The 7-day uv gate released cryptography 50.0.0, so the lock pin moves - #218
Merged
Merged
Conversation
GHSA-g6cj-pr64-35w5 (HIGH) affects cryptography 49.0.0, which clients/hermes takes transitively through pyjwt[crypto] under mcp. The fix waited on clients/hermes/pyproject.toml [tool.uv] exclude-newer = "7 days". cryptography 50.0.0 published 2026-07-31T14:23Z, so the gate held it until 2026-08-07 15:23 BST. The gate is now clear and a plain uv lock --upgrade-package moves it. uv exits 0 and prints "No lockfile changes detected" when the gate holds a version, so the exit code is not evidence. The diff is: one hunk, one package, version 49.0.0 -> 50.0.0. Closes comms-6g1n.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-g6cj-pr64-35w5 (HIGH) in
clients/hermes.cryptography49.0.0 -> 50.0.0 in
uv.lock. The package is transitive — it arrivesthrough
pyjwt[crypto]undermcp, so no manifest pin changes.Why this waited
clients/hermes/pyproject.tomlsets[tool.uv] exclude-newer = "7 days".cryptography50.0.0 published 2026-07-31T14:23Z, so the guard held thefix until about 2026-08-07 15:23 BST. The guard is untouched — the bump
moves because the span expired, not because anything bypassed it.
Why the diff is the evidence
When
exclude-newerholds a version,uvdoes not fail. It exits 0 andprints
No lockfile changes detectedwhile keeping the old pin. A cleanrun proves nothing. The diff is one hunk, one package,
49.0.0->50.0.0plus its wheel hashes. The hermes gate log showscryptography==50.0.0installed.Closes comms-6g1n.