Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for refactors or chores; if I would like to ask a question, I will use Discussions.
• I have searched for existing issues, including closed ones.
• I confirm that I am using English to submit this report.
• 【中文用户 & Non English User】I understand that non-English submissions may be closed.
• I have kept the required fields from the template and filled them in.

Description

This chore audits the direct runtime dependencies under api/pyproject.toml, removes declarations that are redundant in the current synced backend environment, and re-locks api/uv.lock so the lock file matches the updated dependency constraints.

Motivation

The direct dependency list had drifted away from the actual root requirement set. Several packages were still brought in transitively by retained runtime dependencies, default groups (storage, tools, vdb-all), or the dev group. Removing those redundant direct declarations makes api/pyproject.toml easier to maintain while keeping the current locked environment behavior stable.

Additional Context

Classification metrics

The current dependency buckets and version policies use these rules:

• Legacy: long-lived, widely deployed, API-stable packages. Version policy: >=
• Stable: production-proven packages whose major upgrades are still meaningful compatibility events. Version policy: >= current, < next major
• Emerging: newer and faster-moving packages with higher API movement risk. Version policy: ~=
• Dev: development-only tooling and test dependencies. Version policy: >=

Removed dependency declarations and reasons

This cleanup removes 45 direct dependency declarations from project.dependencies.

They were removed only when the package still remained available after removing the declaration and re-running uv sync --dev.

Grouped by retained dependency chain, the reasons are:

• Flask stack: flask, flask-sqlalchemy These still remain available via flask-compress, flask-cors, flask-login, flask-migrate, flask-orjson, flask-restx, fastopenapi, and related Flask integrations.
• Google stack: google-auth-httplib2, google-api-core, google-auth, googleapis-common-protos, starlette These still remain available via google-api-python-client, google-cloud-aiplatform, fastapi, mlflow-skinny, and the storage / vdb-all chains.
• Graph/document parsing stack: beautifulsoup4, markdown, transformers, pypandoc, pypdfium2, python-docx, unstructured, tiktoken These still remain available via graphon, readabilipy, unstructured, and related parsing chains.
• Data and scientific stack: numpy, openpyxl, packaging, pandas[excel,output-formatting,performance] These still remain available via graphon, pandas, chromadb, pymilvus, clickzetta-connector-python, and other retained chains.
• Storage / crypto / transport stack: jieba, pycryptodome, pyyaml, sqlalchemy, cachetools, charset-normalizer, yarl, httpx[socks] These still remain available via retained storage packages, vdb-all packages, langfuse, langsmith, weave, supabase, weaviate-client, gql, and related chains.
• OpenTelemetry stack: opentelemetry-api, opentelemetry-exporter-otlp, opentelemetry-exporter-otlp-proto-common, opentelemetry-exporter-otlp-proto-grpc, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation, opentelemetry-proto, opentelemetry-sdk, opentelemetry-semantic-conventions, opentelemetry-util-http These still remain available via arize-phoenix-otel, langfuse, mlflow-skinny, chromadb, opentelemetry-distro, and the concrete instrumentation/exporter packages.
• SDK / auth / config stack: litellm, pydantic, pydantic-settings, pyjwt, python-dotenv, sentry-sdk[flask], sseclient-py These still remain available via opik, openai, fastapi, supabase-auth, wandb, weave, and the dev group in the case of sseclient-py.
• Miscellaneous retained chains: apscheduler This still remains available via alibabacloud-credentials.

Lock file note

api/uv.lock was re-locked to follow the dependency constraint changes in api/pyproject.toml.

This re-lock did not change the previously locked dependency versions. It only refreshed the lock file so it remains consistent with the updated dependency declarations.