From cc7ee4e7015232482cbe189bf21df60fa3a9497b Mon Sep 17 00:00:00 2001 From: Guy Korland Date: Mon, 24 Aug 2026 11:45:49 +0300 Subject: [PATCH 1/3] fix(deps): pin graphrag-sdk to <0.9.0 and build image from uv.lock graphrag-sdk 1.x is a full rewrite that removed `graphrag_sdk.models` and the `Ontology`/`KnowledgeGraph`/`KnowledgeGraphModelConfig` public API that `api/llm.py` depends on. #673 widened the constraint to `<1.2.0`, so a fresh resolve picks 1.1.1 and the app crashes on import: File "/app/api/llm.py", line 7, in from graphrag_sdk.models.litellm import LiteModel ModuleNotFoundError: No module named 'graphrag_sdk.models' CI stayed green because `uv sync` honours uv.lock (still 0.8.2), while the Docker image ran `pip install .` straight from pyproject.toml and resolved the newest allowed version. Restore the `<0.9.0` upper bound and install the image's dependencies under constraints exported from uv.lock so the container can no longer drift from the lockfile. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Dockerfile | 9 ++++++--- pyproject.toml | 2 +- uv.lock | 2 +- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index f19f6656..5e4cc7fd 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,9 +36,12 @@ RUN apt-get update \ WORKDIR /app -# Install Python dependencies -COPY pyproject.toml ./ -RUN pip install --no-cache-dir --break-system-packages . +# Install Python dependencies pinned to uv.lock so the image matches CI +COPY pyproject.toml uv.lock ./ +RUN pip install --no-cache-dir --break-system-packages uv \ + && uv export --frozen --no-dev --no-emit-project --no-hashes -o /tmp/constraints.txt \ + && pip install --no-cache-dir --break-system-packages -c /tmp/constraints.txt . \ + && rm /tmp/constraints.txt # Verify Node.js tooling for building the frontend RUN node --version && npm --version diff --git a/pyproject.toml b/pyproject.toml index 6e9d8321..0eddfcaf 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ authors = [{name = "Roi Lipman", email = "roilipman@gmail.com"}] readme = "README.md" requires-python = ">=3.12,<3.14" dependencies = [ - "graphrag-sdk>=0.8.1,<1.2.0", + "graphrag-sdk>=0.8.1,<0.9.0", "tree-sitter>=0.25.2,<0.27.0", "validators>=0.35.0,<0.36.0", "falkordb>=1.1.3,<2.0.0", diff --git a/uv.lock b/uv.lock index 80fa808f..7adf2abe 100644 --- a/uv.lock +++ b/uv.lock @@ -396,7 +396,7 @@ requires-dist = [ { name = "falkordb-multilspy", specifier = ">=0.1.0,<1.0.0" }, { name = "falkordblite", marker = "extra == 'light'", specifier = ">=0.10.0,<1.0.0" }, { name = "fastapi", specifier = ">=0.115.0,<1.0.0" }, - { name = "graphrag-sdk", specifier = ">=0.8.1,<1.2.0" }, + { name = "graphrag-sdk", specifier = ">=0.8.1,<0.9.0" }, { name = "httpx", marker = "extra == 'test'", specifier = ">=0.28.0,<1.0.0" }, { name = "javatools", specifier = ">=1.6.0,<2.0.0" }, { name = "mcp", specifier = ">=1.0.0,<2.0.0" }, From 0f7f63cd582e6bc6f87a9ddeb7a03cccc1ead7bf Mon Sep 17 00:00:00 2001 From: Guy Korland Date: Mon, 24 Aug 2026 15:01:55 +0300 Subject: [PATCH 2/3] build(docker): pin uv version used to export lockfile constraints `uv export --frozen` is on the critical path for producing the constraints file, so installing uv unpinned reintroduces exactly the drift this branch removes: an upstream release could change CLI flags or export semantics and break image builds without any change here. Pin via an `ARG UV_VERSION` so the version is overridable at build time without editing the Dockerfile. Addresses review feedback on #723. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Dockerfile | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 5e4cc7fd..6670d5e8 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,9 +36,12 @@ RUN apt-get update \ WORKDIR /app -# Install Python dependencies pinned to uv.lock so the image matches CI +# Install Python dependencies pinned to uv.lock so the image matches CI. +# uv is pinned too: it produces the constraints file, so an unpinned +# upgrade could change `uv export` semantics and break reproducibility. +ARG UV_VERSION=0.12.5 COPY pyproject.toml uv.lock ./ -RUN pip install --no-cache-dir --break-system-packages uv \ +RUN pip install --no-cache-dir --break-system-packages "uv==${UV_VERSION}" \ && uv export --frozen --no-dev --no-emit-project --no-hashes -o /tmp/constraints.txt \ && pip install --no-cache-dir --break-system-packages -c /tmp/constraints.txt . \ && rm /tmp/constraints.txt From 8aa9ec51f845fef67acd5a548914303391165e45 Mon Sep 17 00:00:00 2001 From: Guy Korland Date: Mon, 24 Aug 2026 15:15:35 +0300 Subject: [PATCH 3/3] build(docker): drop uv from the final image after exporting constraints uv is only needed to generate the constraints file; nothing later in the Dockerfile or start.sh uses it. Uninstall it in the same RUN layer so it never persists into the shipped image, avoiding ~23MB of dead weight and the extra dependency/CVE surface in the runtime. Addresses review feedback on #723. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 6670d5e8..6b170e82 100644 --- a/Dockerfile +++ b/Dockerfile @@ -39,10 +39,12 @@ WORKDIR /app # Install Python dependencies pinned to uv.lock so the image matches CI. # uv is pinned too: it produces the constraints file, so an unpinned # upgrade could change `uv export` semantics and break reproducibility. +# It is removed in the same layer, since only the export step needs it. ARG UV_VERSION=0.12.5 COPY pyproject.toml uv.lock ./ RUN pip install --no-cache-dir --break-system-packages "uv==${UV_VERSION}" \ && uv export --frozen --no-dev --no-emit-project --no-hashes -o /tmp/constraints.txt \ + && pip uninstall -y --break-system-packages uv \ && pip install --no-cache-dir --break-system-packages -c /tmp/constraints.txt . \ && rm /tmp/constraints.txt