fix(deps): resolve Dependabot alerts - #6
Conversation
🔎 Lint report:
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0a525e7729
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| messaging = ["python-telegram-bot[webhooks]==22.6", "discord.py[voice]==2.7.1", "aiohttp==3.14.0", "brotlicffi==1.2.0.1", "slack-bolt==1.27.0", "slack-sdk==3.40.1", "qrcode==7.4.2"] | ||
| cron = [] # croniter is now a core dependency; this extra kept for back-compat | ||
| slack = ["slack-bolt==1.27.0", "slack-sdk==3.40.1", "aiohttp==3.13.3"] | ||
| slack = ["slack-bolt==1.27.0", "slack-sdk==3.40.1", "aiohttp==3.14.0"] |
There was a problem hiding this comment.
For Slack gateway users who rely on the normal lazy-install path rather than installing the [slack] extra, this bump is bypassed: tools/lazy_deps.py:130-133 still installs aiohttp==3.13.4 for platform.slack. Since the dependency policy above [all] says opt-in messaging backends resolve through LAZY_DEPS at first use, the Dependabot fix to aiohttp==3.14.0 does not actually reach that production Slack path unless the lazy pin is updated too.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in PR #25 (fix(deps): align lazy pins with audited extras + guard Discord voice) — platform.slack lazy pin was updated from aiohttp==3.13.4 to aiohttp==3.14.1 so the first-use and hermes update paths install the audited version.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
| dev = ["debugpy==1.8.20", "pytest==9.0.2", "pytest-asyncio==1.3.0", "pytest-timeout==2.4.0", "mcp==1.26.0", "ty==0.0.21", "ruff==0.15.10"] | ||
| messaging = ["python-telegram-bot[webhooks]==22.6", "discord.py[voice]==2.7.1", "aiohttp==3.13.3", "brotlicffi==1.2.0.1", "slack-bolt==1.27.0", "slack-sdk==3.40.1", "qrcode==7.4.2"] | ||
| dev = ["debugpy==1.8.20", "pytest==9.0.3", "pytest-asyncio==1.3.0", "pytest-timeout==2.4.0", "mcp==1.26.0", "ty==0.0.21", "ruff==0.15.10"] | ||
| messaging = ["python-telegram-bot[webhooks]==22.6", "discord.py[voice]==2.7.1", "aiohttp==3.14.0", "brotlicffi==1.2.0.1", "slack-bolt==1.27.0", "slack-sdk==3.40.1", "qrcode==7.4.2"] |
There was a problem hiding this comment.
For Discord gateway installs that use check_discord_requirements()'s lazy path, this audited aiohttp==3.14.0 pin is not applied because tools/lazy_deps.py:129 only ensures discord.py[voice] and brotlicffi. discord.py uses aiohttp transitively, so users who previously lazy-installed Discord can keep an older vulnerable aiohttp while hermes update considers platform.discord satisfied; add the same audited aiohttp pin to the Discord lazy spec so the messaging extra and first-use install path stay aligned.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in PR #25 (fix(deps): align lazy pins with audited extras + guard Discord voice) — aiohttp==3.14.1 was added to the platform.discord lazy spec so the Discord lazy install path gets the same audited version.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
| { url = "https://files.pythonhosted.org/packages/88/6d/e43452347630efe8133f5304127539100d937c138c0996d27ec63963ec2c/cbor2-5.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:b51c5e59becae746ca4de2bbaa8a2f5c64a68fec05cea62941b1a84a8335f7d1", size = 71657, upload-time = "2025-12-30T18:44:10.162Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/8b/66/9a780ef34ab10a0437666232e885378cdd5f60197b1b5e61a62499e5a10a/cbor2-5.8.0-cp314-cp314-win_arm64.whl", hash = "sha256:53b630f4db4b9f477ad84077283dd17ecf9894738aa17ef4938c369958e02a71", size = 67171, upload-time = "2025-12-30T18:44:11.619Z" }, | ||
| { url = "https://files.pythonhosted.org/packages/d6/4f/101071f880b4da05771128c0b89f41e334cff044dee05fb013c8f4be661c/cbor2-5.8.0-py3-none-any.whl", hash = "sha256:3727d80f539567b03a7aa11890e57798c67092c38df9e6c23abb059e0f65069c", size = 24374, upload-time = "2025-12-30T18:44:21.476Z" }, | ||
| version = "6.1.2" |
There was a problem hiding this comment.
