chore(build): migrate to Poetry 2.x with PEP 621 pyproject.toml

.github/workflows/_test.yml

@@ -33,7 +33,7 @@ defaults:
   run:
     shell: bash
 env:
-  POETRY_VERSION: 1.8.2
+  POETRY_VERSION: 2.2.1
 
 jobs:
   tests:

.github/workflows/docs-build.yaml

@@ -21,7 +21,7 @@ defaults:
 
 env:
     PYTHON_VERSION: "3.10"
-    POETRY_VERSION: "1.8.2"
+    POETRY_VERSION: "2.2.1"
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

.github/workflows/lint.yml

@@ -9,7 +9,7 @@ on:
   workflow_dispatch:
 
 env:
-  POETRY_VERSION: 1.8.2
+  POETRY_VERSION: 2.2.1
   PYTHON_VERSION: "3.11"
 
 jobs:

.github/workflows/release.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Bootstrap poetry
         run: |
-          curl -sSL https://install.python-poetry.org | POETRY_VERSION=1.8.2 python -
+          curl -sSL https://install.python-poetry.org | POETRY_VERSION=2.2.1 python -
 
       - name: Update PATH
         run: echo "$HOME/.local/bin" >> $GITHUB_PATH

.github/workflows/test-and-build-wheel.yml

@@ -14,7 +14,7 @@ jobs:
   build-wheel:
     runs-on: ubuntu-latest
     env:
-      POETRY_VERSION: "1.8.2"
+      POETRY_VERSION: "2.2.1"
       PYTHON_VERSION: "3.11"
     outputs:
       artifact_name: ${{ steps.set-artifact-name.outputs.artifact_name }}

.gitlab-ci.yml

@@ -20,7 +20,7 @@ include:
 
 variables:
     PIP_CACHE_DIR: "${CI_PROJECT_DIR}/.cache/pip"
-    POETRY_VERSION: "1.8.2"
+    POETRY_VERSION: "2.2.1"
     IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
     LATEST_TAG: $CI_REGISTRY_IMAGE:latest
 

CONTRIBUTING.md

@@ -132,7 +132,7 @@ To get started quickly, follow the steps below.
 
 4. we use `Poetry` to manage the project dependencies. To install Poetry follow the instructions [here](https://python-poetry.org/docs/#installation):
 
-> Note: This project requires Poetry version >=1.8,<2.0. Please ensure you are using a compatible version before running any Poetry commands.
+> Note: This project requires Poetry version >=2.0,<3.0. Please ensure you are using a compatible version before running any Poetry commands.
 
   Ensure you have `poetry` installed:
 

Dockerfile

@@ -21,7 +21,7 @@ FROM python:3.10
 RUN apt-get update && apt-get install -y git gcc g++
 
 # Set POETRY_VERSION environment variable
-ENV POETRY_VERSION=1.8.2
+ENV POETRY_VERSION=2.2.1
 
 RUN if [ "$(uname -m)" = "x86_64" ]; then \
   export ANNOY_COMPILER_ARGS="-D_CRT_SECURE_NO_WARNINGS,-DANNOYLIB_MULTITHREADED_BUILD,-march=x86-64"; \
@@ -35,7 +35,7 @@ WORKDIR /nemoguardrails
 COPY pyproject.toml poetry.lock /nemoguardrails/
 # Copy the rest of the project files
 COPY . /nemoguardrails
-RUN poetry config virtualenvs.create false && poetry install --all-extras --no-interaction --no-ansi && poetry install --with dev --no-interaction --no-ansi
+RUN poetry config virtualenvs.create false && poetry install --all-extras --with dev --no-interaction --no-ansi
 
 
 # Make port 8000 available to the world outside this container
@@ -52,8 +52,6 @@ WORKDIR /nemoguardrails
 RUN python -c "from fastembed.embedding import FlagEmbedding; FlagEmbedding('sentence-transformers/all-MiniLM-L6-v2');"
 
