pyproject.toml
Rama main · réplica de lectura del repositorio original.
[project]
name = "ragflow"
version = "1.0.0"
description = "[RAGFlow](https://ragflow.io/) is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. It offers a streamlined RAG workflow for businesses of any scale, combining LLM (Large Language Models) to provide truthful question-answering capabilities, backed by well-founded citations from various complex formatted data."
authors = [{ name = "Zhichang Yu", email = "yuzhichang@gmail.com" }]
license-files = ["LICENSE"]
readme = "README.md"
requires-python = ">=3.13,<3.14"
dependencies = [
"beartype>=0.20.0,<1.0.0",
"elasticsearch-dsl==8.12.0",
"json-repair==0.60.1",
"mysql-connector-python>=9.0.0,<10.0.0",
"werkzeug>=3.1.9,<4",
"regex>=2025.11.3",
"reportlab>=4.4.1",
"scholarly==1.7.11",
"peewee>=3.17.1,<4.0.0",
"aiohttp>=3.14.4",
]
[dependency-groups]
test = [
"hypothesis>=6.132.0",
"openpyxl>=3.1.5",
"pillow>=13.0.0,<14.0.0",
"pytest>=8.3.5",
"pytest-asyncio>=1.3.0",
"pytest-xdist>=3.8.0",
"pytest-cov>=7.0.0",
"python-docx>=1.1.2",
"python-pptx>=1.0.2",
"reportlab>=4.4.1",
"requests>=2.32.2",
"requests-toolbelt>=1.0.0",
"pycryptodomex==3.20.0",
"pytest-playwright>=0.7.2",
"codecov>=2.1.13",
]
[tool.uv]
constraint-dependencies = [
# CVE-2026-30922: Denial of Service via unbounded recursion in ASN.1 decoding (CVSS 7.5 HIGH)
# CVE-2026-59884, CVE-2026-59885, CVE-2026-59886: additional HIGH vulnerabilities fixed in 0.6.4
# pyasn1 < 0.6.4 is vulnerable; pulled in transitively via google-auth / rsa / pyasn1-modules
"pyasn1>=0.6.4",
# Python 3.13 added pathlib.PurePath.parser as a public class attribute holding
# the posixpath/ntpath module. trio<0.26 introspects all Path class attributes to
# generate async forwards and raises TypeError on any non-callable attribute it
# encounters (fixed in trio 0.26 by skipping non-callables). Pulled in transitively
# via selenium-wire -> trio-websocket -> trio.
"trio>=0.26.0",
# CVE-2026-44431: Cross-origin redirects in urllib3's low-level API may forward sensitive credential
# headers to unintended hosts. (CVSS 5.3)
# CVE-2026-44432: Decompression flaw in urllib3's streaming API can lead to client-side denial of service
# through excessive resource consumption. (CVSS 8.9)
# urllib3 < 2.7.0 is vulnerable, pulled in transitively via requests, minio, akshare, and others
"urllib3>=2.7.0",
# CVE-2026-41066: lxml < 6.1.0 vulnerable; pulled in transitively via html-text,
# readability-lxml, akshare, crawl4ai, duckduckgo-search, and others
"lxml>=6.1.1",
# CVE-2026-49825, CVE-2026-28348, CVE-2026-28350: lxml_html_clean < 0.4.5 vulnerable;
# pulled in transitively via html-text, readability-lxml
"lxml_html_clean>=0.4.5",
# inscriptis 2.7.0 pins lxml<6.0.0, blocking the lxml CVE fix;
# 2.7.3 relaxes to <6.2.0. Pulled in transitively via ir-datasets -> ranx
"inscriptis>=2.7.3",
# CVE-2025-14009 (CRITICAL), CVE-2026-0846, CVE-2026-0847, CVE-2026-33231,
# CVE-2026-33236, CVE-2026-54293 (HIGH), CVE-2026-33230 (MEDIUM):
# nltk < 3.10.0 vulnerable; pulled in transitively via crawl4ai, infinity-sdk
"nltk>=3.10.0",
# CVE-2026-0994: protobuf < 5.29.6 vulnerable; pulled in transitively via
# google-api-core, googleapis-common-protos, grpcio-status, opentelemetry-proto
"protobuf>=5.29.6",
# CVE-2026-59939: httplib2 < 0.32.0 vulnerable; pulled in transitively via
# google-api-python-client, google-auth-httplib2
"httplib2>=0.32.0",
# CVE-2025-67221: orjson < 3.11.6 vulnerable; pulled in transitively via
# langgraph-sdk, langsmith, ranx. Previously blocked by mistralai==0.4.2
# pinning orjson<3.11
"orjson>=3.11.6",
# CVE-2026-26209: cbor2 < 5.9.0 vulnerable; pulled in transitively via ranx
"cbor2>=5.9.0",
# CVE-2026-21226: azure-core < 1.38.0 vulnerable; pulled in transitively via
# azure-identity, azure-storage-blob, azure-storage-file-datalake
"azure-core>=1.38.0",
# CVE-2026-33752: curl_cffi < 0.15.0 vulnerable; pulled in transitively via
# akshare, yfinance
"curl_cffi>=0.15.0"
]