This lockfile bump only protects installs that resolve from uv.lock; users who already lazy-installed the Modal or Vercel terminal backend keep their old cbor2 because tools/lazy_deps.py:153-155 checks only modal==1.3.4 / vercel==0.5.7 before deciding the feature is satisfied. Since both locked backends pull cbor2 transitively, add the audited cbor2==6.1.2 pin to those lazy specs so hermes update refreshes the vulnerable transitive package too.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in PR #25 (fix(deps): align lazy pins with audited extras + guard Discord voice) — cbor2==6.1.2 was added to both terminal.modal and terminal.vercel lazy specs so hermes update refreshes the transitive package to the audited version.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
| [[package]] | ||
| name = "starlette" | ||
| version = "0.52.1" | ||
| version = "1.2.1" |
There was a problem hiding this comment.
For users who first installed the dashboard through its lazy path, this Starlette upgrade will not be applied: tools/lazy_deps.py:169-172 only verifies fastapi==0.133.1 and uvicorn[standard]==0.41.0, so an existing vulnerable starlette can remain installed while the dashboard feature is considered satisfied. Pin the audited Starlette version in tool.dashboard as well, matching the lockfile resolution that FastAPI uses here.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in PR #25 (fix(deps): align lazy pins with audited extras + guard Discord voice) — starlette==1.3.1 was added to the tool.dashboard lazy spec, matching the lockfile resolution that FastAPI pulls, so the dashboard lazy path no longer leaves a vulnerable Starlette installed.
Reviewed and confirmed by Claude Code.
Generated by Claude Code
…(Codex PR #6, #10) (#25) Addresses chatgpt-codex-connector review comments on merged PRs #6 and #10. tools/lazy_deps.py (PR #6 — lazy install pins stale after Dependabot audit): - platform.slack: aiohttp 3.13.4 -> 3.14.1 (match [slack] extra) - platform.discord: add aiohttp==3.14.1 (discord.py uses aiohttp transitively; without the pin, a first-use lazy install can leave an older vulnerable aiohttp while `hermes update` considers the feature satisfied) - terminal.modal / terminal.vercel: add cbor2==6.1.2 (both backends pull cbor2 transitively; pin the audited version so existing installs refresh the vulnerable transitive package) - tool.dashboard: add starlette==1.3.1 (FastAPI pulls starlette transitively; same rationale as above) plugins/platforms/discord/adapter.py (PR #10 — voice extra no longer ships PyNaCl): - join_voice_channel now checks for PyNaCl availability before calling channel.connect(). The `voice` extra was intentionally stripped of PyNaCl (it pinned a vulnerable version and triggered Dependabot), but /voice join was still registered and would crash at runtime with an opaque missing-module error. The guard fails fast with a logged warning instructing the user to install PyNaCl>=1.6.2 manually. tests/gateway/test_discord_race_polish.py: - Added test_join_voice_returns_false_when_pynacl_missing (verifies the guard fires before channel.connect()) - Added test_join_voice_proceeds_when_pynacl_available (pins the happy path so the guard is confirmed as the regression boundary) - Updated test_concurrent_joins_do_not_double_connect to mock nacl via patch.dict (prevents sys.modules leakage into other test files) PR #3 website comments already fixed in main: serialize-javascript override is at 7.0.5, all @docusaurus/* packages aligned at 3.10.1. Verification: pytest tests/gateway/test_discord_race_polish.py tests/tools/test_lazy_deps.py tests/test_package_json_lazy_deps.py tests/tools/test_discord_tool.py (157 passed, 2 pre-existing warnings).
1 participant
Summary
Verification