fix(deps): declare packaging as a core dependency so it ships everywhere by briandevans · Pull Request #40522 · NousResearch/hermes-agent

briandevans · 2026-06-06T13:49:22Z

What does this PR do?

packaging is imported directly on three production code paths but is not declared anywhere in [project.dependencies] — it only reached users transitively (pip/uv pull it for other tools). The slim official Docker image (nousresearch/hermes-agent) ships without it, and there each try/except ImportError fallback silently degrades rather than erroring:

plugins/memory/hindsight/__init__.py (_meets_minimum_version) returns False when packaging is absent, which disables update_mode='append', so every session leaks separate Hindsight documents — the reported Missing packaging module in Docker image causes Hindsight version comparison to fail #40503 symptom.
tools/lazy_deps.py (_is_satisfied) falls back to "installed counts as satisfied", defeating every version-constraint check on lazy extras.
hermes_cli/main.py drops to naive name==version requirement parsing.

This promotes packaging to a declared core dep pinned to packaging==26.0 — the exact version already resolved in uv.lock — so there is zero resolution churn (the lock change is two edge annotations marking it transitive→direct). It's a pure-Python py3-none-any wheel with no compiled extensions, so it's safe to ship on every platform — the same fix-shape as the merged Markdown promotion (commit b434f8c, #32486). Declaring it also wires it into the _verify_core_dependencies_installed() update-repair guard, which reinstalls missing [project.dependencies] on hermes update.

Related Issue

Fixes #40503

Type of Change

🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

pyproject.toml: add "packaging==26.0" to [project.dependencies] with an explanatory comment.
uv.lock: regenerated via uv lock — two edge annotations promoting packaging from transitive to a direct dependency of hermes-agent (no version or resolution change).
tests/test_packaging_metadata.py: add test_packaging_declared_as_core_dependency, a hermetic tomllib-parse regression guard.

How to Test

Confirm the regression test fails before the fix and passes after:
- Without the pyproject.toml change, test_packaging_declared_as_core_dependency fails with AssertionError: packaging ... must be a declared core dependency.
- With the change it passes.

Run the focused suite:

uv run --with pytest --with pytest-xdist --with pytest-asyncio --with setuptools python3 -m pytest tests/test_packaging_metadata.py -v

→ 8 passed.

Confirm the import sites resolve once packaging is installed:

python3 -c "from packaging.version import Version; print(Version('0.7.2') >= Version('0.5.0'))"

Checklist

Code

I've read the Contributing Guide
My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
I searched for existing PRs to make sure this isn't a duplicate
My PR contains only changes related to this fix/feature (no unrelated commits)
I've run the focused packaging suite and all tests pass
I've added tests for my changes (required for bug fixes, strongly encouraged for features)
I've tested on my platform: macOS 15

Documentation & Housekeeping

I've updated relevant documentation (README, docs/, docstrings) — or N/A
I've updated cli-config.yaml.example if I added/changed config keys — or N/A
I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
I've considered cross-platform impact (Windows, macOS) — pure-Python py3-none-any wheel, no platform constraints
I've updated tool descriptions/schemas if I changed tool behavior — or N/A

packaging is imported directly on three production paths but was never declared in [project.dependencies], so it only reached users transitively (pip/uv pull it for other tools). The slim official Docker image ships without it, where each try/except-ImportError fallback silently degrades: - plugins/memory/hindsight/__init__.py (_meets_minimum_version) returns False when packaging is absent, disabling update_mode='append' so every session leaks separate Hindsight documents (the reported NousResearch#40503 symptom). - tools/lazy_deps.py (_is_satisfied) falls back to "installed counts as satisfied", defeating every version-constraint check on lazy extras. - hermes_cli/main.py drops to naive name==version requirement parsing. Promote it to a declared core dep pinned to packaging==26.0 — the exact version already resolved in uv.lock, so there is zero resolution churn (the lock change is two edge annotations marking it transitive->direct). It is a pure-Python py3-none-any wheel with no compiled extensions, safe to ship on every platform. Declaring it also wires it into the _verify_core_dependencies_installed() update-repair guard, which reinstalls missing [project.dependencies] on hermes update. Adds a hermetic tomllib-parse regression test that fails before the declaration and passes after. Fixes NousResearch#40503

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR ensures the packaging library is explicitly declared as a core dependency (to avoid relying on transitive installs) and adds a regression test to prevent future accidental removal.