exclude-dependencies = [
# crawl4ai>=0.8.6 depends on unclecode-litellm, which installs the same
# `litellm` package namespace as upstream litellm and can corrupt imports.
"unclecode-litellm",
# Transitive dep of agentrun-sdk; not imported anywhere in RAGFlow code.
"agentrun-mem0ai",
]
override-dependencies = [
# moodlepy<=0.24.1 pins attrs<23.0.0, but trio>=0.26.0 requires attrs>=23.2.0.
# attrs 23.x is backward-compatible; moodlepy works fine at runtime with it.
"attrs>=23.2.0",
# numpy 1.26.x has no cp313 wheels on PyPI; uv then builds from source (often fails on
# Windows, see infiniflow/ragflow#19928). graspologic pins numpy<2 but works on 2.x.
# Cap at <2.4: numba (via hyppo/graspologic) requires numpy<=2.3.
"numpy>=2.1.0,<2.4.0",
]
# trio 0.26+ (Python 3.13 compatible) is not yet on the Aliyun mirror.
# Mark PyPI as explicit so it is used only for packages listed in [tool.uv.sources].
[[tool.uv.index]]
name = "pypi"
url = "https://pypi.org/simple"
explicit = true
[[tool.uv.index]]
url = "https://mirrors.aliyun.com/pypi/simple"
[tool.uv.sources]
trio = [{ index = "pypi" }]
[tool.setuptools]
packages = [
'agent',
'api',
'deepdoc',
'rag.graphrag',
'tools.chatgpt_on_wechat.plugins',
'mcp.server',
'rag',
'sdk.python.ragflow_sdk',
]
# tools/ holds standalone Python projects whose names contain hyphens
# (chatgpt-on-wechat). Python package names cannot contain hyphens, so
# we map the underscored Python name to the hyphenated filesystem path.
[tool.setuptools.package-dir]
"tools.chatgpt_on_wechat.plugins" = "tools/chatgpt-on-wechat/plugins"
[tool.ruff]
line-length = 200
exclude = [".venv"]
[tool.ruff.lint]
extend-select = ["ASYNC", "ASYNC1"]
ignore = ["E402"]
[tool.pytest.ini_options]
pythonpath = [
"."
]
testpaths = ["test"]
python_files = ["test_*.py"]
python_classes = ["Test*"]
python_functions = ["test_*"]
markers = [
"p0: critical priority test cases",
"p1: high priority test cases",
"p2: medium priority test cases",
"p3: low priority test cases",
"smoke: smoke test cases",
"auth: authentication UI tests",
"asyncio: mark test as async",
]
# Test collection and runtime configuration
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
filterwarnings = [
"error", # Treat warnings as errors
"ignore::DeprecationWarning", # Ignore specific warnings
"ignore:pkg_resources is deprecated:UserWarning",
]
# Command line options
addopts = [
"-v", # Verbose output
"--strict-markers", # Enforce marker definitions
"--tb=short", # Simplified traceback
"--disable-warnings", # Disable warnings
"--color=yes", # Colored output
"-p",
"no:anyio", # anyio's pytest plugin conflicts with pytest-asyncio on Py3.13
]
# Coverage configuration
[tool.coverage.run]
# Source paths - adjust according to your project structure
source = [
# "../../api/db/services",
# Add more directories if needed:
"../../common",
# "../../utils",
]
# Files/directories to exclude
omit = [
"*/tests/*",
"*/test_*",
"*/__pycache__/*",
"*/.pytest_cache/*",
"*/venv/*",
"*/.venv/*",
"*/env/*",
"*/site-packages/*",
"*/dist/*",
"*/build/*",
"*/migrations/*",
"setup.py"
]
[tool.coverage.report]
# Report configuration
precision = 2
show_missing = true
skip_covered = false
fail_under = 0 # Minimum coverage requirement (0-100)
# Lines to exclude (optional)
exclude_lines = [
# "pragma: no cover",
# "def __repr__",
# "raise AssertionError",
# "raise NotImplementedError",
# "if __name__ == .__main__.:",
# "if TYPE_CHECKING:",
"pass"
]
[tool.coverage.html]
# HTML report configuration
directory = "htmlcov"
title = "Test Coverage Report"
# extra_css = "custom.css" # Optional custom CSS