NIFI-13741: Downgrade chromadb dependency - protobuf conflict

[Lehel44]

…uf version conflict with qdrant-client

Summary

NIFI-13741

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

[joewitt]

Fundamentally we should not be downgrading core dependencies of the systems we're aiming to talk to. We should be going the other way. Conflicts otherwise should be evaluated and potentially resolved. Can you please show/share more about the conflicts you are seeing and in what form factor? The description I saw in the JIRA surprised me. Is this defeating nar isolation somehow? The items you listed should not be related to this but perhaps I'm missing an important detail.

But fundamental - we should not be downgrading dependency versions we should be updating them. Especially for these newer AI related systems where resolutions as it relates to security matters and such are evolving fast.

Thanks

[Lehel44]

@joewitt the qdrant-client and chromadb dependencies are defined in the same package and are package-level dependencies i.e. they conflict on the protobuf version.

I was thinking about finer grade modularization but the Developer Guide is not clear about the limitations of defining package level and processor level dependencies together. I personally did not achieve success in that way.

There is an option to package the processors separately, but there's another limitation -> every file used in the processor has to be in the same package -> which results in file duplication.

I'd like to know if the mixed package-level and processor-level dependencies is a possible way to resolve this.
To define common dependencies in a requirement.txt and individual ones within the processors.

[Lehel44]

Agreed on doing better dependency isolation into different package with possible code duplcation.