Changes:

Add packaging to project.dependencies in pyproject.toml.
Add a regression test asserting packaging is present in core dependencies.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/test_packaging_metadata.py	Adds a regression test to ensure `packaging` remains a declared core dependency.
pyproject.toml	Declares `packaging` as a pinned core dependency with explanatory comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    names = {
+        # strip extras/markers/specifiers down to the distribution name
+        dep.split("==")[0].split(">=")[0].split("[")[0].split(";")[0].strip().lower()
+        for dep in core
+    }


Address Copilot review on NousResearch#40522: the inline name-extraction only handled ==, >=, [ and ; and could mis-parse valid requirement strings using <=, ~=, !=, <, > or a direct reference (name @ url). Factor a _distribution_name helper that drops markers, direct-reference URLs and extras, then strips any version operator via regex, so a future dep declared with any PEP 508 specifier shape is matched correctly.

briandevans · 2026-06-06T13:52:33Z

@copilot Addressed in commit 46dad59:

Factored a _distribution_name() helper that extracts the PEP 508 distribution name robustly: it drops environment markers (;), direct-reference URLs (name @ https://...), and extras ([...]), then strips any version operator (==, >=, <=, ~=, !=, <, >) via a single regex split — replacing the previous ==/>=-only parsing.
Verified the regression test still fails without the pyproject.toml declaration and passes with it; full tests/test_packaging_metadata.py is green (8 passed).

austinpickett

Reviewed by Hermes Agent — Approve ✅

Verified all three import sites use packaging directly:

plugins/memory/hindsight/__init__.py → from packaging.version import Version
tools/lazy_deps.py → from packaging.specifiers import SpecifierSet + version import Version
hermes_cli/main.py → from packaging.requirements import Requirement

Confirmed packaging is not declared anywhere in [project.dependencies] on main, so today it only arrives transitively — exactly the silent-degradation risk described (#40503). packaging==26.0 is a pure-Python py3-none-any wheel pinned to the already-resolved lock version, so no resolution churn or platform risk. The added regression test (test_packaging_declared_as_core_dependency) guards against reintroduction. LGTM.

…ere (NousResearch#40522) * fix(deps): declare packaging as a core dependency so it ships everywhere packaging is imported directly on three production paths but was never declared in [project.dependencies], so it only reached users transitively (pip/uv pull it for other tools). The slim official Docker image ships without it, where each try/except-ImportError fallback silently degrades: - plugins/memory/hindsight/__init__.py (_meets_minimum_version) returns False when packaging is absent, disabling update_mode='append' so every session leaks separate Hindsight documents (the reported NousResearch#40503 symptom). - tools/lazy_deps.py (_is_satisfied) falls back to "installed counts as satisfied", defeating every version-constraint check on lazy extras. - hermes_cli/main.py drops to naive name==version requirement parsing. Promote it to a declared core dep pinned to packaging==26.0 — the exact version already resolved in uv.lock, so there is zero resolution churn (the lock change is two edge annotations marking it transitive->direct). It is a pure-Python py3-none-any wheel with no compiled extensions, safe to ship on every platform. Declaring it also wires it into the _verify_core_dependencies_installed() update-repair guard, which reinstalls missing [project.dependencies] on hermes update. Adds a hermetic tomllib-parse regression test that fails before the declaration and passes after. Fixes NousResearch#40503 * test(deps): make packaging dep-name extraction PEP 508-robust Address Copilot review on NousResearch#40522: the inline name-extraction only handled ==, >=, [ and ; and could mis-parse valid requirement strings using <=, ~=, !=, <, > or a direct reference (name @ url). Factor a _distribution_name helper that drops markers, direct-reference URLs and extras, then strips any version operator via regex, so a future dep declared with any PEP 508 specifier shape is matched correctly. --------- Co-authored-by: briandevans <252620095+briandevans@users.noreply.github.com>

