Skip to content

build(deps): move ragas and langchain to a dokimi[ragas] extra - #126

Merged
vchamarthi merged 2 commits into
intel:mainfrom
vchamarthi:deps-ragas-extra
Oct 19, 2026
Merged

vchamarthi merged 2 commits into
intel:mainfrom
vchamarthi:deps-ragas-extra

Conversation

@vchamarthi

Copy link
Copy Markdown
Contributor

Summary

A plain pip install dokimi now gets only what most commands need. RAGAS and the LangChain packages it uses become an opt-in extra, because only eval ragas and answers generate --ragas touch them.

 [project] dependencies
   PyYAML, jsonschema, litellm, httpx, numpy, scipy, PyGithub, datasets, openai
-  ragas, langchain-community, langchain-anthropic, langchain-openai, langchain-core

 [project.optional-dependencies]
+ ragas = [ragas, langchain-community, langchain-anthropic, langchain-openai, langchain-core]
  dev   = [..., dokimi[ragas]]

Why now: this is needed for the conda-forge package (Part of #123). With these packages in the core list, conda-forge cannot build an environment that satisfies all of them. It has no langchain-community 0.4.0 or 0.4.1, so the <0.4.2 cap pushes the solver to 0.3.x, which needs anthropic<1. Before #109 removed the direct anthropic~=1.12 pin, the solve failed outright. After #109 it succeeds, but it lands on older releases than pip does (ragas 0.3.1, langchain-community 0.3.31) that our CI never tests. With the extra, the core list solves on conda-forge with no LangChain at all, and pip and conda users get the same core.

Changes

  • pyproject.toml: the five packages move to a new ragas extra, with their version caps and reasons unchanged. dev pulls it in, so contributors and the test suite still get them.
  • eval ragas and answers generate --ragas without the extra stop with an error. The error names the missing module and says pip install 'dokimi[ragas]'.
  • The import-failure hints in eval/ragas_eval.py point at the extra instead of the lock file.
  • Docs: the extras list in CONTRIBUTING.md and the quickstart troubleshooting row.
  • requirements.txt and the lock are unchanged. CI and make dev keep installing RAGAS.

What breaks

  • Anyone who installs with plain pip install dokimi and runs eval ragas or answers generate --ragas must now install dokimi[ragas].
  • Without the extra, those two commands exit 1. Before, a failed RAGAS import printed a warning and exited 0, which reads as success. On answers generate --ragas, the answers are saved before the exit.
  • Code that imported ragas or langchain_* from dokimi's environment without declaring them must install them itself.
  • Nothing changes for a checkout installed with pip install -e ".[dev]" or from the lock.

Evidence

  • Before: a conda-forge dry-run solve of main's core dependencies (before ci(deps): deptry gate for unused, missing and misplaced dependencies #109) fails with LibMambaUnsatisfiableError on langchain-community <0.4.2 against anthropic >=1.12,<2. After ci(deps): deptry gate for unused, missing and misplaced dependencies #109, the solve succeeds but picks ragas 0.3.1 and langchain-community 0.3.31.
    After: the same solve of this branch's core dependencies succeeds with no LangChain or ragas packages.
  • Wheel built from this branch, installed into a clean Python 3.11 venv with no extras:
    • scripts/smoke_installed.py --expect-version 0.1.0: every check ok.
    • Every module under dokimi imports with ragas absent.
    • dokimi eval ragas --answers a.json exits 1 with ... could not import ragas: No module named 'ragas'. Install the ragas extra: pip install 'dokimi[ragas]'.
    • dokimi[ragas] resolves (langchain-community 0.4.1, langchain-core 1.6.12).
  • New test test_ragas_without_the_extra_exits_with_the_install_command: ragas blocked in sys.modules, _run_ragas_eval raises SystemExit with the install command and writes no _ragas.json.
  • Full suite on Linux, Python 3.13, installed from the lock: 5219 passed, 1 skipped. ruff check, mypy, deptry and config_check pass.

Merge Danger

Door: two-way. Moving the packages back into dependencies reverts it, and nothing is published by merging.

Blast Radius: install

Only plain pip install dokimi users of the two RAGAS commands are affected. No release has shipped yet, so if this lands before 0.1.0, no published version ever had RAGAS in its core dependencies.

Checklist

  • Tests added/updated and pytest passes
  • ruff, mypy, and schema checks pass
  • Docs updated (or N/A): see the docs-drift checklist in CONTRIBUTING.md
  • No ad-hoc run artifacts committed
  • New files carry the SPDX license header (or are exempt in .github/.licenserc.yaml)

Copilot AI balanced review requested due to automatic review settings October 19, 2026 16:30

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The focused dependency split, error handling, documentation, and regression coverage are consistent, with no blocking issues identified.

No open issues 🎉

What changed in this PR

Moves RAGAS and LangChain into an optional extra, keeping core installs smaller and supporting conda-forge packaging.

