RomanNum3ral
/
hermes-agent
mirror of https://github.com/NousResearch/hermes-agent.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(deps): mirror aiohttp 3.14.3 pin into lazy_deps feature specs 

tests/test_project_metadata.py and test_packaging_metadata.py enforce
that lazy_deps.py exact pins match pyproject extras and uv.lock.
This commit is contained in:
Teknium 2026-08-08 11:06:13 -07:00
parent 7537de9e74
commit 45f31de4e9
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tools/lazy_deps.py
View File

@ -216,12 +216,12 @@ LAZY_DEPS: dict[str, tuple[str, ...]] = {
# backbone. Pin the patched floor here too so the lazy Discord path
# can't keep an already-installed vulnerable aiohttp satisfying that
# range — mirrors the messaging extra and platform.slack.
"aiohttp==3.14.1", # CVE-2026-34513/34518/34519/34520/34525 + 34993(RCE)/47265
"aiohttp==3.14.3", # prior CVEs + GHSA-cq5v-8q36-5273/GHSA-mfx4-hv73-q22v/GHSA-mq44-7p77-q5h7
),
"platform.slack": (
"slack-bolt==1.29.0",
"slack-sdk==3.43.0",
"aiohttp==3.14.1", # CVE-2026-34513/34518/34519/34520/34525 + 34993(RCE)/47265
"aiohttp==3.14.3", # prior CVEs + GHSA-cq5v-8q36-5273/GHSA-mfx4-hv73-q22v/GHSA-mq44-7p77-q5h7
),
"platform.matrix": (
"mautrix[encryption]==0.21.0",
@ -231,7 +231,7 @@ LAZY_DEPS: dict[str, tuple[str, ...]] = {
# mautrix (aiohttp>=3,<4) and aiohttp-socks (aiohttp>=3.10.0) only cap
# aiohttp transitively, so a vulnerable already-installed aiohttp still
# satisfies both — pin the patched floor here too, like platform.discord.
"aiohttp==3.14.1", # CVE-2026-34513/34518/34519/34520/34525 + 34993(RCE)/47265
"aiohttp==3.14.3", # prior CVEs + GHSA-cq5v-8q36-5273/GHSA-mfx4-hv73-q22v/GHSA-mq44-7p77-q5h7
),
"platform.dingtalk": (
"dingtalk-stream==0.24.3",
@ -250,7 +250,7 @@ LAZY_DEPS: dict[str, tuple[str, ...]] = {
# (microsoft-teams-api/cards/common, dependency-injector, msal). Lazy-
# installed on demand like every other messaging platform; also exposed
# as the `teams` extra in pyproject for packagers / explicit installs.
"platform.teams": ("microsoft-teams-apps==2.0.13.4", "aiohttp==3.14.1"), # aiohttp 3.14.1: CVE-2026-34993(RCE)/47265 + 34513/34518/34519/34520/34525
"platform.teams": ("microsoft-teams-apps==2.0.13.4", "aiohttp==3.14.3"), # aiohttp 3.14.3: prior CVEs + GHSA-cq5v-8q36-5273/GHSA-mfx4-hv73-q22v/GHSA-mq44-7p77-q5h7
# ─── Terminal backends ─────────────────────────────────────────────────
"terminal.modal": ("modal==1.3.4",),