diff --git a/.github/workflows/release_bundles.yml b/.github/workflows/release_bundles.yml index 87e87a2047..17a89edb4a 100644 --- a/.github/workflows/release_bundles.yml +++ b/.github/workflows/release_bundles.yml @@ -65,9 +65,9 @@ jobs: done echo "bundles-found=1" >> $GITHUB_OUTPUT ls -la bundles-dist/ - # Bundles pin lfx (e.g. lfx>=0.5.0,<0.6.0). The smoke test below + # Bundles floor lfx at >=0.5.0 (no upper bound). The smoke test below # installs the bundles in a fresh venv, so it needs an lfx wheel that - # satisfies the pin available locally — PyPI may not yet have a + # satisfies the floor available locally — PyPI may not yet have a # matching lfx published when bundles are released ahead of a main # release. We build the lfx wheel from the current ref so the smoke # test resolves against it; this artifact is not published. diff --git a/scripts/ci/update_bundle_versions.py b/scripts/ci/update_bundle_versions.py index 40b0726d47..f1be5a44d4 100644 --- a/scripts/ci/update_bundle_versions.py +++ b/scripts/ci/update_bundle_versions.py @@ -23,15 +23,15 @@ from pathlib import Path BASE_DIR = Path(__file__).parent.parent.parent # Matches the lfx dep specifier inside a bundle pyproject's dependencies list. -# Accepts the bundle default ("lfx>=X.Y.Z,=X.Y.Z" with an optional upper bound), +# legacy ~=/==, and the already-rewritten "lfx-nightly==X.Y.Z" form (idempotent). _LFX_DEP_PATTERN = re.compile( r'"lfx(?:-nightly)?' r"(?:" r"(?:~=|==)[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*" r"|" r">=[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*" - r",\s*<[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*" + r"(?:,\s*<[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*)?" r')"' ) diff --git a/scripts/ci/update_lfx_version.py b/scripts/ci/update_lfx_version.py index 25a6e391e8..4893fb4674 100644 --- a/scripts/ci/update_lfx_version.py +++ b/scripts/ci/update_lfx_version.py @@ -60,8 +60,8 @@ _BUNDLE_LFX_DEP_PATTERN = re.compile(r'"lfx(?:-nightly)?(?=[<>=!~])[^"]*"') def update_lfx_dep_in_bundles(lfx_version: str) -> None: """Pin every bundle's `lfx` dep to the renamed `lfx-nightly==`. - Each `src/bundles/*/pyproject.toml` declares an `lfx>=X.Y,=X.Y` + (no upper bound) against the published `lfx` package. During nightly builds the workspace `lfx` package gets renamed to `lfx-nightly`, so those pins no longer resolve against the workspace member — and PyPI may not yet ship a matching `lfx` either. Rewrite each bundle's pin to diff --git a/scripts/migrate/port_bundle.py b/scripts/migrate/port_bundle.py index fd2c1b99c2..149b6cda0b 100755 --- a/scripts/migrate/port_bundle.py +++ b/scripts/migrate/port_bundle.py @@ -86,8 +86,11 @@ keywords = ["langflow", "lfx", "extension", "bundle", "{bundle}"] # Runtime deps: lfx (the BUNDLE_API surface) plus any third-party imports # the bundle's components rely on. REVIEW THIS LIST -- the script ports # only ``lfx``; add any other deps the moved component(s) import. +# lfx is floored at >=0.5.0 (the release that introduced extension bundles) +# with no upper bound so bundles track the latest lfx; BUNDLE_API compat is +# enforced via extension.json's lfx.compat list, not an upper version cap. dependencies = [ - "lfx>=0.5.0,<0.6.0", + "lfx>=0.5.0", ] [project.urls] diff --git a/src/bundles/PORTING.md b/src/bundles/PORTING.md index b71e1c7bf3..d789216112 100644 --- a/src/bundles/PORTING.md +++ b/src/bundles/PORTING.md @@ -67,9 +67,13 @@ src/bundles// Copy [`src/bundles/duckduckgo/pyproject.toml`](duckduckgo/pyproject.toml) and substitute names + the runtime-dep block. The non-obvious bits: -- `dependencies` lists every runtime dep the component imports. Pin `lfx` - to a range that covers the `BUNDLE_API_VERSION` you target - (currently `>=0.5.0,<0.6.0`). +- `dependencies` lists every runtime dep the component imports. Floor `lfx` + at `>=0.5.0` (the release that introduced extension bundles) with **no + upper bound**, so the bundle always resolves the latest available `lfx` — + BUNDLE_API compatibility is enforced separately via `extension.json`'s + `"lfx": {"compat": [...]}` contract, not an upper version cap. A bundle + author *may* tighten this if a component needs a specific newer `lfx`, but + the default carries no ceiling. - **Platform-gated deps:** if a runtime dep has no wheel on some platform (e.g. `ibm-db` ships none for linux/aarch64), gate it with a PEP 508 marker so `pip install langflow` still succeeds there, e.g. diff --git a/src/bundles/arxiv/pyproject.toml b/src/bundles/arxiv/pyproject.toml index 3745610975..3fcd7bcb8d 100644 --- a/src/bundles/arxiv/pyproject.toml +++ b/src/bundles/arxiv/pyproject.toml @@ -15,7 +15,7 @@ keywords = ["langflow", "lfx", "extension", "bundle", "arxiv", "search"] # but we list it here as a direct runtime dep so the bundle keeps building # even if lfx drops it later. dependencies = [ - "lfx>=0.5.0,<0.6.0", + "lfx>=0.5.0", "defusedxml>=0.7.1,<1.0.0", ] diff --git a/src/bundles/duckduckgo/pyproject.toml b/src/bundles/duckduckgo/pyproject.toml index 63458c9aa1..0e708f53da 100644 --- a/src/bundles/duckduckgo/pyproject.toml +++ b/src/bundles/duckduckgo/pyproject.toml @@ -11,11 +11,14 @@ authors = [ keywords = ["langflow", "lfx", "extension", "bundle", "duckduckgo", "search"] # Runtime deps: lfx (the BUNDLE_API surface) and the langchain-community -# binding that wraps the duckduckgo-search Python client. We pin lfx to a -# range that includes the BUNDLE_API_VERSION=1 contract; langchain-community -# is the same range the lfx tree uses to keep co-installation lockstep. +# binding that wraps the duckduckgo-search Python client. lfx is floored +# at >=0.5.0 -- the release that introduced extension bundles -- with no +# upper bound, so the bundle resolves the latest available lfx; BUNDLE_API +# compatibility is enforced separately via extension.json's +# "lfx": {"compat": [...]} contract. langchain-community uses the same +# range the lfx tree does to keep co-installation lockstep. dependencies = [ - "lfx>=0.5.0,<0.6.0", + "lfx>=0.5.0", "langchain-community>=0.4.1,<1.0.0", "ddgs>=9.0.0", ] diff --git a/src/bundles/ibm/pyproject.toml b/src/bundles/ibm/pyproject.toml index 0c741b4ac1..519ed4490b 100644 --- a/src/bundles/ibm/pyproject.toml +++ b/src/bundles/ibm/pyproject.toml @@ -22,7 +22,7 @@ keywords = ["langflow", "lfx", "extension", "bundle", "ibm", "db2", "watsonx", " # the marker stays in lockstep with the langflow-base dep block. # * ``langchain-community`` provides the helpers DB2VS leans on. dependencies = [ - "lfx>=0.5.0,<0.6.0", + "lfx>=0.5.0", "langchain-community>=0.4.1,<1.0.0", "ibm-db>=3.2.9,<4.0.0; sys_platform != 'linux' or platform_machine != 'aarch64'", "ibm-watsonx-ai>=1.3.1,<2.0.0; python_version < '3.14'",