uv lock --upgrade under a new supply-chain cooldown (exclude-newer = "7 days"): releases younger than a week never enter the lock, so a hijacked or yanked-within-days upload can't land on day one. 158 packages move; the advisory set clears entirely (trivy 0.76.0 on uv.lock + pyproject.toml: 32 findings -> 0): aiohttp 3.14.3 -> 3.14.5 pyjwt 2.13.0 -> 2.15.1 urllib3 2.7.0 -> 2.8.0 oauthlib 3.3.1 -> 4.0.0 certifi 2026.1.4 -> 2026.10.19 fsspec 2026.2.0 -> 2026.9.0 multidict 6.7.1 -> 6.9.1 opentelemetry-* 1.40.0 -> 1.45.1 pillow 12.1.1 -> 13.0.0 pyproject floors raised for the direct deps that carried advisories (pyjwt, fsspec, opentelemetry-api/-sdk). The cooldown lives in [tool.uv], and uv.toml is folded into it: uv ignores [tool.uv] whenever a uv.toml exists, and the images copy only pyproject.toml + uv.lock — the lock records the span, so `uv sync --locked` fails anywhere the setting isn't visible. Held deliberately: - pymupdf <2: 2.x folds the former pymupdf_layout code (Polyform Noncommercial / Artifex commercial) into the core wheel and pulls onnxruntime into every image — a licence call, not a routine bump. 1.28.2 is the current 1.x. - duckdb stays on 1.5.6: 2.0.0 is six days old, so the cooldown keeps it out; it arrives as a reviewable Renovate major. polars 1.38 -> 2.0 removed String -> Date casts; the one src caller (aco.express.pharmacy) now parses explicitly when the column arrives as a string, and keeps working for date-typed and duckdb inputs. Full suite: 15591 passed. pkg-manifest regenerated (it was already stale on main). Refs #1365
245 lines
5.5 KiB
TOML
245 lines
5.5 KiB
TOML
[project]
|
|
name = "stack"
|
|
version = "0.1.0"
|
|
description = "Healthcare data platform — ACO analytics, CMS data, BCDA FHIR, PFS equations"
|
|
readme = "README.md"
|
|
requires-python = ">=3.12"
|
|
dependencies = [
|
|
"pydantic>=2.0.0",
|
|
# AGPL-3.0 — flag if shipping outside internal use. <2: pymupdf 2.x folds
|
|
# in the former pymupdf_layout code (Polyform Noncommercial / Artifex
|
|
# commercial) and pulls onnxruntime into every image — a licence call,
|
|
# not a routine bump.
|
|
"pymupdf>=1.27.2,<2",
|
|
"python-docx>=1.1",
|
|
"xlrd>=2.0.2",
|
|
]
|
|
|
|
[project.scripts]
|
|
stack = "cli:main"
|
|
|
|
[project.optional-dependencies]
|
|
conf = [
|
|
"pydantic>=2.0.0",
|
|
"httpx>=0.28.1",
|
|
"duckdb>=1.5.4",
|
|
]
|
|
aco = [
|
|
"stack[conf]",
|
|
"narwhals>=2.17.0",
|
|
"sqlglot>=26.0.0",
|
|
"pyarrow>=23.0.1",
|
|
"duckdb>=1.5.4",
|
|
]
|
|
api = [
|
|
"stack[conf]",
|
|
"fastapi>=0.139.0",
|
|
"uvicorn>=0.41.0",
|
|
"httpx>=0.28.1",
|
|
"pyjwt>=2.15.1",
|
|
"cryptography>=50.0.0",
|
|
]
|
|
bcda = [
|
|
"stack[conf]",
|
|
"httpx>=0.28.1",
|
|
"fsspec>=2026.6.0",
|
|
"narwhals>=2.17.0",
|
|
"pyarrow>=23.0.1",
|
|
]
|
|
bib = [
|
|
"stack[conf]",
|
|
"pydantic>=2.0.0",
|
|
"markdown-it-py>=4.0",
|
|
"mdit-py-plugins>=0.4",
|
|
]
|
|
bls = []
|
|
llm = [
|
|
"stack[conf]",
|
|
"stack[bib]",
|
|
"httpx>=0.28.1",
|
|
"fastapi>=0.139.0",
|
|
"uvicorn>=0.41.0",
|
|
"langchain-core>=0.3.0",
|
|
"langchain-ollama>=0.2.0",
|
|
"langchain-postgres>=0.0.12",
|
|
"psycopg[binary]>=3.2.0",
|
|
"sqlalchemy>=2.0.0",
|
|
"pyyaml>=6.0.0", # dev/scripts/llm_golden.py (golden set YAML) runs inside the llm container
|
|
]
|
|
ccw = [
|
|
"pydantic>=2.0.0",
|
|
]
|
|
cli = [
|
|
"stack[aco]",
|
|
"stack[api]",
|
|
"stack[bib]",
|
|
"stack[llm]",
|
|
"stack[mail]",
|
|
"typer>=0.24.1",
|
|
"uvicorn>=0.41.0",
|
|
]
|
|
mail = [
|
|
"httpx>=0.28.1",
|
|
"pydo>=0.29.0",
|
|
"resend>=2.0.0",
|
|
]
|
|
cms = [
|
|
"narwhals>=2.17.0",
|
|
"pydantic>=2.0.0",
|
|
]
|
|
opps = [
|
|
"stack[conf]",
|
|
"stack[rex]",
|
|
"duckdb>=1.5.4",
|
|
"narwhals>=2.17.0",
|
|
]
|
|
pfs = [
|
|
"stack[conf]",
|
|
"stack[rex]",
|
|
"duckdb>=1.5.4",
|
|
"narwhals>=2.17.0",
|
|
]
|
|
