fix(security): update sandbox Python dependencies

[senthilr-nv]

Summary

Updates the Python dependency baselines used by the Hermes and Deep Agents Code sandbox images. Hermes now selects cryptography 48.0.1, Pillow 12.3.0, and Starlette 1.3.1 through a coherent source-metadata and frozen-lock patch; Deep Agents Code now selects Pillow 12.3.0 through its reviewed hash lock.

Changes

• Apply a reviewed patch to the checksum-pinned Hermes v2026.7.20 source before frozen installation, updating pyproject.toml and uv.lock together.
• Regenerate the Deep Agents Code requirements lock with Pillow 12.3.0 and complete artifact hashes.
• Fail image builds when dependency consistency or installed target versions drift.
• Update dependency review records with current advisory, artifact, license, compatibility, and residual-risk evidence.
• Add repository contracts for the patch boundary and installed-version gates.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Codex security review passed for injection, authorization, credentials, command execution, filesystem, network, resource exhaustion, supply chain, and data exposure. The review records unrelated point-in-time advisory residuals without treating them as remediated by this scoped change.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/security/hermes-0.19.0-dependency-review.md; agents/langchain-deepagents-code/dependency-review.md; follow-up review confirmed the sentence-per-line reflow changes no wording, evidence, or security conclusion.
• Agent: /root/documentation_writer_review

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — all change-specific hooks passed; the current main source-architecture check independently reports the stale shell-quote.ts fan-in budget (26 measured against limit 27).
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 24 repository contract tests; 324 focused upstream Hermes tests with 1 skipped; exact Hermes and Deep Agents environments pass dependency consistency and installed-version checks.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable; the dependency image paths are covered by exact-lock installs, focused upstream compatibility tests, and CI image builds.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

Summary by CodeRabbit

• Security

  • Updated bundled Python dependency pins (Cryptography, Pillow, Starlette) for reviewed Hermes 0.19.0 and Deep Agents Code images.
  • Strengthened build-time integrity checks to fail fast on dependency drift, including automated dependency consistency verification and exact-version assertions.

• Documentation

  • Refreshed the Hermes 0.19.0 dependency-review advisory with updated transaction-based remediation details and audit metadata.

• Bug Fixes

  • Aligned lockfile and installed dependency versions to ensure advisory outcomes match actual image contents.

• Tests

  • Expanded coverage to validate the new pinned versions and remediation records, and updated relevant workflow re-run triggers.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 737f8665-9c5f-48d2-90e7-9050d4a4f13e

📥 Commits

Reviewing files that changed from the base of the PR and between 02b7e2a and 0b5293c.

📒 Files selected for processing (2)

• .github/workflows/base-image.yaml
• test/hermes-share-mount-deps.test.ts

---

📝 Walkthrough

Walkthrough

Hermes applies a verified dependency patch and validates installed package versions. Deep Agents pins and verifies Pillow 12.3.0. Lockfiles, dependency reviews, workflow triggers, and tests reflect the updated dependency resolutions and audit records.

Changes

Dependency hardening

Layer / File(s)	Summary
Hermes dependency selections agents/hermes/security-dependencies.patch	Updates Hermes dependency constraints, lockfile metadata, transitive resolutions, and exact pins for cryptography, Pillow, and Starlette.
Hermes build enforcement agents/hermes/Dockerfile.base, docs/security/..., .github/workflows/base-image.yaml, test/hermes-dependency-review.test.ts, test/hermes-share-mount-deps.test.ts	Copies and applies the dependency patch during image construction, runs uv pip check and version assertions, updates workflow triggers and review tests, and extends the dependency-install test mock.
Deep Agents Pillow validation agents/langchain-deepagents-code/..., test/langchain-deepagents-code-image.test.ts	Pins Pillow 12.3.0, runs pip3 check and an isolated version assertion, and updates audit documentation and tests.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DockerfileBase
  participant SecurityPatch
  participant HermesInstall
  participant UvEnvironment
  DockerfileBase->>SecurityPatch: Copy security-dependencies.patch
  DockerfileBase->>HermesInstall: Apply patch after git apply --check
  HermesInstall-->>DockerfileBase: Update /opt/hermes dependencies
  DockerfileBase->>UvEnvironment: Run uv pip check and version assertions

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7771: Updates the related Hermes version upgrade, dependency-review artifacts, and test expectations.

