pyproject.toml

[build-system]
requires = ["setuptools>=61.0"]
build-backend = "setuptools.build_meta"

[project]
name = "graphfaker"
version = "1.4.0"
description = "Generate graph data that behaves like the real thing: people, the relationships between them and the events over time, with the ground truth included."
readme = "README.md"
authors = [
  {name = "Dennis Irorere", email = "denironyx@gmail.com"}
]
maintainers = [
  {name = "Dennis Irorere", email = "denironyx@gmail.com"}
]
classifiers = [
  "Development Status :: 4 - Beta",
  "Intended Audience :: Developers",
  "Intended Audience :: Science/Research",
  "Intended Audience :: Financial and Insurance Industry",
  "Programming Language :: Python :: 3",
  "Programming Language :: Python :: 3.10",
  "Programming Language :: Python :: 3.11",
  "Programming Language :: Python :: 3.12",
  "Topic :: Database",
  "Topic :: Scientific/Engineering :: Artificial Intelligence",
  "Topic :: Software Development :: Testing",
  "Topic :: Software Development :: Libraries :: Python Modules",
]
license = "MIT"
requires-python = ">=3.10"
keywords = [
  "synthetic-data",
  "graph-data",
  "graph-generator",
  "knowledge-graph",
  "fraud-detection",
  "anti-money-laundering",
  "benchmark",
  "ground-truth",
  "entity-resolution",
  "graphrag",
  "neo4j",
  "ladybugdb",
  "duckdb",
  "sql/pgq",
  "cypher",
  "networkx",
  "polars",
  "parquet",
  "osmnx",
  "flights",
  "faker",
]
dependencies = [
  # >=2026.10.19 for PYSEC-2026-4320: earlier bundles trust `emSign ECC Root
  # CA - G3`, and eight eMudhra intermediates chaining to it have compromised
  # private keys. Someone holding one of those keys, on-path, can present a
  # valid-looking certificate for any hostname. Every HTTPS call the package
  # makes verifies against this bundle, which is the wiki fetcher, the BTS zip
  # the flights fetcher downloads and the Overpass queries behind the OSM one.
  "certifi>=2026.10.19",
  "faker>=37.1.0",
  "networkx>=3.4.2",
  "numpy>=1.26",
  "pandas>=2.2.2",
  "polars>=1.0",
  "pyarrow>=15.0",
  "pydantic>=2.6",
  "pyyaml>=6.0",
  "requests>=2.32.3",
  "tqdm>=4.66.0",
  "typer",
  # >=2.8.0 for PYSEC-2026-4175/4176/4177 (CVE-2026-97688, CVE-2026-97689 and
  # the redirect one): the first two are in the chunked streaming path, which
  # is how the flights fetcher downloads the BTS zip (requests.get(...,
  # stream=True)). One can hang on a crafted deflate response, the other
  # buffers an unbounded chunk-size line.
  "urllib3>=2.8.0",
  "wikipedia>=1.4.0",
]

[project.optional-dependencies]
osm = [
    # The OSM fetcher only. osmnx brings geopandas, shapely, pyproj and pyogrio,
    # about 150 MB that nothing else in the package uses.
    "osmnx==2.0.2",
]
neo4j = [
    "neo4j>=5.26",  # driver for `graphfaker load neo4j` / `graphfaker verify neo4j`
]
ladybug = [
    "ladybug>=0.20",  # LadybugDB, for `graphfaker load ladybug` / `--sink ladybug`
]
duckdb = [
    # DuckPGQ is a community extension built per DuckDB release; this is the newest
    # release it exists for. Check https://community-extensions.duckdb.org/extensions/duckpgq.html before bumping.
    "duckdb==1.5.4",
]
pyg = [
    "torch>=2.2",
    "torch_geometric>=2.5",
    "scikit-learn>=1.4",  # the features-only baseline and the AUC/AP scoring in examples/pyg_baseline.py
]
examples = [
    "matplotlib>=3.8",
    # matplotlib brings Pillow, and 12.3.0 has eight image-parsing CVEs
    # (CVE-2026-112395/112397/112400/112404/112895/112896/112897/112899: TIFF
    # out-of-bounds reads, a PPM width of zero, a GIF decompression bomb, PDF
    # append recursion, EPS through Ghostscript). Nothing in GraphFaker opens
    # an image, so none of it is reachable from the package itself; this is
    # for the notebook environment, where a plot is rendered and saved. The
    # marker is because Pillow 13 needs 3.11 and the package supports 3.10,
    # which keeps the extra installable there rather than forcing a choice.
    "pillow>=13.0.0; python_version >= '3.11'",
    "ladybug>=0.20",  # LadybugDB, the embedded graph database the notebooks query
    "scikit-learn>=1.4",  # the model in docs/notebooks/neo4j_fraud_analysis.ipynb
    "nbformat",
    "nbclient",
    "ipykernel",
    "notebook>=7.6.3",  # 7.6.3 fixes PYSEC-2026-4112; it pulls jupyterlab, which needs >= 4.6.4
    "jupyterlab>=4.6.4",  # PYSEC-2026-4055/4056/4057
    "neo4j>=5.26",
    "duckdb==1.5.4",
    "osmnx==2.0.2",
]
llm = [
    # The semantic layer: `graphfaker schema draft "<description>"`. Both are
    # small pure-Python clients, and neither is imported unless you ask for
    # one. No generated dataset depends on either: a model writes a schema
    # file, a human reads it, and the engine generates from the file.
    "anthropic>=0.49",
    "openai>=1.70",
]
docs = [
    "sphinx>=8.0",
    "myst-nb>=1.2",
    "myst-parser>=4.0",
    "pydata-sphinx-theme>=0.19.0",
    "sphinx-reredirects>=0.1.6",
]
dev = [
    "coverage",  # testing
    "mypy",  # linting
    "pytest",  # testing
    "ruff",  # linting
    "pip-audit",  # dependency vulnerability check
    "orjson",  # optional at runtime: halves the parse cost of reading a register
]

# For uv-managed environments (development and CI) torch on Linux comes from
# the CPU index: the PyPI wheel drags several gigabytes of CUDA libraries that
# the PyG export and its tests do not use. `pip install graphfaker[pyg]` is not
# affected; it resolves from PyPI as usual.
[tool.uv.sources]
torch = [{ index = "pytorch-cpu", marker = "sys_platform == 'linux'" }]

[[tool.uv.index]]
name = "pytorch-cpu"
url = "https://download.pytorch.org/whl/cpu"
explicit = true

[project.scripts]
graphfaker = "graphfaker.cli:app"

[project.urls]
homepage = "https://github.com/graphgeeks-lab/graphfaker/"
documentation = "https://graphfaker.readthedocs.io"
repository = "https://github.com/graphgeeks-lab/graphfaker"
changelog = "https://github.com/graphgeeks-lab/graphfaker/blob/main/HISTORY.rst"
issues = "https://github.com/graphgeeks-lab/graphfaker/issues"
discord = "https://discord.gg/mQQz9bRRpH"

[tool.setuptools]
package-dir = {"graphfaker" = "graphfaker"}

[tool.setuptools.package-data]
"*" = ["*.*"]




# Mypy
# ----

[tool.mypy]
files = "."

# Use strict defaults
strict = true
warn_unreachable = true
warn_no_return = true




[tool.pytest.ini_options]
markers = [
  "network: test reaches the internet; deselect with -m 'not network'",
  "neo4j: test needs a running Neo4j; skipped when none is reachable. Select with -m neo4j",
]