mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
9579567b7d
## What Loosen over-pinned Python dependency constraints and add missing upper bounds in `pyproject.toml`. Also bump the neo4j Docker image and uv builder version. ## Why Several dependencies had constraints that either blocked security patches or allowed silent major-version jumps: - `litellm==1.82.3` was an exact pin — every security patch release requires a manual lockfile bump - `transformers`, `sentence-transformers` had no upper bound and have already crossed major version boundaries without a constraint gate - `neo4j>=5.20.0` had no upper cap; the driver has already reached 6.x in the wild - `mem0ai>=0.1.100` had a pre-1.0 floor while the locked version is already 1.0.11 - `langchain-core`, `langchain-openai`, `qdrant-client`, `uvicorn` had no upper bound on a range with active major-version churn - `docker-compose.yml` pinned neo4j at `5.15.0`, which is 11 patch releases behind the current 5.x LTS - `Dockerfile` pinned uv at `0.11.16`; latest stable is `0.11.18` ## How Constraint changes only — no code changes, no `uv lock --upgrade`. The existing locked versions all satisfy the new bounds (we added caps, not floors). `uv` re-resolved the lockfile to format revision 3 (adds `upload-time` metadata fields) and cleaned up the defunct `llmlingua` extra entries. | Dependency | Before | After | |---|---|---| | `litellm` | `==1.82.3` | `>=1.82.3,<2.0` | | `transformers` | `>=4.30.0` | `>=4.30.0,<6.0` | | `sentence-transformers` | `>=2.2.0` | `>=2.2.0,<6.0` | | `neo4j` | `>=5.20.0` | `>=5.20.0,<7.0` | | `mem0ai` | `>=0.1.100` | `>=1.0.0,<2.0` | | `langchain-core` | `>=0.2.0` | `>=0.2.0,<4.0` | | `langchain-openai` | `>=0.1.0` | `>=0.1.0,<2.0` | | `qdrant-client` | `>=1.9.0` | `>=1.9.0,<2.0` | | `uvicorn` | `>=0.23.0` | `>=0.23.0,<1.0` | | neo4j Docker image | `5.15.0` | `5.26` | | uv (Dockerfile ARG) | `0.11.16` | `0.11.18` | ## Breaking changes None. All currently installed versions fall within the new ranges. Installers that previously resolved `litellm` to an older exact pin may now resolve newer patch releases — which is the desired behavior. --------- Co-authored-by: Tejas Chopra <chopratejas@gmail.com>
50 lines
1.3 KiB
YAML
50 lines
1.3 KiB
YAML
services:
|
|
headroom-proxy:
|
|
build: .
|
|
command: ["--host", "0.0.0.0"]
|
|
environment:
|
|
- HEADROOM_HOST=0.0.0.0
|
|
# if you want to use a custom OpenAI-compatible API endpoint,
|
|
# uncomment and set the following line with the desired URL
|
|
# - OPENAI_TARGET_API_URL=https://api.x.ai
|
|
ports:
|
|
- "8787:8787"
|
|
healthcheck:
|
|
test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:8787/readyz"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
depends_on:
|
|
- qdrant
|
|
- neo4j
|
|
|
|
# Vector database for semantic search
|
|
qdrant:
|
|
image: qdrant/qdrant:v1.17.1
|
|
ports:
|
|
- "6333:6333" # REST API
|
|
- "6334:6334" # gRPC
|
|
volumes:
|
|
- qdrant_data:/qdrant/storage
|
|
environment:
|
|
- QDRANT__SERVICE__GRPC_PORT=6334
|
|
|
|
# Graph database for relationships and multi-hop reasoning
|
|
neo4j:
|
|
image: neo4j:5.26
|
|
ports:
|
|
- "7474:7474" # HTTP (Browser)
|
|
- "7687:7687" # Bolt
|
|
volumes:
|
|
- neo4j_data:/data
|
|
environment:
|
|
- NEO4J_AUTH=${NEO4J_AUTH:-neo4j/devpassword}
|
|
- NEO4J_PLUGINS=["apoc"]
|
|
- NEO4J_apoc_export_file_enabled=true
|
|
- NEO4J_apoc_import_file_enabled=true
|
|
- NEO4J_apoc_import_file_use__neo4j__config=true
|
|
|
|
volumes:
|
|
qdrant_data:
|
|
neo4j_data:
|