Skip to content

Pin backend-api dependencies to exact versions#28

Open
listlessbird wants to merge 23 commits into
mainfrom
codex/check-project-dependency-on-litellm-package
Open

Pin backend-api dependencies to exact versions#28
listlessbird wants to merge 23 commits into
mainfrom
codex/check-project-dependency-on-litellm-package

Conversation

@listlessbird

Copy link
Copy Markdown
Owner

Motivation

  • Make backend installs deterministic and auditable by replacing open-ended dependency ranges with exact versions.
  • Reduce risk from unexpected transitive upgrades and simplify vulnerability review for the backend API dependencies.

Description

  • Replaced ranged specifiers (e.g., >=) with exact == pins for runtime dependencies in backend-api/pyproject.toml, including packages such as fastapi, uvicorn, transformers, pydantic, numpy, and boto3.
  • Pinned development dependencies in backend-api/pyproject.toml, including ipykernel, pandas, ruff, and types-boto3-custom to match the vendored wheel.
  • Regenerated backend-api/uv.lock so lock metadata reflects the new exact specifiers.
  • Recorded the change and created a PR for review.

Testing

  • Ran cd backend-api && uv lock --check, which failed initially because pyproject.toml changed and the lockfile needed refresh.
  • Ran cd backend-api && uv lock to refresh the lockfile, which completed successfully.
  • Reran cd backend-api && uv lock --check, which completed successfully and validated the updated lockfile.

Codex Task

* feat: late fusion search with RRF and disk-cached text FAISS index

Build a separate text FAISS index alongside the image index during
rebuild, using the existing caption/OCR text embeddings stored in S3.
The text index is cached on disk but only loaded into memory lazily
on first use, keeping the default startup fast.

Search now supports a `mode` query parameter (image/text/hybrid).
In hybrid mode (the default), both indexes are queried independently
with the same text embedding and results are merged using Reciprocal
Rank Fusion (score = 1/(rank+k), k=60).

Closes #9

* fix: fetch text index artifacts independently of image index cache

Text index files were only downloaded inside the `if not index_file.exists()`
guard, so nodes that already had the image index cached from before text
indexes existed would never fetch text_index.faiss. This caused
has_text_index() to report false and hybrid mode to silently degrade
to image-only.

Move text artifact fetching to its own `if not text_index_local.exists()`
block that runs unconditionally.

* fix: skip mismatched text embeddings instead of aborting index build

A single _text.npy with a wrong dimension caused a NumPy broadcast
error that killed the entire rebuild. Since text indexing is optional,
log a warning and skip the bad vector so the image index (and the rest
of the text index) still gets built.

* feat: add text meta

* chore: tuning notebook

* chore: setup nbstripout

* fix: one off rrf, text index check

* fix: exception handle

* chore: add basic tests

* chore: test actions

* chore: branding

* fix: missing mode param in test
)

* Bump FastAPI baseline and add explicit response models

* fix: match with orm schema
previously were using the temporal cli on vms, i dont like setting it up anymore
fix search request model
added a load more button, however api doesnt properly return a has_more flag (TODO)
@listlessbird

Copy link
Copy Markdown
Owner Author

in the light of recent litellm package compromise

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant