feat: use uv sources for CPU-only PyTorch

[RamGopalSrikar]

Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA dependencies in Docker images. This replaces hardcoded wheel URLs with a cleaner index-based approach.

• Add pytorch-cpu index with explicit = true
• Add torch/torchvision to [tool.uv.sources]
• Add explicit torch/torchvision deps to trigger source override
• Regenerate lockfile without nvidia/cuda/triton packages

Summary by CodeRabbit

• Chores
  • Added explicit PyTorch (≥2.0.0) and torchvision (≥0.15.0) dependencies
  • Configured enhanced dependency resolution with support for Linux and macOS architectures

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This change adds explicit PyTorch 2.0+ dependencies and configures a platform-aware wheel resolution mechanism via a custom CPU index in the uv package manager. It extends the configuration with required environments for Linux x86_64, Linux aarch64, and Darwin platforms while preserving existing workspace and override settings.

Changes

Cohort / File(s)	Summary
PyTorch Dependencies & Uv Configuration pyproject.toml	Added explicit torch>=2.0.0 and torchvision>=0.15.0 dependencies; created pytorch-cpu uv index; mapped torch and torchvision to the custom index via [tool.uv.sources]; defined required-environments for Linux x86_64, Linux aarch64, and Darwin to ensure consistent lockfile resolution across platforms.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: use uv sources for CPU-only PyTorch' clearly and concisely describes the main change: configuring uv sources to use CPU-only PyTorch wheels instead of hardcoded CUDA-specific URLs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Test Coverage For New Implementations	✅ Passed	Configuration changes to pyproject.toml for dependency versions and uv index setup do not require new test files as they are build configuration, not code implementation.
Test Quality And Coverage	✅ Passed	This PR contains only configuration changes to pyproject.toml for PyTorch dependencies and uv package sources, with no new functional code or implementations that would require test coverage validation.
Test File Naming And Structure	✅ Passed	This PR only modifies pyproject.toml for PyTorch CPU-only wheel resolution and contains no test file changes, making the test file evaluation check not applicable.
Excessive Mock Usage Warning	✅ Passed	This PR only modifies pyproject.toml for PyTorch CPU-only wheels configuration. No test files were added, modified, or removed, so the custom check for excessive mock usage is not applicable.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/cpu-torch-uv-sources

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.40%. Comparing base (75d017d) to head (0150a35).
⚠️ Report is 4 commits behind head on main.

❌ Your project status has failed because the head coverage (42.03%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #11833   +/-   ##
=======================================
  Coverage   35.40%   35.40%           
=======================================
  Files        1527     1527           
  Lines       73418    73418           
  Branches    11025    11025           
=======================================
  Hits        25996    25996           
+ Misses      46009    46008    -1     
- Partials     1413     1414    +1     

Flag	Coverage Δ
backend	56.00% <ø> (+<0.01%)	⬆️
frontend	16.99% <ø> (ø)
lfx	42.03% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 10 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pyproject.toml`:
- Around line 150-154: The required-environments block currently restricts lock
resolution to Linux and macOS only; update pyproject.toml's
required-environments to also include Windows entries (e.g., add conditions like
"sys_platform == 'win32' and platform_machine == 'AMD64'" and "sys_platform ==
'win32' and platform_machine == 'ARM64'") so the lockfile contains
Windows-compatible wheels, or remove the required-environments section entirely
if you want resolution for all platforms, or alternatively add a note in the
repo docs instructing Windows developers to regenerate the lockfile locally.
- Around line 21-23: The top-level dependencies currently include "torch" and
"torchvision" with loose ranges ("torch>=2.0.0", "torchvision>=0.15.0") which
forces a huge unconditional install and risks incompatible pairings; either
tighten them to a tested compatible pair (e.g., change "torch>=2.0.0" and
"torchvision>=0.15.0" to pinned/tight ranges like "torch~=2.10.0" and
"torchvision~=0.25.0" in the project dependencies), or remove these two entries
from the main dependencies and add them under [project.optional-dependencies]
(example group name: ml) as "torch~=2.10.0" and "torchvision~=0.25.0" so users
opt-in; update any docs/install instructions to reference the new optional group
if you choose the latter.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# First, verify the file exists and check lines 21-23
echo "=== Lines 21-23 of pyproject.toml ==="
head -30 pyproject.toml | tail -10

