From 5d1518bf58efba8039a01d02101ffce99dd64cf2 Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 25 Mar 2026 08:46:53 +0000
Subject: [PATCH 1/2] Bump Data Designer to 0.5.4 (removes litellm dependency)

NVIDIA Data Designer v0.5.4 removes litellm entirely and replaces it
with native OpenAI and Anthropic adapters. This follows the litellm
supply chain incident where versions 1.82.7 and 1.82.8 were compromised
with a credential stealer.

Release notes: https://github.com/NVIDIA-NeMo/DataDesigner/releases/tag/v0.5.4

Changes:
- Bump data-designer, data-designer-config, data-designer-engine to 0.5.4
- Sync data-designer-deps.txt with 0.5.4 engine requirements:
  - Added: chardet, fsspec, mcp
  - Removed: python-json-logger, pymupdf, pymupdf4llm, mammoth
    (these remain in the unstructured-seed plugin which still needs them)
  - duckdb constraint relaxed from <1.5 to <2 (upstream fixed record_batch)
- Bump plugin lower bound to >=0.5.4
---
 .../data-designer-unstructured-seed/pyproject.toml    |  2 +-
 .../requirements/single-env/data-designer-deps.txt    | 11 +++++------
 .../backend/requirements/single-env/data-designer.txt |  6 +++---
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml b/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
index d4770a0b05..c9d988bd9d 100644
--- a/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
+++ b/studio/backend/plugins/data-designer-unstructured-seed/pyproject.toml
@@ -11,7 +11,7 @@ version = "0.1.0"
 description = "Local Data Designer unstructured seed reader plugin"
 requires-python = ">=3.11"
 dependencies = [
-  "data-designer-engine>=0.5.1,<0.6",
+  "data-designer-engine>=0.5.4,<0.6",
   "pandas>=2,<3",
   "pymupdf>=1.24.0",
   "pymupdf4llm>=0.0.17",
diff --git a/studio/backend/requirements/single-env/data-designer-deps.txt b/studio/backend/requirements/single-env/data-designer-deps.txt
index 9cd0db99e4..885a95cf88 100644
--- a/studio/backend/requirements/single-env/data-designer-deps.txt
+++ b/studio/backend/requirements/single-env/data-designer-deps.txt
@@ -1,8 +1,10 @@
 # Data Designer runtime deps installed explicitly (single-env mode).
-# DuckDB 1.5 removed Relation.record_batch(); keep <1.5 until upstream ships the fix.
+# Synced with data-designer-engine==0.5.4 requirements.
 anyascii<1,>=0.3.3
-duckdb<1.5,>=1.1.3
+chardet<6,>=3.0.2
+duckdb<2,>=1.5.0
 faker<21,>=20.1.0
+fsspec<2026,>=2025.3.0
 httpx<1,>=0.27.2
 httpx-retries<1,>=0.4.2
 json-repair<1,>=0.48.0
@@ -10,12 +12,9 @@ jsonpath-rust-bindings<2,>=1.0
 jsonschema<5,>=4.0.0
 lxml<7,>=6.0.2
 marko<3,>=2.1.2
+mcp<2,>=1.26.0
 networkx<4,>=3.0
-python-json-logger<4,>=3
 ruff<1,>=0.14.10
 scipy<2,>=1.11.0
 sqlfluff<4,>=3.2.0
 tiktoken<1,>=0.8.0
-pymupdf>=1.24.0
-pymupdf4llm>=0.0.17
-mammoth>=1.8.0
diff --git a/studio/backend/requirements/single-env/data-designer.txt b/studio/backend/requirements/single-env/data-designer.txt
index 8daa1eca43..2e0ba62249 100644
--- a/studio/backend/requirements/single-env/data-designer.txt
+++ b/studio/backend/requirements/single-env/data-designer.txt
@@ -1,5 +1,5 @@
 # Install Data Designer in same env as Unsloth.
-data-designer==0.5.2
-data-designer-config==0.5.2
-data-designer-engine==0.5.2
+data-designer==0.5.4
+data-designer-config==0.5.4
+data-designer-engine==0.5.4
 prompt-toolkit>=3,<4

From b70ec4d112700f29e50ef5bc338c5ce7ec1c0b8e Mon Sep 17 00:00:00 2001
From: Daniel Han <danielhanchen@gmail.com>
Date: Wed, 25 Mar 2026 08:53:00 +0000
Subject: [PATCH 2/2] Keep pymupdf, pymupdf4llm, mammoth in data-designer-deps

The unstructured-seed plugin is installed with --no-deps, so its
pyproject.toml dependencies are not auto-resolved. These three
packages are needed by the seed route (studio/backend/routes/
data_recipe/seed.py) and must remain in the explicit deps list.
---
 studio/backend/requirements/single-env/data-designer-deps.txt | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/studio/backend/requirements/single-env/data-designer-deps.txt b/studio/backend/requirements/single-env/data-designer-deps.txt
index 885a95cf88..0cb42db01d 100644
--- a/studio/backend/requirements/single-env/data-designer-deps.txt
+++ b/studio/backend/requirements/single-env/data-designer-deps.txt
@@ -18,3 +18,7 @@ ruff<1,>=0.14.10
 scipy<2,>=1.11.0
 sqlfluff<4,>=3.2.0
 tiktoken<1,>=0.8.0
+# Unstructured-seed plugin deps (plugin installed with --no-deps)
+pymupdf>=1.24.0
+pymupdf4llm>=0.0.17
+mammoth>=1.8.0