Found while consuming the toolkit purely for its validators/ (the dossier-audit gate) in prompt-injection-portfolio.
pyproject.toml lists pdfplumber and docling as hard dependencies. A consumer that only runs validators/*.py is forced to install the full extraction stack (docling pulls a large ML dependency tree; the pyproject itself notes docling-parse build fragility on darwin). The validators import only yaml (PyYAML).
We ended up not depending on the package at all — instead bootstrapping a pinned clone and running validators in an ephemeral env with just PyYAML — specifically to avoid dragging docling/pdfplumber into a portfolio that never uses them.
Suggestion: move extraction-only deps to an extra (e.g. [extraction] / [pdf]), keeping the base install minimal so validator-only consumers (and CI) stay lean. A [validators] marker extra would also document the intent.
— filed from consumer prompt-injection-portfolio
Found while consuming the toolkit purely for its
validators/(the dossier-audit gate) inprompt-injection-portfolio.pyproject.tomllistspdfplumberanddoclingas hard dependencies. A consumer that only runsvalidators/*.pyis forced to install the full extraction stack (docling pulls a large ML dependency tree; the pyproject itself notes docling-parse build fragility on darwin). The validators import onlyyaml(PyYAML).We ended up not depending on the package at all — instead bootstrapping a pinned clone and running validators in an ephemeral env with just PyYAML — specifically to avoid dragging docling/pdfplumber into a portfolio that never uses them.
Suggestion: move extraction-only deps to an extra (e.g.
[extraction]/[pdf]), keeping the base install minimal so validator-only consumers (and CI) stay lean. A[validators]marker extra would also document the intent.— filed from consumer
prompt-injection-portfolio