echo ""
echo "=== Full dependencies section (lines around 15-30) ==="
head -35 pyproject.toml | tail -25

echo ""
echo "=== Check if langflow-base exists and contains torch ==="
fd "pyproject.toml" | xargs grep -l "langflow-base\|langflow_base" 2>/dev/null || echo "No langflow-base found"

echo ""
echo "=== Search for torch in all pyproject.toml files ==="
fd "pyproject.toml" | xargs grep -n "torch" 2>/dev/null || echo "No torch found"

echo ""
echo "=== Check uv.lock for torch package ==="
if [ -f "uv.lock" ]; then
  echo "Found uv.lock, checking for torch entries..."
  grep -n "name = \"torch\"" uv.lock | head -5
  echo ""
  echo "=== Context around torch entry ==="
  grep -A 10 "name = \"torch\"" uv.lock | head -20
else
  echo "uv.lock not found"
fi

Repository: langflow-ai/langflow

Length of output: 4647

---

🏁 Script executed:

#!/bin/bash
echo "=== Checking src/backend/base/pyproject.toml for torch ==="
cat src/backend/base/pyproject.toml | grep -i "torch" | head -20

echo ""
echo "=== Full dependencies section in langflow-base ==="
sed -n '/^dependencies/,/^]/p' src/backend/base/pyproject.toml | head -50

echo ""
echo "=== Checking uv.lock for torchvision versions and compatibility ==="
grep -A 5 'name = "torchvision"' uv.lock | head -30

echo ""
echo "=== Checking marker consistency between torch and torchvision in uv.lock ==="
echo "Torch entries:"
grep 'name = "torch"' uv.lock | grep -v "^#"
echo ""
echo "Torchvision entries:"
grep 'name = "torchvision"' uv.lock | grep -v "^#"

Repository: langflow-ai/langflow

Length of output: 9974

---

torch and torchvision should be optional dependencies or have tighter version constraints.

torch is now a new unconditional top-level dependency (not previously a transitive dependency of langflow-base), meaning all installations will pull ~700 MB+ even if torch/LLM features aren't used. While the current lockfile correctly resolves to compatible versions (torch 2.2.2 + torchvision 0.17.2 on macOS x86_64, torch 2.10.0 + torchvision 0.25.0 elsewhere), the loose constraint ranges (>=2.0.0 / >=0.15.0) are fragile — they could resolve to incompatible combinations in future updates. Consider either:

1. Tightening to specific compatible pairs (e.g., torch~=2.10.0, torchvision~=0.25.0), or
2. Moving torch/torchvision to an optional dependency group (e.g., [project.optional-dependencies] ml = [...]) so users opt-in to the extra size, while keeping the default install lean.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pyproject.toml` around lines 21 - 23, The top-level dependencies currently
include "torch" and "torchvision" with loose ranges ("torch>=2.0.0",
"torchvision>=0.15.0") which forces a huge unconditional install and risks
incompatible pairings; either tighten them to a tested compatible pair (e.g.,
change "torch>=2.0.0" and "torchvision>=0.15.0" to pinned/tight ranges like
"torch~=2.10.0" and "torchvision~=0.25.0" in the project dependencies), or
remove these two entries from the main dependencies and add them under
[project.optional-dependencies] (example group name: ml) as "torch~=2.10.0" and
"torchvision~=0.25.0" so users opt-in; update any docs/install instructions to
reference the new optional group if you choose the latter.

[jordanrfrazier]

Can we also just put these in the docling optional dependencies?

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	18.81% (6095/32401)	12.25% (3097/25275)	12.64% (879/6951)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
2310	0 💤	0 ❌	0 🔥	31.916s ⏱️

[Adam-Aghili]

Tested locally and it seems fine.
The image size seemed to still be ~4gb but that might be due some local issues I had with QEMU emulation. So i trust your local testing more than mine.

I am confortable getting this merged, then we see how it works in our pipelines