From 3a43ccc1e8a988ae990c3306f747def8902f3556 Mon Sep 17 00:00:00 2001 From: Hermes Engineer Date: Thu, 16 Jul 2026 12:11:36 -0300 Subject: [PATCH 1/2] fix(update): ignore shared deps when refreshing lazy backends --- tests/tools/test_lazy_deps.py | 16 ++++++++++++---- tools/lazy_deps.py | 10 ++++++---- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/tests/tools/test_lazy_deps.py b/tests/tools/test_lazy_deps.py index 4296ffda4514..62016990a01b 100644 --- a/tests/tools/test_lazy_deps.py +++ b/tests/tools/test_lazy_deps.py @@ -316,16 +316,24 @@ def test_finds_features_with_at_least_one_package_installed(self, monkeypatch): assert "memory.hindsight" not in active assert "platform.slack" not in active - def test_multi_package_feature_active_if_any_present(self, monkeypatch): - # platform.slack has 3 packages; only one needs to be present - # for the feature to count as active (user activated it before, - # one transitive may have been uninstalled separately). + def test_multi_package_feature_active_if_primary_present(self, monkeypatch): + # The first spec is the feature's primary package. Secondary packages + # may be shared by unrelated backends. monkeypatch.setattr( ld, "_is_present", lambda spec: ld._pkg_name_from_spec(spec) == "slack-bolt", ) assert "platform.slack" in ld.active_features() + def test_shared_secondary_package_does_not_activate_feature(self, monkeypatch): + # aiohttp is a core/shared dependency and must not make an otherwise + # unused Matrix backend look active during `hermes update`. + monkeypatch.setattr( + ld, "_is_present", + lambda spec: ld._pkg_name_from_spec(spec) == "aiohttp", + ) + assert "platform.matrix" not in ld.active_features() + class TestRefreshActiveFeatures: def test_no_active_features_returns_empty(self, monkeypatch): diff --git a/tools/lazy_deps.py b/tools/lazy_deps.py index 06155bfe8493..33b38de0d52a 100644 --- a/tools/lazy_deps.py +++ b/tools/lazy_deps.py @@ -858,16 +858,18 @@ def feature_install_command(feature: str) -> Optional[str]: def active_features() -> list[str]: """Return the list of features the user has ever lazy-installed. - A feature counts as "active" if at least one of its declared packages - is currently installed in the venv (presence check, ignoring version). - Features the user has never enabled stay quiet. + A feature counts as "active" when its primary package (the first spec in + :data:`LAZY_DEPS`) is currently installed in the venv, ignoring version. + Secondary specs are often shared core dependencies (for example aiohttp), + so treating any declared package as proof of activation causes unrelated + backends to be installed during every update. Used by ``hermes update`` to figure out which lazy backends need a refresh pass when pins move in :data:`LAZY_DEPS`. """ active = [] for feature, specs in LAZY_DEPS.items(): - if any(_is_present(s) for s in specs): + if specs and _is_present(specs[0]): active.append(feature) return active From d9f00abdccd87296da136dd51ebf3a8fbb17def4 Mon Sep 17 00:00:00 2001 From: Hermes Engineer Date: Thu, 16 Jul 2026 12:19:22 -0300 Subject: [PATCH 2/2] fix(deps): keep trace upload compatible with transformers --- tools/lazy_deps.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/lazy_deps.py b/tools/lazy_deps.py index 33b38de0d52a..f335c0b34820 100644 --- a/tools/lazy_deps.py +++ b/tools/lazy_deps.py @@ -239,7 +239,7 @@ "starlette==1.0.1", # CVE-2026-48710 — keep in sync with pyproject [computer-use] ), # HF Agent Trace Viewer upload (hermes trace upload / /upload-trace). - "tool.trace_upload": ("huggingface-hub==1.2.3",), + "tool.trace_upload": ("huggingface-hub==1.23.0",), }