Changes:

  • Adds dokimi[ragas], included automatically by the dev extra.
  • Makes missing RAGAS dependencies produce a nonzero exit with installation guidance.
  • Adds regression coverage and updates documentation.
File Description
dokimi/​tests/​test_ragas_runtime.py Tests missing-extra failure and installation guidance.
dokimi/​pyproject.toml Moves five dependencies into the ragas extra.
dokimi/​dokimi/​eval/​ragas_eval.py Updates dependency installation hints.
dokimi/​dokimi/​commands/​evaluate.py Exits with an error on import failure.
dokimi/​docs/​quickstart.md Documents the optional RAGAS installation.
dokimi/​CONTRIBUTING.md Lists the extra and its inclusion in dev.
dokimi/​changelog.d/​20261019_120000_vchamarthi_ragas-extra.md Records installation and exit-behavior changes.

Review effort: Balanced

@codecov-commenter

codecov-commenter commented Oct 19, 2026 •

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.28%. Comparing base (093cb4b) to head (2a41c2c).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
dokimi/dokimi/commands/evaluate.py 87.50% 0 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #126      +/-   ##
==========================================
+ Coverage   90.27%   90.28%   +0.01%     
==========================================
  Files         206      206              
  Lines       24351    24356       +5     
  Branches     3921     3923       +2     
==========================================
+ Hits        21982    21991       +9     
+ Misses       1703     1698       -5     
- Partials      666      667       +1     
Files with missing lines Coverage Δ
dokimi/dokimi/commands/answers.py 59.25% <100.00%> (+1.03%) ⬆️
dokimi/dokimi/eval/ragas_eval.py 71.72% <ø> (+1.37%) ⬆️
dokimi/dokimi/commands/evaluate.py 77.09% <87.50%> (+0.87%) ⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@vchamarthi

Copy link
Copy Markdown
Contributor Author

Why an extra

  • Tradeoff: eval ragas and answers generate --ragas users install dokimi[ragas]; everyone else gets a smaller install.
  • Opt-in already: only those two commands use RAGAS, --ragas is off by default, and every import of it is inside a function.
  • Size: a plain install resolves to 76 packages, dokimi[ragas] to 130.
  • No end date: the newest ragas (0.4.3) still imports langchain_community.chat_models.vertexai, which langchain-community 0.4.2 removed.
  • conda-forge: with no langchain-community 0.4.0 or 0.4.1 there, conda falls back to ragas 0.3.1 and langchain-community 0.3.31, which CI never tests.
  • Effect: it runs, but answer_relevancy differs: 0.3.1 zeroes the score when any generated question is noncommittal, 0.3.9 only when all are.
  • Future: once ragas drops that import the pin can go, and the extra stays because RAGAS is opt-in.

pip install dokimi no longer installs ragas, langchain-community,
langchain-anthropic, langchain-openai or langchain-core. eval ragas and
answers generate --ragas need the extra and exit with the install command
when it is missing. The dev extra includes it.

Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>

@antonwolfy antonwolfy left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. The split is clean: the caps and their reasons moved intact, dev still pulls the extra in, and the new test fails without the except ImportError clause. A few nits inline.

What I ran, on a Linux review host at aa7a784:

  • make ci-local: 20 passed, 0 failed, 4 skipped (docker/network/PR-condition jobs); 5222 tests passed, 1 skipped; changed-line coverage 100% (2 lines). deptry, mypy, the wheel smoke test and mkdocs build pass.
  • Reproductions with the RAGAS transport mocked. The new test passes at the head and fails with DID NOT RAISE SystemExit when the evaluate.py change is reverted.

Checked, no issues

  • Exit path: _run_ragas_eval has two callers, cmd_eval_ragas and answers generate. Neither catches SystemExit, and EmptyQuestionError is still handled first (exit 2).
  • Answers saved first: answers.py writes the answers before it calls _run_ragas_eval, as the description says.
  • Imports: no module under dokimi/ imports ragas or langchain_* at module level, so a plain install imports everything.
  • Packaging: CI installs from the lock, which still has the five packages, so the test, typecheck and deptry jobs keep RAGAS. The changelog fragment matches the scriv format.

One more nit outside the diff: the comment in [tool.deptry.per_rule_ignores] (pyproject.toml:133) still says "see the comment in [project]", but the langchain-community cap comment now sits under the ragas extra.

Comment thread dokimi/dokimi/commands/evaluate.py Resolved
Comment thread dokimi/dokimi/commands/evaluate.py Resolved
Comment thread dokimi/docs/quickstart.md Resolved
@vchamarthi vchamarthi mentioned this pull request Oct 19, 2026
5 tasks done
Copilot AI balanced review requested due to automatic review settings October 19, 2026 17:08
- eval ragas and answers generate --ragas exit before any model call when ragas is not installed
- import-failure hints say when the extra is the fix
- README lists the ragas extra; deptry comment points at it

Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>
@vchamarthi

Copy link
Copy Markdown
Contributor Author

Deptry comment (pyproject.toml:133): fixed in 2a41c2c, it points at the ragas extra.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The dependency split, early failure handling, documentation, and regression tests are consistent, with no unresolved findings.

