Security: Remove pinned cryptography version 46.0.7

[wallygatorek]

Summary

The cryptography==46.0.7 pin in hermes-agent 0.18.x prevents security updates for a known HIGH vulnerability (GHSA-537c-gmf6-5ccf).

Vulnerability Details

• Package: cryptography
• Installed version: 46.0.7
• Fixed version: 48.0.1+
• GHSA: GHSA-537c-gmf6-5ccf
• Issue: Vulnerable OpenSSL included in cryptography wheels

Current State

Requires-Dist: cryptography==46.0.7

This causes:

1. Security vulnerability - exploitation via vulnerable bundled OpenSSL
2. Dependency conflicts - pyOpenSSL requires cryptography>=49.0.0 for secure versions

Workaround

Manually upgrading pyOpenSSL to 26.3.0 pulls in cryptography==49.0.0, but this reverts after pipx reinstall hermes-agent.

Proposed Fix

Change to flexible constraint:

Requires-Dist: cryptography>=46.0.7,<50

This allows security updates while maintaining compatibility.

Environment

• hermes-agent: 0.18.2
• Python: 3.12.3

[GottZ]

This was generated by AI during triage.

Summary

Two PRs address #61098; both ultimately change the manifest and lockfile from cryptography 46.0.7 to the advisory-fixed exact pin 48.0.1, removing the vulnerable bundled OpenSSL while preserving the repository's reviewed-pin policy.

Related pull requests

• fix(deps): unpin cryptography to allow GHSA-537c-gmf6-5ccf security patches #61105 [closed] fixes — (+60/-42) — fixes, but superseded by merged fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32) #72362: the complete diff updates both pyproject.toml and uv.lock to cryptography==48.0.1. Despite the earlier keep_open review on fix(deps): unpin cryptography to allow GHSA-537c-gmf6-5ccf security patches #61105, keeping it closed is appropriate because the contributor later confirmed that fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32) #72362 landed the same security fix with lockstep lockfile changes and a CI floor guard.
• chore(security): raise cryptography OpenSSL floor #64879 [closed] best fix — (+41/-41) — best fix among the triaged PRs, but superseded by merged fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32) #72362: its final diff addresses the contributor's keep_open objection by exact-pinning cryptography==48.0.1 in both pyproject.toml and uv.lock. Despite the keep_open review on chore(security): raise cryptography OpenSSL floor #64879, it should remain closed rather than be reopened because fix(deps): move CVE pins to current fixed versions (cryptography 48.0.1, starlette 1.3.1, python-multipart 0.0.32) #72362 already merged the equivalent fix plus a regression guard.

Duplicates

#61105 and #64879 converge on substantially the same manifest-and-lock update to cryptography==48.0.1; both are also superseded by merged #72362.

Suggested consolidation

Do not merge or reopen #64879: although Verify selected it as the best fix among #61105 and #64879, merged #72362 already implements the same exact 48.0.1 manifest-and-lock correction and adds a CI floor guard. Keep #61105 and #64879 closed as duplicate/superseded implementations, and close #61098 as resolved by #72362.

Complex graph

flowchart LR
    classDef open fill:#dbeafe,stroke:#1d4ed8,color:#1e3a8a
    classDef merged fill:#dcfce7,stroke:#15803d,color:#14532d
    classDef closed fill:#e5e7eb,stroke:#6b7280,color:#1f2937
    classDef unverified fill:#f3f4f6,stroke:#9ca3af,color:#374151
    classDef best stroke-width:3px,stroke:#b45309
    classDef target stroke-width:3px,stroke:#4338ca
    I61098(["issue #61098 (open)"])
    subgraph Dup61105 ["PRs duplicating each other"]
        P61105["PR #61105 (closed)"]
        P64879["PR #64879 (closed)"]
    end
    P61105 -->|fixes| I61098
    P64879 -->|best fix| I61098
    class I61098 open
    class I61098 target
    class P61105 closed
    class P64879 closed
    class P64879 best
    click I61098 "https://github.com/NousResearch/hermes-agent/issues/61098"
    click P61105 "https://github.com/NousResearch/hermes-agent/pull/61105"
    click P64879 "https://github.com/NousResearch/hermes-agent/pull/64879"

Loading

Graph: solid arrow = fixes / best fix, dashed arrow = partial or unverified (see edge label); boxed group = PRs duplicating each other; amber border = best fix; indigo border = target; gray node = closed or no verify verdict yet (state tag in the node label).

Cross-PR triage: Reviewed 2 pull requests and 1 issue in this complex. Each diff was read against this issue; Assessment working set: 54 kB of PR diffs, 7 kB of issue/PR text, 3 kB of discussion (5 comments), 4 verify verdicts. verdicts reflect diff content, not PR titles. Part of an automated triage batch.