fix(security): update sandbox Python dependencies

.github/workflows/base-image.yaml

@@ -27,6 +27,7 @@ on:
       - "agents/openclaw/openclaw-runtime/package-lock.json"
       - "scripts/lib/reviewed-npm-archive.mts"
       - "agents/hermes/Dockerfile.base"
+      - "agents/hermes/security-dependencies.patch"
       - "agents/langchain-deepagents-code/Dockerfile.base"
       - "agents/langchain-deepagents-code/manifest.yaml"
       - "agents/langchain-deepagents-code/requirements.lock"

agents/hermes/Dockerfile.base

@@ -344,12 +344,15 @@ RUN printf '%s\n' \
 # skip rather than doing a nondeterministic dependency resolve during image
 # build.
 RUN pip3 install --no-cache-dir --break-system-packages "uv==${UV_VERSION}"
+COPY agents/hermes/security-dependencies.patch /tmp/hermes-security-dependencies.patch
 RUN mkdir -p /opt/hermes \
     && curl -fsSL "https://github.com/NousResearch/hermes-agent/archive/refs/tags/${HERMES_VERSION}.tar.gz" -o /tmp/hermes.tar.gz \
     && printf '%s  /tmp/hermes.tar.gz\n' "${HERMES_TARBALL_SHA256}" > /tmp/hermes.tar.gz.sha256 \
     && sha256sum -c /tmp/hermes.tar.gz.sha256 \
     && tar -xzf /tmp/hermes.tar.gz -C /opt/hermes --strip-components=1 \
-    && rm /tmp/hermes.tar.gz /tmp/hermes.tar.gz.sha256
+    && git -C /opt/hermes apply --check /tmp/hermes-security-dependencies.patch \
+    && git -C /opt/hermes apply /tmp/hermes-security-dependencies.patch \
+    && rm /tmp/hermes.tar.gz /tmp/hermes.tar.gz.sha256 /tmp/hermes-security-dependencies.patch
 
 # Cross-check the pinned release against two independent sources before
 # installing anything from it: the extracted tarball must declare
@@ -397,6 +400,9 @@ RUN set -eu; \
         set -- "$@" --extra "$extra"; \
     done; \
     uv sync --frozen --no-dev "$@" --no-cache \
+    && uv pip check --python /opt/hermes/.venv/bin/python \
+    && /opt/hermes/.venv/bin/python -I -c \
+        "from importlib.metadata import version; expected = {'cryptography': '48.0.1', 'pillow': '12.3.0', 'starlette': '1.3.1'}; actual = {name: version(name) for name in expected}; assert actual == expected, actual" \
     && npm ci --prefer-offline --no-audit --no-fund \
     && for ui_dir in ui-tui web; do \
         if [ -f "${ui_dir}/package-lock.json" ]; then \

agents/langchain-deepagents-code/Dockerfile.base

@@ -247,6 +247,9 @@ COPY agents/langchain-deepagents-code/requirements.lock /tmp/deepagents-code-req
 RUN python3 -m venv --copies "$VIRTUAL_ENV" \
     && "$VIRTUAL_ENV/bin/pip3" install --no-cache-dir --require-hashes \
         -r /tmp/deepagents-code-requirements.lock \
+    && "$VIRTUAL_ENV/bin/pip3" check \
+    && "$VIRTUAL_ENV/bin/python3" -I -c \
+        "from importlib.metadata import version; assert version('pillow') == '12.3.0', version('pillow')" \
     && ln -sf "$VIRTUAL_ENV/bin/dcode" /usr/local/bin/dcode \
     && ln -sf "$VIRTUAL_ENV/bin/deepagents-code" /usr/local/bin/deepagents-code \
     && rm -f /tmp/deepagents-code-requirements.lock \

agents/langchain-deepagents-code/dependency-review.md

@@ -7,12 +7,24 @@ This file records the reviewed dependency baseline for the Deep Agents Code sand
 Update it whenever `requirements.lock` changes.
 
 - Lockfile: `agents/langchain-deepagents-code/requirements.lock`
-- Lockfile SHA-256: `7889fd275175ceadde843480587a3ed5b3dc517537222e60fa6fdfe4d5b21332`
+- Lockfile SHA-256: `d112ad4a01ff2b87211b1a10ecb98950e62d4bdffb37a122326af7b352250d25`
 - Audit command: `uv tool run --python 3.13 pip-audit -r agents/langchain-deepagents-code/requirements.lock --progress-spinner off --disable-pip`
-- Audit date: 2026-07-09
-- Audit result: `No known vulnerabilities found`
+- Audit date: 2026-07-29
+- Targeted audit result: `Pillow 12.3.0 has no known vulnerabilities`
+- Complete-lock audit result: `6 records in 3 unrelated packages`
 
 The Dockerfile installs this lockfile with `pip3 install --require-hashes`, so this review covers the exact package versions selected for the managed image install.
+The lock now selects `Pillow==12.3.0` instead of the transitive `12.2.0`
+resolution, removing the image-parser advisories in this remediation scope.
+The image build runs `pip3 check` and asserts the exact installed Pillow
+version before publishing.
+
+The complete point-in-time audit also reports one record for `mcp==1.28.0`,
+three for `pyasn1==0.6.3`, and two duplicate database records for
+`setuptools==82.0.1`. These newly published records are not introduced by the
+Pillow-only lock regeneration and remain visible for a separate
+dependency-lifecycle review; this review does not claim the complete lock is
+vulnerability-free.
 
 ## Managed `fetch_url` Proxy Adapter
 
@@ -202,10 +214,11 @@ staged into the image, and image regression tests enforce that absence.
 
 Deep Agents Code `0.1.34` is the released consumer; prerelease risk is limited
 to its exact `deepagents==0.7.0a6` SDK pin. That risk is accepted because the
-consumer and SDK are hash locked, the dependency audit is clean, and all source,
-version, middleware, graph, and dispatch contracts are enforced by the isolated
-image-build validator. That validator is the fail-closed gate because Deep
-Agents deliberately isolates and logs third-party plugin callback failures.
+consumer and SDK are hash locked and all source, version, middleware, graph,
+and dispatch contracts are enforced by the isolated image-build validator.
+Separately, the point-in-time audit reports no known vulnerabilities for
+Pillow `12.3.0`. The validator is the fail-closed gate because Deep Agents
+deliberately isolates and logs third-party plugin callback failures.
 
 The exact version and source-hash gates remain the executable lifecycle check
 for the alias adapter: any dependency change stops the image build and requires

agents/langchain-deepagents-code/requirements.in

@@ -4,3 +4,5 @@
 uv==0.11.15
 deepagents-code[nvidia,openrouter]==0.1.34
 nemo-relay[langgraph]==0.4.0
+# Fix the image parser advisories reported against the transitive 12.2.0 pin.
+pillow==12.3.0