chore: remove unused Pydantic email extra

[nabinchha]

📋 Summary

Remove the unused Pydantic email extra from data-designer-config. Data Designer does not use Pydantic email validation APIs, so this removes email-validator and dnspython from the runtime dependency graph without changing product behavior.

🔗 Related Issue

Closes #823

🔄 Changes

• Replace pydantic[email] with plain pydantic in data-designer-config.
• Refresh uv.lock to remove email-validator and dnspython.

🧪 Testing

• make check-all
• uv lock --check
• Config, engine, and interface test suites (3,957 passed, 1 skipped; socket-bound interface tests rerun with localhost access)

✅ Checklist

• Follows commit message conventions
• Commits are signed off (DCO)
• Architecture docs updated (N/A — dependency-only change)

[greptile-apps]

Greptile Summary

This PR removes the pydantic[email] extra from data-designer-config, replacing it with plain pydantic, and refreshes uv.lock to drop email-validator and dnspython from the dependency graph. A codebase-wide search confirms no usage of EmailStr, validate_email, or email_validator in production code (the only match is a test fixture that uses it as an example pattern).

• Removes pydantic[email] from packages/data-designer-config/pyproject.toml, replacing it with plain pydantic>=2.9.2,<3.
• Drops email-validator 2.3.0 and dnspython 2.8.0 from uv.lock, reducing the transitive dependency footprint.

Confidence Score: 5/5

Safe to merge — removes two unused transitive dependencies with no behavior change.

The change drops an unused optional extra from pydantic. A codebase-wide search found zero production usage of EmailStr, validate_email, or email_validator, confirming the extra was never exercised. The lock file update is mechanically consistent with the pyproject.toml change.

No files require special attention.

Important Files Changed

Filename	Overview
packages/data-designer-config/pyproject.toml	Removes the [email] extra from the pydantic dependency; no email validation APIs are used in this package.
uv.lock	Lock file updated to remove email-validator 2.3.0 and dnspython 2.8.0 entries and their references from the data-designer-config package section.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[data-designer-config] -->|before| B["pydantic[email]>=2.9.2,<3"]
    B --> C[email-validator 2.3.0]
    C --> D[dnspython 2.8.0]
    C --> E[idna]

    A2[data-designer-config] -->|after| B2["pydantic>=2.9.2,<3"]

    style C fill:#f99,stroke:#c00
    style D fill:#f99,stroke:#c00
    style B fill:#fdd,stroke:#c00
    style B2 fill:#dfd,stroke:#090

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[data-designer-config] -->|before| B["pydantic[email]>=2.9.2,<3"]
    B --> C[email-validator 2.3.0]
    C --> D[dnspython 2.8.0]
    C --> E[idna]

    A2[data-designer-config] -->|after| B2["pydantic>=2.9.2,<3"]

    style C fill:#f99,stroke:#c00
    style D fill:#f99,stroke:#c00
    style B fill:#fdd,stroke:#c00
    style B2 fill:#dfd,stroke:#090

Loading

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into codex/823-remov..." | Re-trigger Greptile}

[github-actions]

Thanks for putting this together, @nabinchha — nice tidy-up of the dependency graph.

Summary

This PR drops the [email] extra from the pydantic dependency in data-designer-config and refreshes uv.lock, removing email-validator and its transitive dep dnspython from the runtime closure. The implementation matches the stated intent and the acceptance criteria in #823: no production code uses pydantic.EmailStr/NameEmail/email_validator, so this is a safe, behavior-preserving dependency trim.

Findings

I verified the core claim and the blast radius rather than just reading the diff:

• No email-validation usage in product code. A repo-wide search for EmailStr, NameEmail, email_validator, and validate_email turns up nothing in packages/*/src. The one import email.utils in engine/models/clients/errors.py is the Python stdlib, unrelated to the extra.
• The dependency-audit test still holds. packages/data-designer/tests/test_dependency_audit.py:94 (test_marks_dependency_from_selected_extra_low) references pydantic[email] and email_validator, but it builds a synthetic pyproject.toml/module inside a tmp_path fixture — it doesn't read the real project config, so it's unaffected by this change.
• Lockfile is clean. No dangling email-validator / dnspython references remain in uv.lock after the removal, and no other package in the workspace requests the email extra.
• License-policy exception (ci: add dependency license compatibility check #822). The linked issue flagged a possible follow-up: remove any stale email-validator exception from the dependency-license policy if ci: add dependency license compatibility check #822 had landed. I searched the repo config/docs and found no such exception present, so there's nothing left to clean up here — the acceptance criterion is satisfied by virtue of the entry not existing.

No Critical, Warning, or Suggestion findings.

What Looks Good

• Scoped precisely. The change is exactly the two lines it needs to be (spec in pyproject.toml, plus the mechanically-regenerated uv.lock), with no incidental version drift on the >=2.9.2,<3 bound.
• Well-evidenced PR description. The testing checklist (make check-all, uv lock --check, all three suites) plus the "does not use email validation APIs" rationale makes the safety of the change easy to confirm.
• Reduces attack surface for free. Dropping dnspython from the runtime graph is a small but genuine supply-chain win with zero product cost.

Verdict

Ship it — verified that no product code depends on the email extra, the lockfile closure is consistent, the one referencing test is a self-contained fixture, and there's no stale license exception to remove. Ready to merge as-is.

---

This review was generated by an AI assistant.

[johnnygreco]

Thanks for putting this together, @nabinchha!

Summary

This removes the unused Pydantic email extra from data-designer-config and refreshes the lockfile so email-validator and dnspython leave the runtime dependency graph. The implementation matches the PR description and linked issue without changing product behavior.

Findings

No findings.

What Looks Good

• The change is tightly scoped to the dependency declaration and its generated lockfile consequences.
• Repository-wide searches confirm production code does not use Pydantic's email types or either removed package.
• The lockfile is current and internally consistent, and both the targeted dependency-audit tests and the full CI matrix pass.

Verdict

Ship it — No findings. Ready to merge as-is.

---

This review was generated by an AI assistant.