refactor(deps): demote LangChain and LangChain-providers from core to dev

[Pouyanpi]

Description

Now that DefaultFramework handles OpenAI-compatible chat via httpx, LangChain is no longer needed for basic operation. Moving it out of core slims the mandatory install substantially and makes the LangChain integration genuinely opt-in.

Core dependencies (removed):

• langchain, langchain-core, langchain-community: only imported lazily inside nemoguardrails/integrations/langchain/ and in conditional paths in llm/frameworks.py and rails/llm/llmrails.py
• langchain-openai: not imported anywhere in src; only referenced by test skipif guards.
• langchain-nvidia-ai-endpoints: imported conditionally in embeddings/providers/nim.py (NIM embeddings) and in LangChain-NIM adapter. Users who need these paths install the package directly.

Extras (removed):

• openai (was -> langchain-openai): obsolete, DefaultFramework uses httpx directly.
• nvidia (was -> langchain-nvidia-ai-endpoints): obsolete for chat; NIM embeddings users should install langchain-nvidia-ai-endpoints directly.

Extras (kept and adjusted):

• server: still includes openai because server/schemas and server/api import openai.types.chat at module scope (server won't start without the openai SDK).
• all: updated to drop the removed extras.

Dev group additions:

• langchain, langchain-core, langchain-community: needed by the LangChain integration tests under tests/integrations/langchain/.
• langchain-openai, langchain-nvidia-ai-endpoints: skip-guarded by tests today; installed in dev so those guards activate.

Runtime behavior unchanged: code that used these packages always imported them lazily or conditionally. Users on
NEMOGUARDRAILS_LLM_FRAMEWORK=langchain now need to install langchain-* themselves; an upgrade note in the migration guide is appropriate (follow-up).

TODO

• upgrade note in migration guide

Related Issue(s)

#1580

Checklist

• I've read the CONTRIBUTING guidelines.
• I've updated the documentation if applicable.
• I've added tests if applicable.
• @mentions of the person or team responsible for reviewing proposed changes.

Summary by CodeRabbit

• Refactor
  • LangChain integration is now available as an optional installation at runtime rather than included by default. Users can still access full LangChain functionality by installing the necessary packages separately when needed, reducing the core package footprint.

[greptile-apps]

Greptile Summary

This PR demotes langchain, langchain-core, langchain-community, langchain-openai, and langchain-nvidia-ai-endpoints from core/optional to dev-only dependencies, and removes the openai and nvidia extras. The server extra now owns the openai SDK, and the OPTIONAL_DEPENDENCIES map in imports.py is updated accordingly — fixing the stale "openai" and "nvidia" extra references flagged in the previous review. Runtime behavior is unchanged since all affected imports were already lazy or conditional.

Confidence Score: 5/5

Safe to merge — the previous P1 stale-extras issues are resolved, no new logic errors introduced, and runtime import paths are unchanged.

All P1 findings from prior review rounds (stale OPTIONAL_DEPENDENCIES entries pointing to removed extras) are now corrected. No module-scope imports of the demoted packages exist outside the server path, and the embedding providers already used lazy try/except imports. No new P0 or P1 issues found.

No files require special attention. Integration docs under docs/integration/langchain/ still reference langchain packages but those are pre-existing and out of this PR's scope.

Important Files Changed

Filename	Overview
nemoguardrails/imports.py	Corrected OPTIONAL_DEPENDENCIES: langchain_openai → None, langchain_nvidia_ai_endpoints → None, and openai → "server"; resolves stale extra references from previous review
pyproject.toml	Removes langchain*, langchain-openai, langchain-nvidia-ai-endpoints from core deps; drops openai and nvidia extras; adds all five LangChain packages to dev group; server extra correctly retains openai SDK
docs/getting-started/installation-guide.md	Removes references to dropped nvidia and openai extras from quick-start commands and the extras table; aligns documentation with new dependency layout

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["pip install nemoguardrails"] --> B["Core only: httpx, jinja2, lark, etc."]
    A --> C{"Need extras?"}
    C -->|server| D["pip install nemoguardrails server extra + openai SDK"]
    C -->|LangChain integration| E["pip install langchain langchain-core langchain-community langchain-openai"]
    C -->|NIM embeddings| F["pip install langchain-nvidia-ai-endpoints"]
    C -->|eval / sdd / tracing| G["pip install nemoguardrails with eval/sdd/tracing extras"]
    B --> H["DefaultFramework httpx-based chat"]
    D --> I["nemoguardrails server"]
    E --> J["NEMOGUARDRAILS_LLM_FRAMEWORK=langchain"]

Loading

_{Reviews (7): Last reviewed commit: "docs: drop langchain-nvidia install hint..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

📝 Walkthrough

Walkthrough

LangChain-related packages (langchain, langchain-core, langchain-community, langchain-openai, langchain-nvidia-ai-endpoints) are relocated from optional runtime dependencies to development-only dependencies. The corresponding Poetry extras for openai and nvidia are removed from the main dependency declarations.

Changes

Cohort / File(s)	Summary
Dependency Configuration pyproject.toml	Removed LangChain packages from [tool.poetry.dependencies] and [tool.poetry.extras] (openai, nvidia). Reintroduced the same packages as [tool.poetry.group.dev.dependencies], with a note that LangChain integration is opt-in at runtime.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Test Results For Major Changes	⚠️ Warning	PR moves LangChain packages to dev dependencies and removes extras without documented evidence of test execution or validation of the breaking change.	Update PR description with concrete test execution results, coverage metrics, and add upgrade note to migration guide documenting the breaking change for users.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: moving LangChain packages from core/optional dependencies to development dependencies, making them opt-in at runtime.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/langchain-decouple/stack-11-deps-cleanup

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@pyproject.toml`:
- Around line 157-163: Tighten the provider package constraints in
pyproject.toml so they remain compatible with langchain==0.2.14 and
langchain-core <0.3.0: update the langchain-openai requirement to add an upper
bound (e.g., restrict to <0.2.0) and add an upper bound to
langchain-nvidia-ai-endpoints (e.g., restrict to <1.0.0) so they cannot pull
newer major versions that require langchain-core >=0.3.x or >=1.x; adjust the
version strings for the langchain-openai and langchain-nvidia-ai-endpoints
entries accordingly while keeping the existing langchain and langchain-core
constraints.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dd993b57-4e8a-4ede-b212-bde52a82758b

📥 Commits

Reviewing files that changed from the base of the PR and between 4f3a939 and a82c5e9.

⛔ Files ignored due to path filters (1)

• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• pyproject.toml

[tgasser-nv]

Looks good! Just a few comments to address before merging:

1. Docs updates:
   a) CONTRIBUTING.md tries to install the openai extra which is now gone.
   b) The Getting Started guide installs the nvidia extra to use NVCF in the examples.
2. The migration note is unchecked in the description.
3. Greptile pointed out the OPTIONAL_DEPENDENCIES in imports.py needs updating.
4. Are there any CI workflows which use these extras?

[Pouyanpi]

Thanks @tgasser-nv ! I addressed your comments, only keeping CONTRIBUTING-GUIDE.md for a follow-up PR as docs need more changes given this decoupling.