fix(sec): patch vulnerable deps + add publication-age floors and npm script allow-list

[ethernet8023]

What does this PR do?

Supply-chain / vulnerability sweep across both dependency trees, plus two structural guardrails so the same drift doesn't creep back in.

Two halves:

1. Patch the known-vulnerable pins. Python deps bumped to the fixed releases (Pillow, mcp, pygments, pynacl, pyasn1, pydantic-settings, pytest, msgpack, httplib2, cbor2, tornado, setuptools), npm deps updated to clear npm audit.

2. Shrink the window a new compromise has to land in. A malicious package version is usually yanked within days of publication, so the highest-leverage defence is not installing anything that was published in the last two weeks:

• .npmrc gets min-release-age=14
• pyproject.toml [tool.uv] gets exclude-newer = "14 days"

Both carry explicit, commented escape hatches for the packages that genuinely need a fresher release (either because they ship a vuln fix that is itself younger than 14 days, or because they release constantly — @assistant-ui/*, @radix-ui/*). Every exclusion says when to remove it.

Also adds allowScripts to the root package.json, so npm lifecycle scripts run only for the handful of packages that legitimately need them (esbuild, node-pty, electron, electron-winstaller, agent-browser) and are denied everywhere else — that's the exact execution path the recent worm campaigns used.

This follows the existing pinning policy in AGENTS.md ("Dependency Pinning Policy") and extends it from version ceilings to publication age + script execution.

Related Issue

N/A — proactive supply-chain hardening, no single issue.

Type of Change

• 🔒 Security fix

Changes Made

Publication-age floors (new)

• .npmrc — new file: min-release-age=14 with per-package, individually commented exclusions
• pyproject.toml — [tool.uv] exclude-newer = "14 days", with exclude-newer-package opting out vercel / nemo-relay
• uv.lock — regenerated under the new constraint

Install-time script execution

• package.json — allowScripts allow-list; everything not named is denied

Python dependency bumps (pyproject.toml, uv.lock, tools/lazy_deps.py)

• Pillow 12.2.0 → 12.3.0 (kept in sync in tools/lazy_deps.py::tool.vision)
• mcp 1.26.0 → 1.28.1 ([mcp], [computer-use], [dev], and tools/lazy_deps.py::tool.computer_use)
• setuptools → 83.0.0, incl. [build-system] requires (torch >= 2.13 requires 83)
• pytest 9.0.2 → 9.1.1, pygments → 2.20.0, pyasn1 → 0.6.4, pydantic-settings → 2.14.2, msgpack → 1.2.1, httplib2 → 0.32.0, cbor2 → 6.1.3, tornado → 6.5.7
• pynacl → 1.6.2 via [tool.uv] override-dependencies — discord.py 2.7.1 pins pynacl<1.6 and 1.5.0 is vulnerable; upstream has the fix on main but no release yet, so we force the override with a comment to drop it after the next discord.py release

npm dependency bumps

• exact version pins across every workspace package.json (apps/desktop, apps/bootstrap-installer, apps/shared, ui-tui, ui-tui/packages/hermes-ink, web, tests-js, root) — no more caret ranges
• brace-expansion forced to 5.0.8 via root overrides
• package-lock.json regenerated

Toolchain

• nix/hermes-agent.nix + flake.lock — nodejs 22 → 26, nixpkgs bumped
• eslint.config.shared.mjs — drop eslint-plugin-react (its rules are already covered by react-hooks + the TS config; it was blocking the eslint 10 upgrade that carries the vuln fix). Call-site churn across apps/desktop/src/** is the resulting lint autofix.
• tests/tools/test_computer_use.py — follows the mcp version bump

How to Test

1. npm ci && npm audit — clean
2. uv lock --check — lock matches pyproject.toml under the new exclude-newer
3. nix develop -c scripts/run_tests.sh — Python suite green
4. nix develop -c npm run check — typecheck + lint + JS tests green
5. Sanity-check the guardrails actually bite: adding a dep published today should be refused by both npm install and uv lock unless it's on an exclusion list.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature
• I've run the test suite and all tests pass
• I've added tests for my changes — N/A, this is a dependency/config change; the existing suites are the regression surface
• I've tested on my platform: NixOS (Linux 7.1.0)