 RUN nemoguardrails --help
-# Ensure the entry point is installed as a script
-RUN poetry install --all-extras --no-interaction --no-ansi
 
 ENTRYPOINT ["poetry", "run", "nemoguardrails"]
 CMD ["server", "--verbose", "--config=/config"]

docs/conf.py

@@ -26,7 +26,7 @@
 release = "0.0.0"
 with open("../pyproject.toml") as f:
     t = load(f)
-    release = t.get("tool").get("poetry").get("version")
+    release = t.get("project").get("version")
 
 extensions = [
     "myst_parser",

pyproject.toml

@@ -1,154 +1,150 @@
-[tool.poetry]
+[project]
 name = "nemoguardrails"
+version = "0.18.0"
 description = "NeMo Guardrails is an open-source toolkit for easily adding programmable guardrails to LLM-based conversational systems."
-authors = ["NVIDIA <nemoguardrails@nvidia.com>"]
-license = "LICENSE.md"
+license-files = ["LICENSE*"]
 readme = "README.md"
-version = "0.18.0"
-packages = [{ include = "nemoguardrails" }]
-
+requires-python = ">=3.10,<3.14"
+authors = [{ name = "NVIDIA", email = "nemoguardrails@nvidia.com" }]
 
-include = [
-  "LICENSE.md",
-  "LICENSE-Apache-2.0.txt",
-  "LICENCES-3rd-party.txt",
-  "chat-ui/**/*",
-  "examples/**/*",
-  "eval/data/**/*",
-  "**/*.yml",
-  "**/*.co",
-  "**/*.txt",
-  "**/*.json",
-  "**/*.lark",
-]
 
 classifiers = [
   "Development Status :: 4 - Beta",
   "Intended Audience :: Developers",
-  "License :: OSI Approved :: Apache Software License",
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
 ]
 
-[tool.poetry.urls]
-homepage = "https://github.com/NVIDIA/nemo-guardrails"
-issues = "https://github.com/NVIDIA/nemo-guardrails/issues"
-changelog = "https://github.com/NVIDIA/NeMo-Guardrails/blob/develop/CHANGELOG.md"
-documentation = "https://docs.nvidia.com/nemo/guardrails/"
-repository = "https://github.com/NVIDIA/NeMo-Guardrails"
+dependencies = [
+  "aiohttp (>=3.10.11)",
+  "annoy (>=1.17.3)",
+  "fastapi (>=0.121.0)",
+  "starlette (>=0.49.1)",
+  "uvicorn (>=0.23)",
+  "typer (>=0.8)",
+  "fastembed (>=0.2.2,<=0.6.0)",
+  "httpx (>=0.24.1)",
+  "jinja2 (>=3.1.6)",
+  "langchain (>=0.2.14,<2.0.0)",
+  "langchain-core (>=0.2.14,<2.0.0)",
+  "langchain-community (>=0.2.5,<2.0.0)",
+  "lark (>=1.1.7)",
+  "nest-asyncio (>=1.5.6)",
+  "prompt-toolkit (>=3.0)",
+  "protobuf (>=5.29.5)",
+  "pydantic (>=1.10)",
+  "pyyaml (>=6.0)",
+  "rich (>=13.5.2)",
+  "simpleeval (>=0.9.13)",
+  "watchdog (>=3.0.0)",
+]
 
+[project.optional-dependencies]
 
-[tool.poetry.scripts]
-nemoguardrails = "nemoguardrails.__main__:app"
+tracing = ["opentelemetry-api (>=1.27.0,<2.0.0)", "aiofiles (>=24.1.0)"]
+
+openai = ["langchain-openai (>=0.2.0)"]
+
+
+sdd = [
+  "presidio-analyzer (>=2.2) ; python_version<'3.13'",
+  "presidio-anonymizer (>=2.2) ; python_version<'3.13'",
+]
 
