Skip to content

fix(deps): pin graphrag-sdk to <0.9.0 and build image from uv.lock #723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
galshubeli merged 3 commits into from
Aug 24, 2026
Merged

fix(deps): pin graphrag-sdk to <0.9.0 and build image from uv.lock #723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc7ee4e
fix(deps): pin graphrag-sdk to <0.9.0 and build image from uv.lock
gkorland Aug 24, 2026
0f7f63c
build(docker): pin uv version used to export lockfile constraints
gkorland Aug 24, 2026
8aa9ec5
build(docker): drop uv from the final image after exporting constraints
gkorland Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,17 @@ RUN apt-get update \

WORKDIR /app

# Install Python dependencies
COPY pyproject.toml ./
RUN pip install --no-cache-dir --break-system-packages .
# Install Python dependencies pinned to uv.lock so the image matches CI.
# uv is pinned too: it produces the constraints file, so an unpinned
# upgrade could change `uv export` semantics and break reproducibility.
# It is removed in the same layer, since only the export step needs it.
ARG UV_VERSION=0.12.5
COPY pyproject.toml uv.lock ./

@gkorland gkorland Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Investigated this one and it turned out to be more than a metadata nit — thanks for pushing on it.

On the README specifically: I tested it, and current setuptools tolerates the missing file (it warns rather than fails), so metadata generation was not actually breaking:

README.md present: False
METADATA OK: falkordb_code_graph-0.4.2.dist-info

But the underlying concern was real, and worse than fragile metadata. Because pip install . ran with no sources present, [tool.setuptools.packages.find] matched nothing — so the api package, the api.mcp templates package-data, and the console scripts never reached site-packages. A console script resolves imports from its own bin directory rather than the working directory, so both entry points were dead in the image:

api installed: False
cgraph BROKEN
cgraph-mcp BROKEN

That means the documented CGRAPH_MODE=mcp path in start.sh (exec cgraph-mcp) could never have started. Web mode only worked by accident, because uvicorn adds the working directory to the import path.

Fix (bbd4118) — took your second suggestion, splitting the install so the dependency layer stays cache-friendly:

# deps only, pinned from uv.lock
RUN ... uv export --frozen ... -o /tmp/requirements.txt \
    && pip uninstall -y --break-system-packages uv \
    && pip install --no-cache-dir --break-system-packages -r /tmp/requirements.txt
...
COPY ./api ./api
COPY README.md ./
RUN pip install --no-cache-dir --break-system-packages --no-deps .

Verified on a full build of the real Dockerfile:

OK: uv gone
graphrag-sdk Version: 0.8.2
api installed: True
cgraph OK            <- run from / , not /app
cgraph-mcp OK        <- run from / , not /app
templates dir: .../site-packages/api/mcp/templates exists: True
                 ['claude_mcp_section.md', 'cursorrules.template']
STATIC_DIR: /app/app/dist exists: True

Plus runtime smoke tests of both modes:

  • web — container boots to Application startup complete, GET /api/list_repos returns 200 {"status":"success","repositories":[]}, and GET / serves the SPA with 200
  • mcp — CGRAPH_MODE=mcp now answers a JSON-RPC initialize, returning serverInfo.name = "code-graph"

No regression to web mode: STATIC_DIR still resolves against /app/api, because the working directory takes precedence over site-packages on the import path.

RUN pip install --no-cache-dir --break-system-packages "uv==${UV_VERSION}" \
&& uv export --frozen --no-dev --no-emit-project --no-hashes -o /tmp/constraints.txt \
&& pip uninstall -y --break-system-packages uv \
&& pip install --no-cache-dir --break-system-packages -c /tmp/constraints.txt . \
&& rm /tmp/constraints.txt
Comment on lines +45 to +49

@gkorland gkorland Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed — uv was dead weight in the runtime. Fixed in 8aa9ec5 by uninstalling it in the same RUN layer, so it never lands in the shipped layer at all (uninstalling in a later layer would leave the bytes in the earlier one):

RUN pip install --no-cache-dir --break-system-packages "uv==${UV_VERSION}" \\
    && uv export --frozen --no-dev --no-emit-project --no-hashes -o /tmp/constraints.txt \\
    && pip uninstall -y --break-system-packages uv \\
    && pip install --no-cache-dir --break-system-packages -c /tmp/constraints.txt . \\
    && rm /tmp/constraints.txt

Saves ~23MB (the uv manylinux wheel is 22.6MB compressed) plus the associated dependency/CVE surface.

Verified in a real image build:

OK: uv binary gone
OK: uv package gone
OK: imports work
Name: graphrag-sdk
Version: 0.8.2


# Verify Node.js tooling for building the frontend
RUN node --version && npm --version
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ authors = [{name = "Roi Lipman", email = "roilipman@gmail.com"}]
readme = "README.md"
requires-python = ">=3.12,<3.14"
dependencies = [
"graphrag-sdk>=0.8.1,<1.2.0",
"graphrag-sdk>=0.8.1,<0.9.0",
"tree-sitter>=0.25.2,<0.27.0",
"validators>=0.35.0,<0.36.0",
"falkordb>=1.1.3,<2.0.0",
Expand Down
2 changes: 1 addition & 1 deletion uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading