3bc953a666
* fix(security): bump dependencies to fix 7 CVEs Python (pyproject.toml): - requests >=2.33.0: CVE-2026-25645 - PyJWT >=2.12.0: CVE-2026-32597 Transitive Python CVEs (require lock file or upstream fix): - cbor2 5.8.0: CVE-2026-26209 (via modal) - pygments 2.19.2: CVE-2026-4539 (via rich) - pynacl 1.5.0: CVE-2025-69277 (via discord.py) NPM (package-lock.json via npm audit fix): - basic-ftp: CRITICAL path traversal (GHSA-5rq4-664w-9x2c) - fast-xml-parser: HIGH stack overflow + entity expansion - undici: HIGH CRLF injection, memory DoS, smuggling - minimatch: HIGH ReDoS Remaining: lodash moderate prototype pollution in @appium/logger (upstream fix needed). * chore: regenerate uv.lock for CVE version bumps uv lock after requests >=2.33.0 and PyJWT >=2.12.0 minimum bumps. Without this, uv sync --locked fails because the old lock pinned requests==2.32.5 and pyjwt==2.11.0 (below new minimums). --------- Co-authored-by: 0xbyt4 <35742124+0xbyt4@users.noreply.github.com>
104 lines
3.4 KiB
TOML
104 lines
3.4 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "hermes-agent"
|
|
version = "0.4.0"
|
|
description = "The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
authors = [{ name = "Nous Research" }]
|
|
license = { text = "MIT" }
|
|
dependencies = [
|
|
# Core — pinned to known-good ranges to limit supply chain attack surface
|
|
"openai>=2.21.0,<3",
|
|
"anthropic>=0.39.0,<1",
|
|
"python-dotenv>=1.2.1,<2",
|
|
"fire>=0.7.1,<1",
|
|
"httpx>=0.28.1,<1",
|
|
"rich>=14.3.3,<15",
|
|
"tenacity>=9.1.4,<10",
|
|
"pyyaml>=6.0.2,<7",
|
|
"requests>=2.33.0,<3", # CVE-2026-25645
|
|
"jinja2>=3.1.5,<4",
|
|
"pydantic>=2.12.5,<3",
|
|
# Interactive CLI (prompt_toolkit is used directly by cli.py)
|
|
"prompt_toolkit>=3.0.52,<4",
|
|
# Tools
|
|
"firecrawl-py>=4.16.0,<5",
|
|
"parallel-web>=0.4.2,<1",
|
|
"fal-client>=0.13.1,<1",
|
|
# Text-to-speech (Edge TTS is free, no API key needed)
|
|
"edge-tts>=7.2.7,<8",
|
|
"faster-whisper>=1.0.0,<2",
|
|
# Skills Hub (GitHub App JWT auth — optional, only needed for bot identity)
|
|
"PyJWT[crypto]>=2.12.0,<3", # CVE-2026-32597
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
modal = ["swe-rex[modal]>=1.4.0,<2"]
|
|
daytona = ["daytona>=0.148.0,<1"]
|
|
dev = ["pytest>=9.0.2,<10", "pytest-asyncio>=1.3.0,<2", "pytest-xdist>=3.0,<4", "mcp>=1.2.0,<2"]
|
|
messaging = ["python-telegram-bot>=22.6,<23", "discord.py[voice]>=2.7.1,<3", "aiohttp>=3.13.3,<4", "slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
|
|
cron = ["croniter>=6.0.0,<7"]
|
|
slack = ["slack-bolt>=1.18.0,<2", "slack-sdk>=3.27.0,<4"]
|
|
matrix = ["matrix-nio[e2e]>=0.24.0,<1"]
|
|
cli = ["simple-term-menu>=1.0,<2"]
|
|
tts-premium = ["elevenlabs>=1.0,<2"]
|
|
voice = ["sounddevice>=0.4.6,<1", "numpy>=1.24.0,<3"]
|
|
pty = [
|
|
"ptyprocess>=0.7.0,<1; sys_platform != 'win32'",
|
|
"pywinpty>=2.0.0,<3; sys_platform == 'win32'",
|
|
]
|
|
honcho = ["honcho-ai>=2.0.1,<3"]
|
|
mcp = ["mcp>=1.2.0,<2"]
|
|
homeassistant = ["aiohttp>=3.9.0,<4"]
|
|
sms = ["aiohttp>=3.9.0,<4"]
|
|
acp = ["agent-client-protocol>=0.8.1,<1.0"]
|
|
dingtalk = ["dingtalk-stream>=0.1.0,<1"]
|
|
rl = [
|
|
"atroposlib @ git+https://github.com/NousResearch/atropos.git",
|
|
"tinker @ git+https://github.com/thinking-machines-lab/tinker.git",
|
|
"fastapi>=0.104.0,<1",
|
|
"uvicorn[standard]>=0.24.0,<1",
|
|
"wandb>=0.15.0,<1",
|
|
]
|
|
yc-bench = ["yc-bench @ git+https://github.com/collinear-ai/yc-bench.git ; python_version >= '3.12'"]
|
|
all = [
|
|
"hermes-agent[modal]",
|
|
"hermes-agent[daytona]",
|
|
"hermes-agent[messaging]",
|
|
"hermes-agent[cron]",
|
|
"hermes-agent[cli]",
|
|
"hermes-agent[dev]",
|
|
"hermes-agent[tts-premium]",
|
|
"hermes-agent[slack]",
|
|
"hermes-agent[pty]",
|
|
"hermes-agent[honcho]",
|
|
"hermes-agent[mcp]",
|
|
"hermes-agent[homeassistant]",
|
|
"hermes-agent[sms]",
|
|
"hermes-agent[acp]",
|
|
"hermes-agent[voice]",
|
|
"hermes-agent[dingtalk]",
|
|
]
|
|
|
|
[project.scripts]
|
|
hermes = "hermes_cli.main:main"
|
|
hermes-agent = "run_agent:main"
|
|
hermes-acp = "acp_adapter.entry:main"
|
|
|
|
[tool.setuptools]
|
|
py-modules = ["run_agent", "model_tools", "toolsets", "batch_runner", "trajectory_compressor", "toolset_distributions", "cli", "hermes_constants", "hermes_state", "hermes_time", "rl_cli", "utils"]
|
|
|
|
[tool.setuptools.packages.find]
|
|
include = ["agent", "tools", "tools.*", "hermes_cli", "gateway", "gateway.*", "cron", "honcho_integration", "acp_adapter"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
markers = [
|
|
"integration: marks tests requiring external services (API keys, Modal, etc.)",
|
|
]
|
|
addopts = "-m 'not integration' -n auto"
|