-[tool.poetry.dependencies]
-python = ">=3.10,<3.14"
-aiohttp = ">=3.10.11"
-annoy = ">=1.17.3"
-fastapi = ">=0.103.0,"
-fastembed = [{ version = ">=0.2.2, <=0.6.0", python = ">=3.10,<3.14" }]
-httpx = ">=0.24.1"
-jinja2 = ">=3.1.6"
-langchain = ">=0.2.14,<2.0.0"
-langchain-core = ">=0.2.14,<2.0.0"
-langchain-community = ">=0.2.5,<2.0.0"
-lark = ">=1.1.7"
-nest-asyncio = ">=1.5.6,"
-# NOTE:
-# security: ensure protobuf version is patched against CVE-2024-7254
-# must move this to google-cloud-language only once onnxruntime is dropped
-# and streamlit is using the vulnerable protobuf versions
-protobuf = ">=5.29.5"
-prompt-toolkit = ">=3.0"
-pydantic = ">=1.10"
-pyyaml = ">=6.0"
-rich = ">=13.5.2"
-simpleeval = ">=0.9.13,"
-starlette = ">=0.49.1"
-typer = ">=0.8"
-uvicorn = ">=0.23"
-watchdog = ">=3.0.0,"
-
-# tracing
-opentelemetry-api = { version = ">=1.27.0,<2.0.0", optional = true }
-aiofiles = { version = ">=24.1.0", optional = true }
-
-# openai
-langchain-openai = { version = ">=0.1.0", optional = true }
+nvidia = ["langchain-nvidia-ai-endpoints (>=0.3.0)"]
+
+gcp = ["google-cloud-language (>=2.14.0)", "protobuf (>=5.29.5)"]
+
+jailbreak = ["yara-python (>=4.5.1)"]
 
 # eval
-tqdm = { version = ">=4.65,<5.0", optional = true }
-streamlit = { version = "^1.37.0", optional = true, python = ">=3.10,<3.14" }
-tornado = { version = ">=6.5.0", optional = true, python = ">=3.10,<3.14" }
-pandas = { version = ">=1.4.0,<3", optional = true }
-numpy = [
-  { version = ">=1.21", python = ">=3.10,<3.12" },
-  { version = ">=1.26", python = ">=3.12,<3.13" },
-  { version = ">=2.1.0", python = ">=3.13" },
-  { version = ">=1.21,<2.1.0", python = "<3.10" },
+eval = [
+  "tqdm (>=4.65,<5.0)",
+  "streamlit (>=1.37.0)",
+  "tornado (>=6.5.0)",
+  "pandas (>=1.4.0,<3)",
+  "protobuf (>=5.29.5)",
+  "numpy",
 ]
-# sdd
-# we don't need it and we comment it for sake of documentation
-# spacy = { version = ">=3.4.4,<4.0.0,!=3.7.0", python = "<3.13", optional = true }
-presidio-analyzer = { version = ">=2.2", optional = true, python = "<3.13" }
-presidio-anonymizer = { version = ">=2.2", optional = true, python = "<3.13" }
-
-# nim
-langchain-nvidia-ai-endpoints = { version = ">= 0.2.0", optional = true }
-
-# gpc
-google-cloud-language = { version = ">=2.14.0", optional = true }
-
-# jailbreak injection
-yara-python = { version = "^4.5.1", optional = true }
-
-[tool.poetry.extras]
-sdd = ["presidio-analyzer", "presidio-anonymizer"]
-eval = ["tqdm", "numpy", "streamlit", "tornado"]
-openai = ["langchain-openai"]
-gcp = ["google-cloud-language"]
-tracing = ["opentelemetry-api", "aiofiles"]
-nvidia = ["langchain-nvidia-ai-endpoints"]
-jailbreak = ["yara-python"]
-# Poetry does not support recursive dependencies, so we need to add all the dependencies here.
-# I also support their decision. There is no PEP for recursive dependencies, but it has been supported in pip since version 21.2.
-# It is here for backward compatibility.
+
 all = [
-  "presidio-analyzer",
-  "presidio-anonymizer",
-  "tqdm",
+  "presidio-analyzer (>=2.2) ; python_version<'3.13'",
+  "presidio-anonymizer (>=2.2) ; python_version<'3.13'",
+  "tqdm (>=4.65,<5.0)",
+  "streamlit (>=1.37.0)",
+  "tornado (>=6.5.0)",
+  "pandas (>=1.4.0,<3)",
+  "protobuf (>=5.29.5)",
   "numpy",
-  "streamlit",
-  "langchain-openai",
-  "google-cloud-language",
-  "opentelemetry-api",
-  "aiofiles",
-  "langchain-nvidia-ai-endpoints",
-  "yara-python",
+  "langchain-openai (>=0.2.0)",
+  "google-cloud-language (>=2.14.0)",
+  "opentelemetry-api (>=1.27.0,<2.0.0)",
+  "aiofiles (>=24.1.0)",
+  "langchain-nvidia-ai-endpoints (>=0.3.0)",
+  "yara-python (>=4.5.1)",
 ]
 