Suggested labels: area: docs

Suggested reviewers: apurvvkumaria, ericksoa, jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the PR’s main change: updating sandbox Python dependencies for security.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Review the warnings below.
Findings: 0 blockers · 1 warning · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 1 warning · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 fewer warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, security-posture, ubuntu-repo-cloud-langchain-deepagents-code

1 warning · 0 suggestions

Warnings

Warnings do not block.

PRA-1 Warning — Test the Hermes patch-application failure path

• Location: agents/hermes/Dockerfile.base:372
• Category: tests
• Problem: The new image build applies a repository-supplied patch to the extracted Hermes archive, but the changed tests only assert that Dockerfile and patch strings exist. They do not execute the patch-application layer against either the reviewed source shape or a mismatched patch.
• Impact: A future patch or upstream archive change can make the build guard fail or alter patch application without a focused regression test identifying the boundary.
• Recommendation: Add a focused fixture test that runs the extracted archive-and-patch layer, asserts the reviewed patch applies, and asserts a deliberately mismatched patch stops before dependency installation.
• Verification: Inspect test/hermes-dependency-review.test.ts and test/hermes-share-mount-deps.test.ts for a fixture that invokes `git apply --check` on the Dockerfile patch layer.
• Test coverage: Run the extracted Hermes archive-and-patch build layer in a fixture repository; verify the reviewed patch applies and a mismatched patch exits before `uv sync`.
• Evidence: agents/hermes/Dockerfile.base:372-378 runs `git -C /opt/hermes apply --check` and `git -C /opt/hermes apply`. test/hermes-dependency-review.test.ts:84-98 checks only that patch, guard, and version strings are present. test/hermes-share-mount-deps.test.ts mocks the later install layer and its `uv` and Python commands.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/hermes-0.19.0-dependency-review.md`:
- Around line 18-24: Reflow the changed paragraphs in
docs/security/hermes-0.19.0-dependency-review.md so each complete sentence
occupies a single source line. Apply this consistently to the paragraphs around
the selected Python graph, lines 147-172, and lines 224-225, without changing
their wording or content.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c159ac79-e354-40e3-aba4-2be780571554

📥 Commits

Reviewing files that changed from the base of the PR and between 3aea38c and 7eeb9b4.

⛔ Files ignored due to path filters (1)

• agents/langchain-deepagents-code/requirements.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

• agents/hermes/Dockerfile.base
• agents/hermes/security-dependencies.patch
• agents/langchain-deepagents-code/Dockerfile.base
• agents/langchain-deepagents-code/dependency-review.md
• agents/langchain-deepagents-code/requirements.in
• docs/security/hermes-0.19.0-dependency-review.md
• test/hermes-dependency-review.test.ts
• test/langchain-deepagents-code-image.test.ts

[senthilr-nv]

Addressed the two PR-caused failures in 0b5293c1bd5c918f0c6bda10933e90b52a2fe537.

• The Hermes install-layer fixture now materializes the .venv/bin/python produced by its mocked uv sync, resolving the seven shard-1 failures.
• agents/hermes/security-dependencies.patch is now included in the base-image publisher trigger paths, resolving the shard-2 workflow contract failure.
• The exact focused contracts pass 18/18 locally.

The static check and shard-7 shell-quote.ts fan-in ratchet reproduce on current main and are unrelated to this PR.
Fresh exact-head CI is running; the obsolete failed run does not need a retry.