fix(ibis): move duckdb and opendal to main-dependency

[goldmedal]

Description

We put duckdb and opendal in the dev dependency but it should be used in the production.

Summary by CodeRabbit

• Dependencies
  • Updated project dependencies:
    • Moved duckdb to version 1.1.3
    • Moved opendal to version >=0.45
  • Relocated dependencies from development to main configuration

[coderabbitai]

Walkthrough

The pull request modifies the pyproject.toml file by relocating two dependencies, duckdb and opendal, from the development dependencies section to the main dependencies section. The version specifications remain consistent, with duckdb set to a specific version of "1.1.3" and opendal using a version constraint of ">=0.45".

Changes

File	Change Summary
ibis-server/pyproject.toml	- Moved duckdb from dev dependencies to main dependencies - Moved opendal from dev dependencies to main dependencies

Poem

🐰 A Rabbit's Dependency Dance

From dev to main, dependencies leap,
DuckDB and OpenDAL now take their seat,
A poetry shuffle, precise and neat,
Dependencies finding their rhythm sweet,
In the config's harmonious retreat! 🚀

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

ibis-server/pyproject.toml (1)

35-35: Consider pinning the OpenDAL version.

Using >=0.45 could lead to unexpected behavior if major versions introduce breaking changes. Consider pinning to a specific version or using a more restrictive version constraint (e.g., >=0.45,<1.0).

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f84a7ee and 18b0ef2.

⛔ Files ignored due to path filters (1)

• ibis-server/poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• ibis-server/pyproject.toml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms (1)

• GitHub Check: ci

🔇 Additional comments (2)

ibis-server/pyproject.toml (2)

34-35: Verify security advisories for production dependencies.

Since these dependencies are being moved to production, we should verify there are no known vulnerabilities in the specified versions.

✅ Verification successful

✅ No security vulnerabilities found for duckdb and opendal

Both dependencies have been verified against the GitHub Security Advisory Database and no known vulnerabilities were found for the specified versions.

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Check for security advisories for both packages
gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: PIP, package: "duckdb") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}' 

gh api graphql -f query='
{
  securityVulnerabilities(first: 5, ecosystem: PIP, package: "opendal") {
    nodes {
      advisory {
        summary
        severity
        publishedAt
      }
      vulnerableVersionRange
      firstPatchedVersion {
        identifier
      }
    }
  }
}'

Length of output: 679

---

34-35: Verify production usage of these dependencies.

Before moving these to production dependencies, we should verify they are actually used in production code and not just in tests.

✅ Verification successful

Dependencies are correctly placed as production dependencies

Both DuckDB and OpenDAL are actively used in production code:

• DuckDB is used for database operations in object_storage.py, connector.py, and as a data source in rewriter.py
• OpenDAL is used for filesystem operations in object_storage.py

🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Search for DuckDB usage in production code (excluding tests)
echo "Checking DuckDB usage in production code:"
rg -l "(?i)duckdb" --type py | grep -v "test_" || true

echo -e "\nChecking OpenDAL usage in production code:"
rg -l "(?i)opendal" --type py | grep -v "test_" || true

# Search for specific imports
echo -e "\nChecking for specific imports:"
ast-grep --pattern 'import duckdb' || true
ast-grep --pattern 'from duckdb import $_' || true
ast-grep --pattern 'import opendal' || true
ast-grep --pattern 'from opendal import $_' || true

Length of output: 888

---

Script:

#!/bin/bash
# Check DuckDB usage context
echo "DuckDB usage in object_storage.py:"
rg "duckdb" ibis-server/app/model/metadata/object_storage.py -B 2 -A 2

echo -e "\nDuckDB usage in connector.py:"
rg "duckdb" ibis-server/app/model/connector.py -B 2 -A 2

echo -e "\nDuckDB usage in rewriter.py:"
rg "duckdb" ibis-server/app/mdl/rewriter.py -B 2 -A 2

echo -e "\nOpenDAL usage in object_storage.py:"
rg "opendal" ibis-server/app/model/metadata/object_storage.py -B 2 -A 2

Length of output: 1930