-[tool.poetry.group.dev]
+[tool.poetry]
+packages = [{ include = "nemoguardrails" }]
+
+include = [
+  "LICENSE.md",
+  "LICENSE-Apache-2.0.txt",
+  "LICENCES-3rd-party.txt",
+  "chat-ui/**/*",
+  "examples/**/*",
+  "eval/data/**/*",
+  "**/*.yml",
+  "**/*.co",
+  "**/*.txt",
+  "**/*.json",
+  "**/*.lark",
+]
+
+
+[tool.poetry.group.lint]
+optional = true
+
+[tool.poetry.group.lint.dependencies]
+ruff = "0.14.6"
+
+[tool.poetry.group.typing]
 optional = true
 
+[tool.poetry.group.typing.dependencies]
+pyright = "^1.1.405"
 
-[tool.poetry.group.dev.dependencies]
-aioresponses = ">=0.7.6"
-pre-commit = ">=3.1.1"
+[tool.poetry.group.test]
+optional = true
+
+[tool.poetry.group.test.dependencies]
 pytest = ">=7.2.2"
 pytest-asyncio = ">=0.21.0, <1.0.0"
 pytest-cov = ">=4.1.0"
 pytest-httpx = ">=0.22.0"
+pytest-profiling = "^1.7.0"
+
+[tool.poetry.group.test_integration]
+optional = true
+
+[tool.poetry.group.test_integration.dependencies]
+aioresponses = ">=0.7.6"
 streamlit = ">=1.37.0"
 tox = "^4.23.2"
-pytest-profiling = "^1.7.0"
 yara-python = "^4.5.1"
 opentelemetry-api = "^1.34.1"
 opentelemetry-sdk = "^1.34.1"
-pyright = "^1.1.405"
-ruff = "0.14.6"
+
+
+[tool.poetry.group.dev]
+optional = true
+include-groups = ["test", "test_integration", "lint", "typing"]
+
+[tool.poetry.group.dev.dependencies]
+pre-commit = ">=3.1.1"
 
 # Directories in which to run Pyright type-checking
 [tool.pyright]
@@ -191,6 +187,17 @@ log-level = "DEBUG"
 # phase, which will cause tests to fail or "magically" ignored.
 log_cli = "False"
 
+[project.scripts]
+nemoguardrails = "nemoguardrails.__main__:app"
+
+[project.urls]
+homepage = "https://github.com/NVIDIA-NeMo/Guardrails"
+issues = "https://github.com/NVIDIA-NeMo/Guardrails/issues"
+changelog = "https://github.com/NVIDIA-NeMo/Guardrails/blob/develop/CHANGELOG.md"
+documentation = "https://docs.nvidia.com/nemo/guardrails/"
+repository = "https://github.com/NVIDIA-NeMo/Guardrails"
+
+
 [build-system]
-requires = ["poetry-core>=1.0.0,<2.0.0"]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
 build-backend = "poetry.core.masonry.api"