-1045, add expect(requirementsLock).not.toContain(...) assertions to
confirm absence of aiohttp==3.14.1 and the superseded cryptography==46.0.7
version. This ensures all occurrences of replaced versions are updated, not just
some of them.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/hermes/security-dependencies.patch`:
- Around line 16-18: Update the dependency audit record for tornado==6.5.7 to
document that it is the lowest version fixing all three cited advisories, with
the first two requiring 6.5.6 and GHSA-pw6j-qg29-8w7f requiring 6.5.7. Also
record why the change includes the additional Tornado, Starlette, Pillow, and
MCP scope.
- Around line 274-293: The dependency audit record should explicitly document
the downgrade of alibabacloud-tea-openapi from 0.4.4 to 0.3.16, including its
sdist-only distribution and incomplete PyPI dependency metadata, and similarly
address alibabacloud-tea-xml 0.0.3. Update the relevant section of the Hermes
dependency review so it records whether these conditions were audited and deemed
expected and acceptable.

In `@docs/security/hermes-0.19.0-dependency-review.md`:
- Around line 164-165: Correct the selected third-party package count in the
dependency review text from 94 to 88. Keep the existing version-transition and
downstream security-selection details unchanged, and ensure the description
reflects that the listed pins do not add packages to the selected closure.

---

Nitpick comments:
In `@agents/hermes/security-dependencies.patch`:
- Around line 87-88: Update the comment on the web extra pin to include the
explicit GHSA-82w8-qh3p-5jfq advisory reference and the transitive-resolution
rationale, matching the pattern established in the mcp, dev, and computer-use
extras. The comment should clarify that this starlette==1.3.1 pin is a security
constraint due to FastAPI's transitive pull of Starlette, not merely a
preference for the latest reviewed fixes.

In `@test/hermes-dependency-review.test.ts`:
- Around line 154-156: The version-bump tests use only positive assertions
(checking new versions exist) without confirming old versions are absent, so
partial edits would pass. At test/hermes-dependency-review.test.ts lines
154-156, add expect(securityDependenciesPatch).not.toContain(...) assertions to
confirm the absence of the superseded versions aiohttp==3.14.1,
cryptography==46.0.7, and alibabacloud-dingtalk==2.2.42 alongside the existing
presence checks; also add matching expect(dockerfileBase).not.toContain(...)
assertions for the pins referenced at lines 165-166. At
test/langchain-deepagents-code-image.test.ts lines 1040-1045, add
expect(requirementsLock).not.toContain(...) assertions to confirm absence of
aiohttp==3.14.1 and the superseded cryptography==46.0.7 version. This ensures
all occurrences of replaced versions are updated, not just some of them.

In `@test/langchain-deepagents-code-image.test.ts`:
- Around line 1046-1047: Update the Dockerfile.base assertion in the relevant
test to verify the aiohttp, cryptography, and deepagents-code pins independently
rather than as one ordered contiguous substring. Keep each expected version tied
to its specific key while allowing key reordering or formatting changes.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d29e526c-2edc-47d8-9483-2cce49bf6350

📥 Commits

Reviewing files that changed from the base of the PR and between d58f67d and bb62198.

⛔ Files ignored due to path filters (1)

• agents/langchain-deepagents-code/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing (14)

• agents/hermes/Dockerfile.base
• agents/hermes/security-dependencies.patch
• agents/langchain-deepagents-code/Dockerfile.base
• agents/langchain-deepagents-code/dependency-review.md
• agents/langchain-deepagents-code/requirements.in
• docs/security/hermes-0.19.0-dependency-review.md
• scripts/check-messaging-plan-image-boundary.mts
• src/lib/messaging/channels/metadata.test.ts
• src/lib/messaging/channels/teams/manifest.ts
• src/lib/messaging/compiler/manifest-compiler.test.ts
• test/hermes-dependency-review.test.ts
• test/langchain-deepagents-code-image.test.ts
• test/messaging-build-applier.test.ts
• test/messaging-plan-image-boundary.test.ts

[cjagwani]

Exact-head follow-up for bb62198: the aiohttp 3.14.3 and cryptography 50.0.0 pins match the first patched versions for GHSA-cq5v-8q36-5273 and GHSA-g6cj-pr64-35w5, the Deep Agents lock SHA-256 matches its review record, and the image contracts assert both installed versions. The DingTalk/MSAL graph changes are documented as lock-only optional extras outside the managed Hermes extras. No new credential, authorization, policy, or network-control code is introduced in this diff. The required markdown-links failure is base drift: this head is five commits behind current main and the check is evaluating two contributor-update-hermes skill paths that main has since removed. Please refresh the branch before final review. Protected image build/E2E and automated review remain pending, so this is not an approval or merge-ready declaration.

[cjagwani]

Post-merge regression on current main f504948: PR #8203 correctly changed the Hermes Teams authority to aiohttp==3.14.3, but test/managed-image-capability-union.test.ts still expects 3.14.1 at lines 52 and 152. Reproduction: npx vitest run --project integration test/managed-image-capability-union.test.ts yields exactly 2 failures and 3 passes; changing only those two expectations to 3.14.3 yields 5/5 passes. This inherited failure is now red on refreshed release PRs #8188 and #8200. Please land a focused follow-up updating the two stale test expectations; no production or dependency change is needed.