RELIABILITY BRIEF · P2 · AUTH / STARTUP
Hermes Post-Update Secret-Source Launch Blocker: Issue #70697
A sourced reliability brief on an open report that a Hermes update can prevent startup when bundled Bitwarden and command secret sources encounter a missing cryptography module.
What the report says
The issue report says that after updating Hermes, startup can fail with ModuleNotFoundError for cryptography.hazmat.decrepit.ciphers.modes. The report links the failure to both the bundled Bitwarden secret source and the command secret source, leaving the application unable to reach a usable state in the reported environment.
Status boundary: This brief summarizes a public, open issue report. It is not an independent reproduction, security assessment, product-wide reliability estimate, or confirmation that the report remains unresolved.
Operational significance
For affected installations, the immediate risk is availability loss after an upgrade, with additional operational concern because the affected path is secret and credential management. This page reports an open issue and does not establish prevalence, root cause, exploitability, or behavior outside the reporter’s environment.
Evidence-bounded verification checklist
| Check | Question | Safe evidence practice |
|---|---|---|
| Upgrade gate | Can the application complete startup after the target upgrade? | Validate in a representative non-production environment before rollout. |
| Secret-source coverage | Do bundled Bitwarden and command secret-source paths load successfully? | Test only with safe test credentials and record the exact component versions. |
| Dependency trace | Does the installed cryptography package expose the referenced module? | Capture the full error, package versions, and environment details for reproducibility. |
| Rollback readiness | Is a known-good deployment artifact and configuration backup available? | Keep rollback scoped, documented, and approved before a production change. |
| Recovery state | After remediation, can the service reach its expected usable state? | Verify startup and minimum secret-dependent workflow behavior without publishing sensitive output. |
Handling guidance
- Treat a post-update launch failure as an operational incident until the affected deployment scope is known.
- Preserve the complete stack trace and dependency versions, redacting secrets and sensitive paths before sharing.
- Avoid assuming a dependency change fixes the issue without reproducing startup and the affected secret-source paths.
- Track the upstream issue for maintainer updates, reproduction requests, and any stated fix or workaround.
Source evidence
Hermes Agent GitHub issue #70697
Issue status, labels, discussion, and remediation guidance can change. Consult the upstream report directly before making deployment or product decisions.