…ere (#40522) * fix(deps): declare packaging as a core dependency so it ships everywhere packaging is imported directly on three production paths but was never declared in [project.dependencies], so it only reached users transitively (pip/uv pull it for other tools). The slim official Docker image ships without it, where each try/except-ImportError fallback silently degrades: - plugins/memory/hindsight/__init__.py (_meets_minimum_version) returns False when packaging is absent, disabling update_mode='append' so every session leaks separate Hindsight documents (the reported #40503 symptom). - tools/lazy_deps.py (_is_satisfied) falls back to "installed counts as satisfied", defeating every version-constraint check on lazy extras. - hermes_cli/main.py drops to naive name==version requirement parsing. Promote it to a declared core dep pinned to packaging==26.0 — the exact version already resolved in uv.lock, so there is zero resolution churn (the lock change is two edge annotations marking it transitive->direct). It is a pure-Python py3-none-any wheel with no compiled extensions, safe to ship on every platform. Declaring it also wires it into the _verify_core_dependencies_installed() update-repair guard, which reinstalls missing [project.dependencies] on hermes update. Adds a hermetic tomllib-parse regression test that fails before the declaration and passes after. Fixes #40503 * test(deps): make packaging dep-name extraction PEP 508-robust Address Copilot review on #40522: the inline name-extraction only handled ==, >=, [ and ; and could mis-parse valid requirement strings using <=, ~=, !=, <, > or a direct reference (name @ url). Factor a _distribution_name helper that drops markers, direct-reference URLs and extras, then strips any version operator via regex, so a future dep declared with any PEP 508 specifier shape is matched correctly. --------- Co-authored-by: briandevans <252620095+briandevans@users.noreply.github.com>

…ere (NousResearch#40522) * fix(deps): declare packaging as a core dependency so it ships everywhere packaging is imported directly on three production paths but was never declared in [project.dependencies], so it only reached users transitively (pip/uv pull it for other tools). The slim official Docker image ships without it, where each try/except-ImportError fallback silently degrades: - plugins/memory/hindsight/__init__.py (_meets_minimum_version) returns False when packaging is absent, disabling update_mode='append' so every session leaks separate Hindsight documents (the reported NousResearch#40503 symptom). - tools/lazy_deps.py (_is_satisfied) falls back to "installed counts as satisfied", defeating every version-constraint check on lazy extras. - hermes_cli/main.py drops to naive name==version requirement parsing. Promote it to a declared core dep pinned to packaging==26.0 — the exact version already resolved in uv.lock, so there is zero resolution churn (the lock change is two edge annotations marking it transitive->direct). It is a pure-Python py3-none-any wheel with no compiled extensions, safe to ship on every platform. Declaring it also wires it into the _verify_core_dependencies_installed() update-repair guard, which reinstalls missing [project.dependencies] on hermes update. Adds a hermetic tomllib-parse regression test that fails before the declaration and passes after. Fixes NousResearch#40503 * test(deps): make packaging dep-name extraction PEP 508-robust Address Copilot review on NousResearch#40522: the inline name-extraction only handled ==, >=, [ and ; and could mis-parse valid requirement strings using <=, ~=, !=, <, > or a direct reference (name @ url). Factor a _distribution_name helper that drops markers, direct-reference URLs and extras, then strips any version operator via regex, so a future dep declared with any PEP 508 specifier shape is matched correctly. --------- Co-authored-by: briandevans <252620095+briandevans@users.noreply.github.com>

briandevans requested review from a team and Copilot June 6, 2026 13:49

Copilot AI reviewed Jun 6, 2026

View reviewed changes

Comment thread tests/test_packaging_metadata.py Outdated

Comment on lines +77 to +81

names = {

# strip extras/markers/specifiers down to the distribution name

dep.split("==")[0].split(">=")[0].split("[")[0].split(";")[0].strip().lower()

for dep in core

}

alt-glitch added type/bug Something isn't working P2 Medium — degraded but workaround exists dependencies Pull requests that update a dependency file area/docker Docker image, Compose, packaging labels Jun 6, 2026

austinpickett approved these changes Jun 9, 2026

View reviewed changes

austinpickett merged commit b5421f4 into NousResearch:main Jun 9, 2026
26 checks passed

austinpickett mentioned this pull request Jun 9, 2026

security(deps): bump aiohttp 3.14.0 + anthropic 0.87.0, pin cryptography floor, + drift guard #42334

Closed

Navigation Menu

Uh oh!

fix(deps): declare packaging as a core dependency so it ships everywhere - #40522

fix(deps): declare packaging as a core dependency so it ships everywhere#40522
austinpickett merged 2 commits into
NousResearch:mainfrom
briandevans:fix/deps-declare-packaging-core-40503

briandevans commented Jun 6, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

briandevans commented Jun 6, 2026

Uh oh!

austinpickett left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

briandevans commented Jun 6, 2026

What does this PR do?

Related Issue

Type of Change

Changes Made

How to Test

Checklist

Code

Documentation & Housekeeping

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

briandevans commented Jun 6, 2026

Uh oh!

austinpickett left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants