pyproject.toml

[tool.ruff]

# description of all rules are available on https://docs.astral.sh/ruff/rules/
lint.select = ["D", "E", "F", "W", "C", "S", "I", "TCH", "SLOT", "RUF", "C90", "N", "YTT", "ASYNC", "TRIO"]

# we need to check 'mood' of all docstrings, this needs to be enabled explicitly
lint.extend-select = ["D401"]

lint.ignore = []
lint.pydocstyle.convention = "google"
lint.flake8-tidy-imports.banned-api = { "unittest" = { msg = "use pytest instead of unittest" }, "unittest.mock" = { msg = "use pytest-mock instead of unittest.mock" } }

target-version = "py312"
line-length = 100
exclude = ["embeddings_model"]
force-exclude = true

[tool.ruff.lint.per-file-ignores]
"tests/*" = ["S101", "D104", "D100"]
"scripts/*" = ["S101", "S310", "S603", "S607"]
"src/lightspeed_rag_content/image_builder.py" = ["S603", "S607"]

[tool.black]
line-length = 100
force-exclude = "embeddings_model"

[tool.pydocstyle]
match-dir = "(?!embeddings_model)[^\\.].*"

[tool.mypy]
disable_error_code = ["union-attr", "return-value", "arg-type", "import-untyped"]
ignore_missing_imports = true
mypy_path = ["src"]
namespace_packages = true
explicit_package_bases = true
exclude = ["^embeddings_model/"]

[tool.pyright]
exclude = ["embeddings_model"]

[tool.pdm]
distribution = true

[build-system]
requires = ["pdm-backend"]
build-backend = "pdm.backend"

[project]
name = "lightspeed-rag-content"
version = "0.5.0"
description = "RAG content for OpenShift LightSpeed."
authors = []
dependencies = [
    "PyYAML>=6.0.2",
    "huggingface_hub>=0.33.4,<2.0",
    "llama-index>=0.12.51",
    "llama-index-vector-stores-faiss>=0.3.0",
    "llama-index-embeddings-huggingface>=0.4.0",
    "llama-index-readers-file>=0.4.11",
    "faiss-cpu>=1.11.0.post1",
    "llama-index-vector-stores-postgres>=0.5.4",
    # Pin torch/torchvision to versions available as CPU wheels
    # torch 2.9.x pairs with torchvision 0.24.x
    "ogx==1.0.2",
    "ogx-api==1.0.2",
    "ogx-client==1.0.2",
    "torch>=2.9.0",
    "torchvision>=0.24.0",
    "aiosqlite>=0.21.0",
    "tomlkit",
    "chardet==7.2.0",
    "hf-xet>=1.2.0",
    "einops>=0.8.1",
    # For HTML to Markdown conversion in BYOK workflows
    "docling>=2.94.0",
    "python-frontmatter>=1.1.0",
    "certifi>=2025.10.5",
    # CVE floor constraints — transitive deps pinned to fix known vulnerabilities
    "Pillow>=12.3.0",          # CVE-2026-59205: heap corruption in ImageCms.ImageCmsTransform.apply
    "nltk>=3.10.0",            # CVE-2026-54293: URL-encoded path traversal in nltk.data.load()
    "pypdf>=6.14.2",           # CVE-2026-59935/59936/59937/59938: infinite loops, memory exhaustion
    "mcp>=1.28.1",             # CVE-2026-52869/52870/59950: HTTP session hijack, task access, WebSocket origin bypass
]
requires-python = "==3.12.*"
dynamic = ["license", "readme"]

# PyTorch has multiple wheel variants for different backends - cpu, cuda, etc.
# By default on pypi.org is the cuda variant. Forces uv to use the cpu variant.
[[tool.uv.index]]
name = "pytorch-cpu"
url = "https://download.pytorch.org/whl/cpu"
explicit = true
# Require wheels for Linux x86_64 so torchvision resolves to a build that has
# manylinux wheels (the PyTorch CPU index has multiple builds; without this,
# uv can pick a build that only has win_arm64 and then sync fails on Linux).
[tool.uv]
required-environments = [
    "sys_platform == 'linux' and platform_machine == 'x86_64'",
    "sys_platform == 'linux' and platform_machine == 'aarch64'",
]

[tool.uv.sources]
torch = [{ index = "pytorch-cpu" }]
torchvision = [{ index = "pytorch-cpu" }]

[dependency-groups]
dev = [
    "black>=25.1.0",
    "mypy>=1.15.0",
    "ruff>=0.12.4",
    "types-requests>=2.32.0.20240622",
    "pre-commit>=4.2.0",
    "coverage>=7.6.12",
    "huggingface-hub>=0.33.4,<2.0",
    "radon>=6.0.1",
    "pyright>=1.1.401",
    "pylint>=3.3.7",
    "pytest>=8.3.4",
    "pytest-cov>=6.0.0",
    "pytest-mock>=3.15.1",
    "pybuild-deps>=0.5.0",
    "pip==26.1.2",
]

[tool.pylint.main]
ignore-paths = ["^embeddings_model/"]

[tool.pylint."MESSAGES CONTROL"]
good-names = ["e"]
disable = ["R0902", "R0903", "R0913", "R0917", "W0621", "W0511"]