No open issues 🎉

Review effort: Balanced

@vchamarthi
vchamarthi merged commit dcf4645 into intel:main Oct 19, 2026
27 of 29 checks passed
@vchamarthi
vchamarthi deleted the deps-ragas-extra branch October 19, 2026 17:44
vchamarthi added a commit to vchamarthi/dokimi that referenced this pull request Oct 19, 2026
Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>
vchamarthi added a commit that referenced this pull request Oct 19, 2026
* release: 0.1.0

- CHANGELOG.md: 0.1.0 section, fragments collected
- README and quickstart: pip install dokimi
- releasing.md: python_min for the conda-forge recipe

Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>

* release: collect the #126 and #127 fragments into 0.1.0

Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>

---------

Signed-off-by: vchamarthi <venkata.sai.gireesh.chamarthi@intel.com>
@vchamarthi vchamarthi mentioned this pull request Oct 19, 2026
6 tasks done
xaleryb added a commit to xaleryb/dokimi that referenced this pull request Oct 27, 2026
The fragment named CVE IDs that do not exist and said pip install dokimi stopped installing ragas, which was already true since intel#126. It now says what this PR changes: the locks lose ragas, langchain and diskcache, and the extra stays covered by test-latest.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>
napetrov pushed a commit that referenced this pull request Oct 28, 2026
…#245)

* fix(deps): remove ragas from main requirements to fix CVE reports

ragas is already optional in pyproject.toml (dokimi[ragas] extra).
requirements.txt should not contain it; lock files are regenerated
from it. This removes CVE reports for ragas and diskcache.

After this change:
- pip install dokimi: the base install, without ragas
- pip install dokimi[ragas]: adds the `eval ragas` functionality
- pip install dokimi[dev]: for development (includes the ragas extra)

All code protections (_require_ragas checks) are already in place.

Fixes: CVE-2026-2447, CVE-2026-3046

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* test(deps): declare markdown-it-py for the docs hook tests

tests/test_docs_hooks.py imports markdown_it. It reached the lock only through ragas -> rich, so with ragas out of the lock the module's tests would silently skip.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* build(deps): regenerate the locks without ragas

Each lock is compiled with the command its header records. The main lock loses ragas, langchain-* and everything only they pulled in (diskcache, gitpython, pillow, instructor, rich, ...); markdown-it-py stays, now from requirements-test.txt. The tools and docs locks keep their headers; the tools lock changes only in its via comments, the docs lock is unchanged from main.

gitpython and pillow are no longer in the main lock, so their --exclude-newer-package exemptions go too; certifi's stays.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* test(ragas): run the ragas tests without the extra installed

test_ragas_falls_back_to_the_default_judge_for_an_unsupported_provider stubbed ragas.llms and the langchain chat models but not langchain_core.language_models, so it needed the real package. The real-import guard in test_ragas_runtime skips when ragas is not installed, and fails instead when DOKIMI_REQUIRE_RAGAS=1, so the job that installs the extra cannot lose it silently.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* ci: install the ragas extra in test-latest and require the real import

With ragas out of requirements.txt and the lock, the weekly test-latest job is where eval ragas runs on real packages. It installs the [ragas] extra and sets DOKIMI_REQUIRE_RAGAS=1, so test_ragas_runtime fails there instead of skipping. The job is unpinned, so this adds no manifest Dependabot reads.

The 3.13 comment said scikit-network came in through ragas for every install; only the extra pulls it in now.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* docs(security): drop the ragas and diskcache advisories from the lock ignore lists

PYSEC-2026-2447 (diskcache) and PYSEC-2026-3046 (ragas) are no longer reported against any lock, so pip-audit.yml and osv-scanner.toml stop ignoring them. SECURITY.md keeps why neither affects the optional [ragas] extra, which installs ragas 0.3.9 and diskcache 5.6.3.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* docs(changelog): describe the ragas lock change under Security

The fragment named CVE IDs that do not exist and said pip install dokimi stopped installing ragas, which was already true since #126. It now says what this PR changes: the locks lose ragas, langchain and diskcache, and the extra stays covered by test-latest.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* test(agent-eval): leave the real ragas import out of the regression run

The eval image is built from the lock, which no longer has ragas, and the task workspaces start at commits older than the test's skip, so fix-degrade-pre's regress_pass failed on test_ragas_imports_and_evaluator_builds_from_installed_deps. It is deselected like the timing-sensitive tests; test-latest runs it with the extra installed.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

* test(ragas): pin the DOKIMI_REQUIRE_RAGAS fail and skip branches

Signed-off-by: Anton Volkov <antonwolfy@gmail.com>

* test(ragas): a skipped guard fails the guard test instead of skipping it

With pytest.fail replaced by pass under DOKIMI_REQUIRE_RAGAS=1, the check went on to pytest.skip; pytest.raises(pytest.fail.Exception) let the Skipped through, so the guard test skipped and the suite stayed green. Both outcomes are caught now and the type is asserted.

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>

---------

Signed-off-by: Alexander Rybkin <alexander.rybkin@intel.com>
Signed-off-by: Anton Volkov <antonwolfy@gmail.com>
Co-authored-by: Anton Volkov <antonwolfy@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants