pyproject.toml

[project]
name = "nvflow"
dynamic = ["version"]  # Version determined from git tags via hatch-vcs
description = "Workflow orchestration for end-to-end model training on NeMo ecosystem"
authors = [
    {name = "Your Team", email = "team@example.com"}
]
readme = "README.md"
requires-python = ">=3.12,<3.14"
license = {text = "Apache-2.0"}

dependencies = [
    # Core framework we orchestrate (brings ~200+ deps). Pinned to a commit
    # since nemo-skills has no version tags.
    # Pinned 2026-08-02 | e06c9b90 (paired with nemo-rl v0.7.0; NVFlow v1.1.2).
    # Must match NEMO_SKILLS_COMMIT in dockerfiles/Dockerfile.nemo-skills.
    "nemo-skills @ git+https://github.com/NVIDIA/NeMo-Skills.git@e06c9b900177be3f60d6a3f99135bb5de9af9bed",

    # Configuration & Workflow
    "omegaconf>=2.3.0",      # YAML config loading with variable interpolation

    # CLI Interface
    "typer>=0.9.0",          # CLI framework (includes click as dependency)
    "rich>=13.0.0",          # Pretty terminal output and tables

    # Data handling
    "jsonlines>=4.0.0",      # JSONL file reading/writing

    # Declared directly ONLY so the CPU-index source below can route it (keeps
    # CUDA out of the x86_64 client). Floor set for CVE remediation; otherwise
    # tracks nemo-skills' torch.
    "torch>=2.13.0",
]

[project.optional-dependencies]
# Development tools (testing, linting, formatting, docs)
dev = [
    # Testing
    "pytest>=9.0.3",
    "pytest-cov>=4.1.0",
    "pytest-xdist>=3.3.0",
    "pytest-timeout>=2.2.0",

    # Code quality
    "pre-commit>=3.5.0",
    "ruff>=0.1.0",
    "mypy>=1.7.0",
    "types-PyYAML",
    "types-requests",
]

[project.scripts]
nflow = "nvflow.cli.main:app"

[build-system]
requires = ["hatchling", "hatch-vcs"]
build-backend = "hatchling.build"

[tool.hatch.version]
source = "vcs"
fallback-version = "0.0.0"

[tool.hatch.build.hooks.vcs]
version-file = "nvflow/_version.py"

[tool.hatch.metadata]
allow-direct-references = true

[tool.hatchling.build.targets.wheel]
packages = ["nvflow"]

[tool.ruff]
line-length = 100
target-version = "py312"

[tool.ruff.lint]
select = ["E", "F", "I", "N", "UP", "B", "C4"]
ignore = ["E501"]

[tool.mypy]
python_version = "3.12"
warn_return_any = false
warn_unused_configs = true
disallow_untyped_defs = false
ignore_missing_imports = true

# Disable strict checks for OmegaConf (dynamic config library)
[[tool.mypy.overrides]]
module = "nvflow.*"
disable_error_code = ["index", "call-overload", "union-attr", "arg-type", "no-any-return", "attr-defined", "assignment", "operator"]

[tool.pytest.ini_options]
testpaths = ["tests"]
python_files = "test_*.py"
python_functions = "test_*"
addopts = "-v --cov=nvflow --cov-report=html --cov-report=term-missing"
timeout = 300

[tool.uv]
managed = true
override-dependencies = [
    # Break leptonai's httpx[http2]==0.27.2 hard pin (pulled in via nemo-run)
    # so litellm 1.83.14 (which requires httpx==0.28.1) can be installed.
    # Mirrors the override added in nemo-skills/pyproject.toml (PR #1433),
    # but [tool.uv] from a dep is ignored — overrides must be at the top-level project.
    "httpx[http2]>=0.28.1",
    # Force minimum versions of transitive deps for security/maintenance updates
    "cryptography>=48.0.1",
    "Pillow>=12.3.0",
    "Pygments>=2.20.0",
    "GitPython>=3.1.52",   # 3.1.50 still resolves vulnerable; fixes land in 3.1.51/3.1.52 (Trivy HIGH)
    # Nspec CVE remediation (2026-07-09) — long-term fixes
    # ray[default]>=2.54.0 was previously overridden (removed in 4e1b7ec4 during rebase cleanup).
    # Restoring at >=2.56.0 to cover both the functional fix (entrypoint_label_selector added
    # in 2.54.0) and the Nspec CVE recommendation. Without this, nemo-run->torchx pins ray 2.53.0.
    "ray[default]>=2.56.0",
    "urllib3>=2.7.0",
    "transformers>=5.13.0",
    # CVE floors ported from !188 (litellm capped to 1.84.x to avoid the 1.91.x/aiohttp-4.0.0a1 conflict)
    # lxml>=6.1.0 clears High CVE-2026-41066 (info disclosure / local file read)
    "starlette>=1.3.1",
    "litellm>=1.84.0,<1.85",
    "lxml>=6.1.0",
    "gradio>=6.20.0",
]

# NSpect/Trivy HIGH CVE floors (2026-07-21) — transitive-only, raise lower bound.
constraint-dependencies = [
    "pyjwt>=2.12.0",
    "python-multipart>=0.0.27",
    "mcp>=1.28.1",
    "msgpack>=1.2.1",
    "nltk>=3.10.0",
    "aiohttp>=3.13.3",
    "pyarrow>=23.0.1",
    "pyasn1>=0.6.4",  # CVE-2026-59886: exact big-integer exponentiation DoS
    "soupsieve>=2.8.4",
]

# x86_64 torch from CPU wheels (arm64 PyPI torch is already CPU-only), keeping
# CUDA runtime out of the amd64 client. explicit = only torch uses this index.
[[tool.uv.index]]
name = "pytorch-cpu"
url = "https://download.pytorch.org/whl/cpu"
explicit = true

[tool.uv.sources]
torch = [{ index = "pytorch-cpu", marker = "platform_machine == 'x86_64'" }]

[dependency-groups]
dev = [
    "pudb>=2025.1.3",
]