hermes doctor reports 15 high-severity npm advisories in the bundled web/ and ui-tui/ workspaces on a clean install of v2026.7.20 (upstream 2e9559ad). hermes doctor --fix reports them but does not resolve them.
Most are dev tooling and low urgency, but one is a runtime dependency and seems worth separating out.
The runtime one
web/package.json depends on react-router-dom@^7.17.0, which resolves inside the vulnerable range for:
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response — high
Vulnerable range is 7.12.0 - 8.2.0. npm audit only offers a downgrade to 7.11.0 (flagged isSemVerMajor), so moving forward means >= 8.3.0.
This only bites if RSC mode is actually in use — but since it's a declared runtime dependency rather than tooling, it's the one that looked worth raising rather than absorbing locally.
The rest (dev tooling)
web/ — 8 high: @eslint/config-array, @eslint/eslintrc, brace-expansion, eslint, minimatch, postcss, plus the two react-router entries above.
ui-tui/ — 7 high: @eslint/config-array, @eslint/eslintrc, brace-expansion, eslint, eslint-plugin-react, minimatch, postcss.
Representative advisories: brace-expansion DoS via unbounded expansion length; postcss path traversal in previous-source-map auto-loading.
Why I'm reporting rather than patching
Neither workspace ships a lockfile, and both package.json files are tracked in the repo — so a local fix is both unpinned and reverted by the next hermes update. Upstream looks like the only place a fix would persist.
Happy to open a PR adding overrides for the dev-tooling set if that's a direction you'd take; the react-router bump is a bigger call and I didn't want to presume.
Environment: macOS 27.0.0, Python venv install at ~/.hermes/hermes-agent, hermes --version → v0.19.0 (2026.7.20) · upstream 2e9559ad.
hermes doctorreports 15 high-severity npm advisories in the bundledweb/andui-tui/workspaces on a clean install of v2026.7.20 (upstream2e9559ad).hermes doctor --fixreports them but does not resolve them.Most are dev tooling and low urgency, but one is a runtime dependency and seems worth separating out.
The runtime one
web/package.jsondepends onreact-router-dom@^7.17.0, which resolves inside the vulnerable range for:Vulnerable range is
7.12.0 - 8.2.0.npm auditonly offers a downgrade to 7.11.0 (flaggedisSemVerMajor), so moving forward means>= 8.3.0.This only bites if RSC mode is actually in use — but since it's a declared runtime dependency rather than tooling, it's the one that looked worth raising rather than absorbing locally.
The rest (dev tooling)
web/— 8 high:@eslint/config-array,@eslint/eslintrc,brace-expansion,eslint,minimatch,postcss, plus the two react-router entries above.ui-tui/— 7 high:@eslint/config-array,@eslint/eslintrc,brace-expansion,eslint,eslint-plugin-react,minimatch,postcss.Representative advisories:
brace-expansionDoS via unbounded expansion length;postcsspath traversal in previous-source-map auto-loading.Why I'm reporting rather than patching
Neither workspace ships a lockfile, and both
package.jsonfiles are tracked in the repo — so a local fix is both unpinned and reverted by the nexthermes update. Upstream looks like the only place a fix would persist.Happy to open a PR adding
overridesfor the dev-tooling set if that's a direction you'd take; the react-router bump is a bigger call and I didn't want to presume.Environment: macOS 27.0.0, Python venv install at
~/.hermes/hermes-agent,hermes --version→v0.19.0 (2026.7.20) · upstream 2e9559ad.