fix(deps): align aiohttp pins with lazy Slack deps

[cresslank]

What does this PR do?

Restores the aiohttp==3.13.4 pin across the eager-install extras that still had aiohttp==3.13.3, then regenerates uv.lock. This keeps pyproject.toml/uv.lock aligned with tools/lazy_deps.py's Slack lazy dependency pin so hermes update does not downgrade aiohttp before the active Slack lazy refresh upgrades it again.

Related Issue

No direct open issue currently tracks the update/lazy-install oscillation.

Related context:

• Follow-up to security(deps): bump aiohttp, anthropic, cryptography to CVE-fixed versions #26830, which originally bumped aiohttp to the CVE-fixed 3.13.4 pin.
• chore: release v0.14.0 (2026.5.16) #26862 appears to have regressed the pyproject.toml aiohttp pins during the v0.14.0 release commit.
• chore(deps): regen uv.lock to match pinned versions in pyproject #28094 and open chore: refresh uv lock #27837 are lockfile-alignment changes against the already-regressed pyproject.toml; this PR updates the source pins as well.
• Related but not fixed by fix(update): avoid refreshing inactive lazy backends #27878: that PR avoids refreshing inactive lazy backends, while this bug affects active Slack installs because LAZY_DEPS["platform.slack"] already requires aiohttp==3.13.4.
• Not in scope: the separate anthropic==0.87.0 / Bedrock bearer-token work tracked in Auxiliary client (title-gen / compress) cannot use AWS Bedrock Bearer Token (AWS_BEARER_TOKEN_BEDROCK) — anthropic SDK 0.87.0 CVE-pin lacks api_key parameter #29309, fix(bedrock): support bearer-token auth + raw image bytes for aux vision #28085, and fix(bedrock): route Claude through Converse API when bearer token auth #24507.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• pyproject.toml: bump aiohttp from 3.13.3 to 3.13.4 in the messaging, slack, homeassistant, and sms extras.
• uv.lock: regenerate the lockfile so the resolver records aiohttp==3.13.4.
• tests/test_project_metadata.py: add a regression test that fails when pyproject extras pin aiohttp differently from LAZY_DEPS["platform.slack"].

How to Test

1. On current main before the pin update, the new regression test fails with the mismatched extras:

   scripts/run_tests.sh tests/test_project_metadata.py::test_pyproject_aiohttp_pins_match_lazy_slack_pin -q

2. On this branch, run:

   uv lock --check
   scripts/run_tests.sh tests/test_project_metadata.py tests/tools/test_lazy_deps.py -q
   python scripts/check-windows-footguns.py --all
   git diff HEAD~1..HEAD --check

Validation results from this branch:

• uv lock --check ✅
• scripts/run_tests.sh tests/test_project_metadata.py tests/tools/test_lazy_deps.py -q ✅ — 68 passed
• python scripts/check-windows-footguns.py --all ✅ — no Windows footguns found
• git diff HEAD~1..HEAD --check ✅

Full-suite note: I also ran scripts/run_tests.sh. It completed with 24665 passed, 50 skipped, 3 failed. The reproducible selected failure tests/plugins/web/test_web_search_provider_plugins.py::TestBundledPluginsRegister::test_all_seven_plugins_present_in_registry also fails on detached upstream/main because web-xai is registered but the test still expects seven providers. The other two full-suite failures passed when re-run in isolation on this branch and detached upstream/main; they do not touch dependency metadata or aiohttp pins.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Fedora Linux 44

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

N/A

Screenshots / Logs

N/A

[cresslank]

CI note after the first run: all non-test checks passed (uv lock --check, ruff/ty, Windows footguns, supply-chain/OSV, Nix, Docker, e2e). The test job is red on two failures that appear unrelated to this dependency-pin change:

• tests/plugins/web/test_web_search_provider_plugins.py::TestBundledPluginsRegister::test_all_seven_plugins_present_in_registry expects seven web providers but the current plugin loader registers web-xai; I reproduced this selected failure on detached upstream/main.
• tests/hermes_cli/test_update_hangup_protection.py::TestInstallHangupProtection::test_wraps_stdout_and_stderr_with_mirror failed only in the full parallel CI run; the selected test passes in isolation on this branch and on detached upstream/main.

Focused validation for this PR still passes:

uv lock --check
scripts/run_tests.sh tests/test_project_metadata.py tests/tools/test_lazy_deps.py -q
python scripts/check-windows-footguns.py --all
git diff HEAD~1..HEAD --check

[cresslank]

Rebased this onto current main and force-pushed the PR branch as a single commit: 9e1e79a80.

The only conflict was in pyproject.toml; I kept current main's dev extra changes and applied the aiohttp 3.13.4 alignment.

Validation after rebase:

• git diff --check
• uv lock --check
• uv run --locked --extra dev python -m pytest tests/test_project_metadata.py -q → 7 passed
• GitHub checks are passing; only expected skipped jobs remain

No npm lockfiles changed, so I do not see a fetchNpmDeps / Nix hash refresh needed.

[cresslank]

@alt-glitch force pushed again to resolve merge conflicts. Thanks for any time and attention. Screenshot of what the hermes update churn looks like without this update.

[teknium1]

Merged via #42154 (commit c6d27ad). Your commit was cherry-picked onto current main with your authorship preserved in git log — thanks for the fix! The stale branch couldn't merge directly so I reapplied the four extras bumps + your guard test and regenerated uv.lock. Closes #31817.