qpp = [
|
|
"stack[conf]",
|
|
"pydantic>=2.0.0",
|
|
]
|
|
rec = [
|
|
"stack[conf]",
|
|
"stack[pfs]",
|
|
"duckdb>=1.5.4",
|
|
"narwhals>=2.17.0",
|
|
"typer>=0.24.1",
|
|
]
|
|
rex = [
|
|
"stack[conf]",
|
|
"narwhals>=2.17.0",
|
|
"pyarrow>=23.0.1",
|
|
"fsspec>=2026.6.0",
|
|
]
|
|
prisma = [
|
|
"stack[conf]",
|
|
"stack[bib]",
|
|
"anthropic>=0.40.0",
|
|
"httpx[socks]>=0.28.1",
|
|
"pyyaml>=6.0.0",
|
|
"pydo>=0.29.0",
|
|
"pdfminer.six>=20221105",
|
|
"resend>=2.0.0",
|
|
]
|
|
perf = [
|
|
"stack[conf]",
|
|
"opentelemetry-api>=1.45.1",
|
|
"opentelemetry-sdk>=1.45.1",
|
|
"opentelemetry-exporter-otlp-proto-grpc>=1.25.0",
|
|
"opentelemetry-exporter-prometheus>=0.46b0",
|
|
"opentelemetry-instrumentation-fastapi>=0.46b0",
|
|
"opentelemetry-semantic-conventions>=0.46b0",
|
|
"psutil>=5.9.0",
|
|
]
|
|
sem = [
|
|
"coverage>=7.13.4",
|
|
]
|
|
lake = [
|
|
"stack[aco]",
|
|
"databricks-sdk>=0.85.0",
|
|
"databricks-bundles>=0.295.0",
|
|
]
|
|
aws = [
|
|
"boto3>=1.35.0",
|
|
"s3fs>=2026.2.0",
|
|
]
|
|
gcp = [
|
|
"google-cloud-storage>=2.18.0",
|
|
"gcsfs>=2024.1.0",
|
|
]
|
|
azure = [
|
|
"azure-storage-blob>=12.23.0",
|
|
"adlfs>=2024.1.0",
|
|
]
|
|
all = [
|
|
"stack[aco]",
|
|
"stack[api]",
|
|
"stack[bcda]",
|
|
"stack[bib]",
|
|
"stack[bls]",
|
|
"stack[ccw]",
|
|
"stack[cli]",
|
|
"stack[cms]",
|
|
"stack[llm]",
|
|
"stack[perf]",
|
|
"stack[pfs]",
|
|
"stack[qpp]",
|
|
"stack[rec]",
|
|
"stack[rex]",
|
|
"stack[lake]",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"stack[all]",
|
|
"coverage>=7.13.4",
|
|
"dbt-core==1.10.15",
|
|
"dbt-duckdb>=1.10,<1.11",
|
|
"openpyxl>=3.1.5",
|
|
"pdfplumber>=0.11.9",
|
|
"polars>=1.38.1",
|
|
"pytest>=9.0.2",
|
|
"pytest-cov>=7.0.0",
|
|
"pytest-xdist>=3.5.0",
|
|
"marimo>=0.23.13",
|
|
"ruff>=0.11.0",
|
|
"altair>=6.0.0",
|
|
"pandas>=3.0.1",
|
|
"obstore>=0.9.2",
|
|
"s3fs>=2026.2.0",
|
|
"jinja2>=3.1.0",
|
|
"fastexcel>=0.19.0",
|
|
]
|
|
|
|
[build-system]
|
|
requires = ["uv_build>=0.7,<1"]
|
|
build-backend = "uv_build"
|
|
|
|
[tool.ruff]
|
|
line-length = 88
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "I"]
|
|
ignore = ["E501", "E741"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|
|
markers = [
|
|
"stub: marks tests that report stub vs implemented status (deselect with '-m \"not stub\"')",
|
|
"live: marks tests that need a live DuckDB replica on disk (skipped without one)",
|
|
]
|
|
filterwarnings = [
|
|
"error::ResourceWarning",
|
|
"ignore::ResourceWarning:coverage.*",
|
|
]
|
|
|
|
[tool.coverage.run]
|
|
# Required for reliable pytest-cov + pytest-xdist combining: each worker
|
|
# writes .coverage.<host>.<pid>, then pytest-cov auto-combines at exit.
|
|
# Without this, parallel test runs randomly drop coverage data.
|
|
parallel = true
|
|
source = ["src"]
|
|
concurrency = ["multiprocessing", "thread"]
|
|
|
|
[tool.uv]
|
|
# Supply-chain cooldown: resolve only releases at least a week old, so a
|
|
# hijacked or yanked-within-days upload never lands in the lock. Renovate's
|
|
# minimumReleaseAge matches. Exempt one package with
|
|
# `exclude-newer-package` when a CVE fix can't wait. Lives here, not in a
|
|
# uv.toml: images copy only pyproject.toml + uv.lock, and the lock records
|
|
# the span, so `uv sync --locked` fails wherever the setting isn't visible.
|
|
exclude-newer = "7 days"
|
|
# Prevents broken .venv symlinks when uv runs under different users.
|
|
link-mode = "copy"
|
|
python-preference = "managed"
|
|
|
|
[tool.uv.build-backend]
|
|
module-name = ["aco", "api", "bcda", "bib", "bls", "ccw", "cli", "cms", "conf", "llm", "mail", "opps", "perf", "pfs", "prisma", "qpp", "rec", "rex", "sem"]
|
|
namespace = true
|
|
source-exclude = ["compose.yml","infra/**","data/**","notebooks/**","tuva/**","assets/**","docs/**","dev/**","bundle/**","cloud/**"]
|