Skip to content

Relax openai/requests floors to Hermes core pins - #11

Open
teknium1 wants to merge 1 commit into
lancedb:mainfrom
teknium1:fix/relax-core-pins
Open

teknium1 wants to merge 1 commit into
lancedb:mainfrom
teknium1:fix/relax-core-pins

Conversation

@teknium1

Copy link
Copy Markdown

Hermes pins requests==2.33.0 (CVE-2026-25645) and openai==2.24.0. With NousResearch/hermes-agent#113851 Hermes installs plugin pyproject dependencies automatically under its core pins and refuses unresolvable candidates, so the current floors (requests>=2.34.2, openai>=2.38.0) would make the catalog install of this plugin fail with a conflict. This relaxes both floors to versions Hermes actually ships; verified the plugin's requirement set resolves against Hermes' constraints with these values.

Hermes pins requests==2.33.0 (CVE-2026-25645 pin) and openai==2.24.0. Hermes is
adding automatic installation of plugin pyproject dependencies under those core
pins (NousResearch/hermes-agent#113851); with the previous floors the lancedb
plugin would be refused at install time as unresolvable. Both APIs the plugin
uses exist at the relaxed floors.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant