chore(deps): loosen over-pinned constraints and add upper bounds (#538)

## What Loosen over-pinned Python dependency constraints and add missing upper bounds in `pyproject.toml`. Also bump the neo4j Docker image and uv builder version. ## Why Several dependencies had constraints that either blocked security patches or allowed silent major-version jumps: - `litellm==1.82.3` was an exact pin — every security patch release requires a manual lockfile bump - `transformers`, `sentence-transformers` had no upper bound and have already crossed major version boundaries without a constraint gate - `neo4j>=5.20.0` had no upper cap; the driver has already reached 6.x in the wild - `mem0ai>=0.1.100` had a pre-1.0 floor while the locked version is already 1.0.11 - `langchain-core`, `langchain-openai`, `qdrant-client`, `uvicorn` had no upper bound on a range with active major-version churn - `docker-compose.yml` pinned neo4j at `5.15.0`, which is 11 patch releases behind the current 5.x LTS - `Dockerfile` pinned uv at `0.11.16`; latest stable is `0.11.18` ## How Constraint changes only — no code changes, no `uv lock --upgrade`. The existing locked versions all satisfy the new bounds (we added caps, not floors). `uv` re-resolved the lockfile to format revision 3 (adds `upload-time` metadata fields) and cleaned up the defunct `llmlingua` extra entries. | Dependency | Before | After | |---|---|---| | `litellm` | `==1.82.3` | `>=1.82.3,<2.0` | | `transformers` | `>=4.30.0` | `>=4.30.0,<6.0` | | `sentence-transformers` | `>=2.2.0` | `>=2.2.0,<6.0` | | `neo4j` | `>=5.20.0` | `>=5.20.0,<7.0` | | `mem0ai` | `>=0.1.100` | `>=1.0.0,<2.0` | | `langchain-core` | `>=0.2.0` | `>=0.2.0,<4.0` | | `langchain-openai` | `>=0.1.0` | `>=0.1.0,<2.0` | | `qdrant-client` | `>=1.9.0` | `>=1.9.0,<2.0` | | `uvicorn` | `>=0.23.0` | `>=0.23.0,<1.0` | | neo4j Docker image | `5.15.0` | `5.26` | | uv (Dockerfile ARG) | `0.11.16` | `0.11.18` | ## Breaking changes None. All currently installed versions fall within the new ranges. Installers that previously resolved `litellm` to an older exact pin may now resolve newer patch releases — which is the desired behavior. --------- Co-authored-by: Tejas Chopra <chopratejas@gmail.com>
2026-08-27 14:17:10 -04:00 · 2026-06-09 02:06:24 -04:00 · 2026-06-09 02:06:24 -04:00 · 9579567b7d
commit 9579567b7d
parent 574bbae2cb
7 changed files with 4928 additions and 4853 deletions
--- a/.github/workflows/init-e2e.yml
+++ b/.github/workflows/init-e2e.yml
@ -1,42 +1,42 @@
-name: Init E2E
-
-on:
-  pull_request:
-    branches: [main]
-    paths:
-      - 'headroom/**'
-      - 'crates/**'
-      - 'docker/**'
-      - 'Dockerfile'
-      - 'e2e/**'
-      - 'scripts/install*'
-      - 'pyproject.toml'
-      - 'Cargo.toml'
-      - 'Cargo.lock'
-      - 'rust-toolchain.toml'
-      - 'uv.lock'
-      - '.claude-plugin'
-      - '.github/plugin/**'
-      - 'plugins/headroom-agent-hooks/**'
-      - '.github/workflows/init-e2e.yml'
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: init-e2e-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-jobs:
-  docker-init-e2e:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Build init e2e image
-        run: docker build -f e2e/init/Dockerfile -t headroom-init-e2e .
-
-      - name: Run init e2e container
-        run: docker run --rm headroom-init-e2e
+name: Init E2E
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'headroom/**'
+      - 'crates/**'
+      - 'docker/**'
+      - 'Dockerfile'
+      - 'e2e/**'
+      - 'scripts/install*'
+      - 'pyproject.toml'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'rust-toolchain.toml'
+      - 'uv.lock'
+      - '.claude-plugin'
+      - '.github/plugin/**'
+      - 'plugins/headroom-agent-hooks/**'
+      - '.github/workflows/init-e2e.yml'
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: init-e2e-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  docker-init-e2e:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Build init e2e image
+        run: docker build -f e2e/init/Dockerfile -t headroom-init-e2e .
+
+      - name: Run init e2e container
+        run: docker run --rm headroom-init-e2e
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -33,13 +33,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+### Changed
+
+* **deps:** loosen over-pinned constraints and add upper bounds
+  - `litellm==1.82.3` -> `>=1.86.2,<2.0` (exact pin blocked security patches; floor stays above the CVE-2026-42271 fix)
+  - `transformers>=4.30.0` -> `>=4.30.0,<6.0` (add upper bound; library already crossed a major version silently)
+  - `sentence-transformers>=2.2.0` -> `>=2.2.0,<6.0` (same; applied in `memory`, `evals`, and `dev` extras)
+  - `neo4j>=5.20.0` -> `>=5.20.0,<7.0` (client had already crossed the 5.x/6.x boundary)
+  - `mem0ai>=0.1.100` -> `>=1.0.0,<2.0` (floor was pre-1.0; locked package is already 1.0.11)
+  - `langchain-core>=0.2.0` -> `>=1.3.3,<4.0` (floor stays above current high-severity advisory fixes)
+  - `langchain-openai>=0.1.0` -> `>=1.1.14,<2.0` (floor stays above current advisory fixes)
+  - `qdrant-client>=1.9.0` -> `>=1.9.0,<2.0`
+  - `uvicorn>=0.23.0` -> `>=0.23.0,<1.0` (applied in `proxy` and `dev` extras)
+  - Same `transformers` and `litellm` bounds applied consistently across `ml`, `voice`, and `dev` extras
+* **docker:** bump `neo4j` image in `docker-compose.yml` from `5.15.0` to `5.26` (latest 5.x LTS)
+* **docker:** bump `UV_VERSION` in `Dockerfile` from `0.11.16` to `0.11.18`
+
 ### Bug Fixes


 * **deps:** move `gunicorn` to `[proxy-prod]` extra with `sys_platform != 'win32'` guard; removed from `[proxy]` to avoid forcing a Unix-only package on dev, CI, and Windows users ([#537](https://github.com/chopratejas/headroom/pull/537))
 * **startup:** suppress proxy startup log noise — litellm banner, trafilatura parse errors, HuggingFace Hub unauthenticated warnings, tiktoken fallback warning, and httpx INFO lines from sentence_transformers HEAD checks. Affected files: `headroom/providers/litellm.py`, `headroom/transforms/html_extractor.py`, `headroom/memory/adapters/embedders.py`, `headroom/providers/anthropic.py`, `headroom/providers/registry.py`, `headroom/image/onnx_router.py`, `headroom/transforms/kompress_compressor.py`.

-
 ## [0.23.0](https://github.com/chopratejas/headroom/compare/v0.22.4...v0.23.0) (2026-06-04)

 ### Features
--- a/2
+++ b/2
@ -1,5 +1,5 @@
 ARG PYTHON_VERSION=3.13
-ARG UV_VERSION=0.11.16
+ARG UV_VERSION=0.11.18
 ARG DISTROLESS_IMAGE=gcr.io/distroless/python3-debian13
 ARG PYTHON_SITE_PACKAGES=/usr/local/lib/python${PYTHON_VERSION}/site-packages

--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -32,7 +32,7 @@ services:

  # Graph database for relationships and multi-hop reasoning
  neo4j:
-    image: neo4j:5.15.0
+    image: neo4j:5.26
    ports:
      - "7474:7474"  # HTTP (Browser)
      - "7687:7687"  # Bolt
--- a/pyproject.toml
+++ b/pyproject.toml
@ -47,7 +47,7 @@ dependencies = [
    # Core: lightweight compression (SmartCrusher, ContentRouter, CCR, TOIN)
    "tiktoken>=0.5.0",            # Tokenizer for all compressors
    "pydantic>=2.0.0",            # Config and data models
-    "litellm==1.82.3",            # Model registry, pricing, and provider support
+    "litellm>=1.86.2,<2.0",        # Model registry, pricing, and provider support
    "click>=8.1.0",               # CLI framework
    "rich>=13.0.0",               # Rich terminal output
    "opentelemetry-api>=1.24.0",  # Safe no-op OTEL API for instrumentation
@ -59,7 +59,7 @@ dependencies = [
 # Proxy server (most common install: pip install headroom-ai[proxy])
 proxy = [
    "fastapi>=0.100.0",
-    "uvicorn>=0.23.0",
+    "uvicorn>=0.23.0,<1.0",
    "httpx[http2]>=0.24.0",
    "openai>=2.14.0",             # OpenAI API format support
    "mcp>=1.0.0",                 # MCP server (headroom_compress, retrieve, stats)
@ -67,7 +67,7 @@ proxy = [
    "zstandard>=0.20.0",          # Decompress zstd request bodies (Codex, etc.)
    "websockets>=13.0",           # WebSocket proxy for /v1/responses (Codex gpt-5.4+)
    "onnxruntime>=1.16.0",        # Kompress ONNX INT8 text compression (no torch needed)
-    "transformers>=4.30.0",       # Tokenizer only (for Kompress)
+    "transformers>=4.30.0,<6.0",  # Tokenizer only (for Kompress)
    "watchdog>=4.0.0",            # File watcher for live code graph reindexing (--code-graph)
    "sqlite-vec>=0.1.6",          # Vector index for memory (--memory). Lightweight, no torch.
 ]
@ -88,7 +88,7 @@ code = [
 # Use [ml] for the supported ML compression dependencies.)
 ml = [
    "torch>=2.0.0",
-    "transformers>=4.30.0",
+    "transformers>=4.30.0,<6.0",
    # transformers >= 5.x requires huggingface-hub >= 1.5.0,<2.0; pinning
    # the floor here prevents Kompress from silently falling back to
    # "unavailable" when a sibling install (e.g. `pip install
@ -99,13 +99,13 @@ ml = [
 memory = [
    "hnswlib>=0.8.0",
    "sqlite-vec>=0.1.6",
-    "sentence-transformers>=2.2.0",
+    "sentence-transformers>=2.2.0,<6.0",
 ]
 # Qdrant + Neo4j memory backend helpers
 memory-stack = [
-    "mem0ai>=0.1.100",
-    "qdrant-client>=1.9.0",
-    "neo4j>=5.20.0",
+    "mem0ai>=1.0.0,<2.0",
+    "qdrant-client>=1.9.0,<2.0",
+    "neo4j>=5.20.0,<7.0",
 ]
 # Semantic relevance scoring with embeddings.
 # Uses `fastembed` (BAAI/bge-small-en-v1.5 by default — 33M params,
@ -159,8 +159,8 @@ anyllm = [
 ]
 # LangChain integration
 langchain = [
-    "langchain-core>=0.2.0",
-    "langchain-openai>=0.1.0",
+    "langchain-core>=1.3.3,<4.0",
+    "langchain-openai>=1.1.14,<2.0",
 ]
 # Agno agent framework integration
 agno = [
@ -178,7 +178,7 @@ mcp = [
 # Voice filler detection
 voice = [
    "onnxruntime>=1.16.0",
-    "transformers>=4.30.0",
+    "transformers>=4.30.0,<6.0",
    "torch>=2.0.0",
 ]
 # Voice training (includes voice deps + training extras)
@ -190,7 +190,7 @@ voice-train = [
 # Evaluation framework
 evals = [
    "datasets>=2.14.0",
-    "sentence-transformers>=2.2.0",
+    "sentence-transformers>=2.2.0,<6.0",
    "numpy>=1.24.0",
    "scikit-learn>=1.3.0",
    "anthropic>=0.18.0",
@ -220,9 +220,9 @@ dev = [
    "pre-commit>=3.0.0",
    "openai>=1.0.0",
    "anthropic>=0.18.0",
-    "litellm==1.82.3",
+    "litellm>=1.86.2,<2.0",
    "fastapi>=0.100.0",
-    "uvicorn>=0.23.0",
+    "uvicorn>=0.23.0,<1.0",
    "httpx[http2]>=0.24.0",
    "websockets>=13.0",
    "opentelemetry-sdk>=1.24.0",
@ -231,7 +231,7 @@ dev = [
    "langchain-ollama>=0.2.0",
    "hnswlib>=0.8.0",
    "sqlite-vec>=0.1.6",
-    "sentence-transformers>=2.2.0",
+    "sentence-transformers>=2.2.0,<6.0",
    "numpy>=1.24.0",
 ]
 # All optional dependencies (everything you need)
--- a/uv.lock
+++ b/uv.lock