fix(deps): align anthropic extra pin with lazy pin + guard whole pin surface - #42335
Merged
Conversation
…surface The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp #31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused #31817 coverage.
Contributor
🔎 Lint report:
|
changman
pushed a commit
to changman/hermes-agent
that referenced
this pull request
Jun 10, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
alt-glitch
pushed a commit
that referenced
this pull request
Jun 14, 2026
…surface (#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp #31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused #31817 coverage.
davidgut1982
pushed a commit
to davidgut1982/hermes-agent
that referenced
this pull request
Jun 17, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
T02200059
pushed a commit
to T02200059/hermes-agent
that referenced
this pull request
Jun 18, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
xyshanren
pushed a commit
to xyshanren/hermes-agent-cn
that referenced
this pull request
Jun 25, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
waefrebeorn
pushed a commit
to waefrebeorn/slermes
that referenced
this pull request
Jul 2, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
santhreal
pushed a commit
to santhreal/hermes-agent
that referenced
this pull request
Jul 13, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
donbowman
pushed a commit
to donbowman/hermes-agent
that referenced
this pull request
Jul 13, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
Gravezzz
pushed a commit
to Gravezzz/hermes-agent
that referenced
this pull request
Jul 21, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
leewenjie
pushed a commit
to leewenjie/hermes-agent
that referenced
this pull request
Aug 7, 2026
…surface (NousResearch#42335) The anthropic extra pinned anthropic==0.86.0 while LAZY_DEPS['provider.anthropic'] pins 0.87.0 (CVE-2026-34450, CVE-2026-34452) — the same drift class as the aiohttp NousResearch#31817 downgrade. On hermes update the extra pin won and rolled anthropic 0.87.0 -> 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it. Bump the extra to 0.87.0, regenerate uv.lock, and generalize the regression guard: test_pyproject_pins_match_lazy_deps_pins now fails if ANY package pinned in both a pyproject extra and a LAZY_DEPS entry drifts, so a third package can't reintroduce this class. The aiohttp-specific test is kept for focused NousResearch#31817 coverage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
hermes updateno longer downgrades anthropic and reopens its CVEs — and the whole pin surface is now guarded against this class of drift.The
anthropicextra pinnedanthropic==0.86.0whileLAZY_DEPS["provider.anthropic"]pins0.87.0(CVE-2026-34450, CVE-2026-34452). On update the extra pin won and rolled anthropic0.87.0 → 0.86.0, reopening both CVEs until the native-Anthropic lazy refresh re-bumped it — the same drift class as the aiohttp #31817 downgrade.Changes
pyproject.toml: bump theanthropicextra to0.87.0; annotate with the CVE IDs.uv.lock: regenerated (uv lock) — anthropic0.86.0 → 0.87.0, no other resolution drift.tests/test_project_metadata.py: addtest_pyproject_pins_match_lazy_deps_pins— fails if any package pinned in both a pyproject extra and aLAZY_DEPSentry drifts apart (generalizes the aiohttp-specific hermes update downgrades aiohttp from 3.13.4 to 3.13.3 #31817 guard so a third package can't reintroduce the class). The aiohttp-specific test is kept for focused coverage.Supply-chain posture
anthropic 0.87.0published 2026-03-31 (~2.4 months old, well past the 2-week quarantine).==pin; matches our own lazy-deps pin (not chasing latest — 0.88.0 exists, deliberately skipped).Validation
anthropicextra pin0.86.00.87.0LAZY_DEPS["provider.anthropic"]uv lock --checktests/test_project_metadata.pyCVEs closed: CVE-2026-34450, CVE-2026-34452. Follow-up to #42154 (aiohttp); same drift class, found via a full pyproject↔lazy-deps pin sweep.
Infographic