Documentation & Housekeeping

• I've updated relevant documentation — N/A; AGENTS.md's Dependency Pinning Policy still describes the pinning rules correctly. Happy to add a short "publication-age floor" paragraph there if reviewers want it documented.
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md / AGENTS.md — see above
• I've considered cross-platform impact — .npmrc / [tool.uv] are platform-neutral; exclude-newer-package explicitly opts out the platform-gated nemo-relay and vercel so non-Linux resolution isn't broken
• I've updated tool descriptions/schemas — N/A

Notes for the reviewer

The exclusion lists in .npmrc are deliberately verbose — one comment per entry stating the reason and the removal condition — because an undocumented exclusion is how a 14-day floor quietly becomes a 0-day floor. Please push back on any entry whose justification looks weak.

closes:

closes #72683
closes #72108
closes #50901
closes #43997
closes #68736
closes #73426
closes #50902
closes #51471
closes #60201
closes #73222
closes #69711
closes #68973
closes #63942
closes #73474
closes #73219
closes #72587
closes #73476
closes #73475
closes #72878
closes #69864
closes #73662
closes #73857
closes #66871
closes #63099
closes #68648
closes #65150
closes #68961
closes #65345
closes #61248
closes #70003
closes #51305
closes #54424
closes #50052
closes #47998

Issues that remain open and are NOT fixed here

• #60841 — the specific versions it names are fixed, but its actual complaint is structural: pip-audit --fix is transient because the next uv sync reverts to uv.lock. That's a workflow bug, untouched by this PR.
• #59998 — hermes update reports success while leaving vulnerable deps installed. Needs a post-update CVE signal; out of scope here.
• #5197 / #45041 / #46738 — recurring audit automation, Dependency Review gate, OSV coverage for bridge lockfiles. This PR fixes today's advisories; it does not stop tomorrow's from landing silently.
• #51212 / #51292 — container base-image CVEs. Different layer entirely.

---

Contributor attribution

This PR consolidates work from 24 contributors across the superseded PRs listed above.
Please use the block below verbatim in the squash-merge commit message so
each of them keeps authorship in git history.

Co-authored-by: Kingsley Wong <7207924+datanerdie@users.noreply.github.com>
Co-authored-by: viky <vikyw89@gmail.com>
Co-authored-by: FT_IOxCS <237263164+ft-ioxcs@users.noreply.github.com>
Co-authored-by: 方明元 <fmy3@qq.com>
Co-authored-by: Yorkstone Supplies <58149681+sycamoregroupltd@users.noreply.github.com>
Co-authored-by: Steven Cuz Leath <Steven.Leath@gmail.com>
Co-authored-by: Kyle French <248366920+Dadmin88@users.noreply.github.com>
Co-authored-by: Eugeniusz Gilewski <egilewski@egilewski.com>
Co-authored-by: Christopher Gara <79837758+christopherrobin88@users.noreply.github.com>
Co-authored-by: LironTTG <147833337+LironTTG@users.noreply.github.com>
Co-authored-by: Austin Porada <bbasketballer75@gmail.com>
Co-authored-by: cresslank <9219265+cresslank@users.noreply.github.com>
Co-authored-by: Ion Mudreac <mudreac@gmail.com>
Co-authored-by: martinramos002 <262243228+martinramos002-bot@users.noreply.github.com>
Co-authored-by: Sensie-Agents <agents@joinsensie.com>
Co-authored-by: alexwill87 <173086651+alexwill87@users.noreply.github.com>
Co-authored-by: BullishMomentum56 <218643122+BullishMomentum56@users.noreply.github.com>
Co-authored-by: pintadoai <240097310+pintadoai@users.noreply.github.com>
Co-authored-by: Alfred Sahlberg <dinmail@gmail.com>
Co-authored-by: liuhao1024 <sunsky.lau@gmail.com>
Co-authored-by: Richard Ham <richard.ham@live.com>
Co-authored-by: jrcrittenden <jrcrittenden@gmail.com>
Co-authored-by: 峯岸　亮 <1920071390@campus.ouj.ac.jp>
Co-authored-by: Marcus Martini <6473852+napoleonmm83@users.noreply.github.com>

Notes on how this list was built:

