From 3998f67680ae292d599c6d8137dc8769c84ccea4 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 25 Mar 2026 02:01:43 -0700
Subject: [PATCH] Bump Data Designer to 0.5.4 (removes litellm dependency)
 (#4569)

* Bump Data Designer to 0.5.4 (removes litellm dependency)

NVIDIA Data Designer v0.5.4 removes litellm entirely and replaces it
with native OpenAI and Anthropic adapters. This follows the litellm
supply chain incident where versions 1.82.7 and 1.82.8 were compromised
with a credential stealer.

Release notes: https://github.com/NVIDIA-NeMo/DataDesigner/releases/tag/v0.5.4

Changes:
- Bump data-designer, data-designer-config, data-designer-engine to 0.5.4
- Sync data-designer-deps.txt with 0.5.4 engine requirements:
  - Added: chardet, fsspec, mcp
  - Removed: python-json-logger, pymupdf, pymupdf4llm, mammoth
    (these remain in the unstructured-seed plugin which still needs them)
  - duckdb constraint relaxed from <1.5 to <2 (upstream fixed record_batch)
- Bump plugin lower bound to >=0.5.4

* Keep pymupdf, pymupdf4llm, mammoth in data-designer-deps

The unstructured-seed plugin is installed with --no-deps, so its
pyproject.toml dependencies are not auto-resolved. These three
packages are needed by the seed route (studio/backend/routes/
data_recipe/seed.py) and must remain in the explicit deps list.
---
 .../data-designer-unstructured-seed/pyproject.toml       | 2 +-
 .../requirements/single-env/data-designer-deps.txt       | 9 ++++++---
 studio/backend/requirements/single-env/data-designer.txt | 6 +++---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml b/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
index d4770a0b05..c9d988bd9d 100644
--- a/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
+++ b/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
@@ -11,7 +11,7 @@ version = "0.1.0"
 description = "Local Data Designer unstructured seed reader plugin"
 requires-python = ">=3.11"
 dependencies = [
-  "data-designer-engine>=0.5.1,<0.6",
+  "data-designer-engine>=0.5.4,<0.6",
   "pandas>=2,<3",
   "pymupdf>=1.24.0",
   "pymupdf4llm>=0.0.17",
diff --git a/studio/backend/requirements/single-env/data-designer-deps.txt b/studio/backend/requirements/single-env/data-designer-deps.txt
index 9cd0db99e4..0cb42db01d 100644
--- a/studio/backend/requirements/single-env/data-designer-deps.txt
+++ b/studio/backend/requirements/single-env/data-designer-deps.txt
@@ -1,8 +1,10 @@
 # Data Designer runtime deps installed explicitly (single-env mode).
-# DuckDB 1.5 removed Relation.record_batch(); keep <1.5 until upstream ships the fix.
+# Synced with data-designer-engine==0.5.4 requirements.
 anyascii<1,>=0.3.3
-duckdb<1.5,>=1.1.3
+chardet<6,>=3.0.2
+duckdb<2,>=1.5.0
 faker<21,>=20.1.0
+fsspec<2026,>=2025.3.0
 httpx<1,>=0.27.2
 httpx-retries<1,>=0.4.2
 json-repair<1,>=0.48.0
@@ -10,12 +12,13 @@ jsonpath-rust-bindings<2,>=1.0
 jsonschema<5,>=4.0.0
 lxml<7,>=6.0.2
 marko<3,>=2.1.2
+mcp<2,>=1.26.0
 networkx<4,>=3.0
-python-json-logger<4,>=3
 ruff<1,>=0.14.10
 scipy<2,>=1.11.0
 sqlfluff<4,>=3.2.0
 tiktoken<1,>=0.8.0
+# Unstructured-seed plugin deps (plugin installed with --no-deps)
 pymupdf>=1.24.0
 pymupdf4llm>=0.0.17
 mammoth>=1.8.0
diff --git a/studio/backend/requirements/single-env/data-designer.txt b/studio/backend/requirements/single-env/data-designer.txt
index 8daa1eca43..2e0ba62249 100644
--- a/studio/backend/requirements/single-env/data-designer.txt
+++ b/studio/backend/requirements/single-env/data-designer.txt
@@ -1,5 +1,5 @@
 # Install Data Designer in same env as Unsloth.
-data-designer==0.5.2
-data-designer-config==0.5.2
-data-designer-engine==0.5.2
+data-designer==0.5.4
+data-designer-config==0.5.4
+data-designer-engine==0.5.4
 prompt-toolkit>=3,<4