• One entry per human, de-duplicated: egilewski (fix(deps): secure Pillow across Linux installers (#72108) #73474, fix(deps): repair Google transitive security floors (#72108) #73475, fix(deps): enforce patched server dependency floors (#72108) #73476),
  mudrii (deps: raise vulnerable dependency floors #66871, fix(deps): enforce advisory-fixed optional dependency floors #63099), sycamoregroupltd (fix(deps): pin httplib2==0.32.0 across all 3 install paths (GHSA-j5g9-f88f-gfj3) #73222, fix: bump MCP security pin #73219) and
  bbasketballer75 (chore(deps): clear desktop npm advisories #69864, chore(deps): refresh safe transitive npm dependencies #73857) each contributed more than one PR.
• Excluded: dependabot[bot] (chore(deps): bump pyasn1 from 0.6.3 to 0.6.4 #68973 — bot, and its pyasn1 bump is
  credited via fix(deps): bump pyasn1 0.6.3 -> 0.6.4 (CVE-2026-59886) #69711), the various Claude/Cursor/Hermes Agent tooling
  identities that appear as commit co-authors, and Teknium (maintainer
  commits on contributor branches, not a contribution to credit here).
• Where a commit's author email was a non-routable local identity
  (builder@local, alfred@openclaw.local, omar-oa@agentmail.to), the
  contributor's canonical GitHub noreply address is used instead so the
  attribution actually resolves to their account.
• One to sanity-check: fix(security): update Pillow to 12.3.0 #63942 was opened by @DeployFaith (id 259692215)
  but its commit is authored by Kyle French <248366920+Dadmin88@…>, a
  different account. I credited the commit author. Say the word if you'd
  rather credit the PR opener.

contributors/emails/ mappings added

scripts/contributor_audit.py resolves Co-authored-by trailers through
contributors/emails/, so a plain-email co-author with no mapping drops out
of the generated release notes. Nine mappings were missing and are added in
this PR:

email	login
vikyw89@gmail.com	vikyw89
fmy3@qq.com	superafun
Steven.Leath@gmail.com	Leathal1
bbasketballer75@gmail.com	bbasketballer75
mudreac@gmail.com	mudrii
agents@joinsensie.com	Sensie-agents
dinmail@gmail.com	sahlbergalfred4-lgtm
richard.ham@live.com	zebadee2kk
jrcrittenden@gmail.com	jrcrittenden

egilewski@egilewski.com, sunsky.lau@gmail.com and
1920071390@campus.ouj.ac.jp were already mapped. Every other co-author uses
a GitHub id+login noreply address, which auto-resolves and needs no file.
tests/scripts/test_contributor_map.py passes (7/7).

Newly added to the closes: list

• Security: Fix 36 vulnerabilities in dependencies #54424 (@napoleonmm83) — "Security: Fix 36 vulnerabilities in dependencies"
• fix(security): bump dependencies to resolve 25 CVEs (7 HIGH, 9 MODERATE, 9 LOW) #50052 (@zebadee2kk) — "bump dependencies to resolve 25 CVEs"
• security(deps): clear June 2026 Dependabot CVE batch #47998 (@zapabob) — "clear June 2026 Dependabot CVE batch" (note: security(deps): clear June 2026 Dependabot batch (starlette, tornado, cryptography, dompurify, opentelemetry) #47997 is
  the issue; the PR is security(deps): clear June 2026 Dependabot CVE batch #47998)

Deliberately NOT closed: #28749

#28749 (@jrcrittenden)
gates release age at hermes update time for installed users via
security.minimum_release_age_days. This PR only puts a floor on installs
from the repo. The two are orthogonal — repo-side floor plus user-side gate —
and #28749 should stay open and land on its own. Its author is credited above
because the idea overlaps, not because this supersedes it.

[github-actions]

૮ >ﻌ< ა ci review

_{ran on bc49e98}

ℹ️ Info

CI-sensitive file review · View job

PR touches sensitive files, but the ci-reviewed label has been added, approving them.

Sensitive files changed:

• eslint.config.shared.mjs

---

Desktop E2E visual evidence · View test artifacts · View job

2 visual diffs.

_{inline evidence is publishing...}

[teknium1]

Reviewed the full diff (72 files, 23 commits) plus CI. This is exactly the direction we want: it extends the AGENTS.md Dependency Pinning Policy from version ceilings to publication age + install-script execution, which addresses the actual mechanics of the recent worm campaigns rather than just today's advisory list.

What I checked:

• Python pins — all 12 bumps land on the fixed releases; mcp kept in sync across [mcp], [computer-use], [dev], tools/lazy_deps.py, and the test_computer_use.py fixture. The pynacl 1.6.2 override-dependencies escape hatch for discord.py's <1.6 pin is the right call and clearly commented for removal after the next discord.py release.
• Age floors — .npmrc min-release-age=14 + [tool.uv] exclude-newer = "14 days", with every exclusion individually commented with its removal condition. That per-entry "remove when X is >2wks old" discipline is what keeps a 14-day floor from silently decaying to 0 — appreciated.
• allowScripts — allow-list covers exactly the packages that legitimately need lifecycle scripts (esbuild, node-pty, electron, electron-winstaller, agent-browser, fsevents; core-js on the website side). This closes the install-script execution path outright.
• CI — full 48-check matrix green: uv lock --check, both Docker builds, every JS workspace check, Python suite, Desktop E2E. Mergeable against current main despite the fast-moving base.

Minor notes (non-blocking):

1. Commit d670c89a00 says "update mcp to 1.29.0" but the final state consistently pins 1.28.1 — cosmetic, the tree is self-consistent.
2. The nodejs 22→26 nix bump and the eslint-plugin-react removal widen the blast radius beyond pure pin bumps, but both are load-bearing (eslint 10 carries the vuln fix; the plugin was blocking it) and the resulting lint churn is mechanical autofix, verified by the green desktop/web check jobs.
3. The "NOT fixed here" section at the bottom is genuinely useful triage — #60841's uv sync revert problem and #59998's post-update CVE signal are real follow-ups worth their own PRs.

This supersedes a cluster of open dupes (#50902, #51471, #72878, #73703, #48816) — we'll close those with credit once this lands.

Approving. Thanks Ari — this is thorough, well-documented work.

[ethernet8023]

updated to fix the mcp commit message, and added an important feature to HA to ensure the version of NPM we use can work with the publication-age floor.

[teknium1]

Re-reviewed the two new commits. Both look right — and nice catch on the npm 11.10–12.0 gap.

3975e9d7 — engine gate. npm 11.10–12.0 enforcing min-release-age while silently ignoring min-release-age-exclude[] is exactly the failure mode that would make this policy worse than no policy: the floor half-applies and every documented exception (react-router, eslint 10, vite 8.2…) hard-fails with no explanation. engine-strict=true + engines.npm: "<11.10.0 || >=12.0.0" refuses the broken range up front in both trees. Correct fix, correctly placed.

e803c5ae — EBADENGINE self-heal. This handles the fallout #1 creates for Hermes-managed installs sitting on npm 11.10.x, and the design choices are the ones I'd want:

• Reacting to the failure instead of predicting it — no npm --version probe or semver matcher on the happy path; the recovery reads the Required: range straight out of npm's own error output.
• Scope discipline: upgrades only an npm inside $HERMES_HOME/node (with --prefix so the managed tree upgrades in place rather than landing a second npm at the prefix=~/.local from node/etc/npmrc); system/nvm/brew/Nix npm gets the exact manual command and the original failure stands. Symlink resolution in managed_npm_prefix covers all three spellings of the managed npm.
• The stderr tee in _run_npm_watching_for_engine_failure — the capture_output=False desktop path would otherwise hand the recovery stderr=None with nothing to parse. Live output unchanged, text retained.
• Both npm call sites wired (_run_npm_install_deterministic and the TUI install path), one retry max, False on every non-managed/non-npm/Node-mismatch case.

One noted tension, acceptable: the self-upgrade runs with npm_config_min_release_age=0 from a temp cwd — necessary, since the age floor would refuse the very npm release the repair needs. It's scoped to the single npm@<range> install and nothing else.

17 new tests + the E2E verification against real npm binaries in both directions (managed 11.10.0 → upgraded → retry green; foreign 11.10.0 → manual command, untouched) is exactly the standard we want for this kind of recovery path.

Approving. Merge once the new head's CI is green.