v0.6.2

0.6.2 — audit-driven release. Closes the 4 CRIT + 4 MAJ flagged by
the 0.6.1 audit and the 0.6.2 release-gate audit.

Highlights

• Image size cut by ~half — latest-local drops from 6.04 GB to 3.11 GB
  (-48%), and a new slim latest-remote ships at 547 MB. Details below.
• docling-serve container added under the remote compose profile —
  the backend now ships a slim image that delegates conversion to
  quay.io/docling-project/docling-serve-cpu:v1.21.0 over HTTP. Zero
  HuggingFace Hub dependency in build or runtime.
• Backend + embedding-service migrated from pip to uv. Single source
  of truth is now pyproject.toml + uv.lock. BREAKING for anyone
  bootstrapping from requirements*.txt.
• BAKE_MODELS default flipped from true to false in both
  Dockerfiles. The only sanctioned HF touch in the project is now the
  latest-local GHCR build in release.yml. BREAKING for operators
  building from source — pass --build-arg BAKE_MODELS=true explicitly
  to restore the old behaviour. See
  docs/architecture/huggingface-dependency-map.md.
• Reasoning stack made opt-in via --build-arg WITH_REASONING=true
  (#254). BREAKING — without the flag, /api/reasoning responds 503.

Pre-built images — major size reduction

The latest-local image dropped by ~48% (-2.93 GB) versus 0.5.1, and
the new remote variant ships at 547 MB — about an order of magnitude
smaller than 0.5.1's only published variant. Pulls are faster, hosts use
less disk, and cold starts are quicker.

Image	0.5.1	0.6.2	Δ
latest-local (Docling + models baked in)	6.04 GB	3.11 GB	-2.93 GB (-48%)
latest-remote (talks to docling-serve over HTTP)	—	547 MB	new — -91% vs 0.5.1 local

Where the bytes went:

• uv migration (#254) — smaller resolved venv vs pip, deterministic
  lockfile, no transitive bloat that nobody noticed under pip's resolver.
• Explicit CPU-only torch via [tool.uv.sources] — drops ~3 GB of useless
  CUDA wheels that used to come along for the ride on latest-local.
• Reasoning made opt-in — docling-agent + mellea + their LLM SDK
  transitive weight move out of the default image. Rebuild with
  --build-arg WITH_REASONING=true to keep them.
• BAKE_MODELS opt-in for non-release builds — only release.yml
  builds the local target with the ~1.3 GB Docling checkpoint bake; the
  remote variant carries none.
• Hardened .dockerignore — leaner build context, no spurious layer
  churn on every rebuild.

Tags published

Both targets are tagged three ways for pinning flexibility:

• ghcr.io/scub-france/docling-studio:0.6.2-remote / 0.6-remote / latest-remote
• ghcr.io/scub-france/docling-studio:0.6.2-local / 0.6-local / latest-local

---

Added

• Docling Serve container wired into compose (#audit-10, dd1962e, bc9b4f8): new docling-serve service under the remote compose profile, pinned to quay.io/docling-project/docling-serve-cpu:v1.21.0. Pairs with CONVERSION_MODE=remote so the backend image stays slim and talks to a Docling Serve container over HTTP — no HF Hub dep on the build or runtime path. CI/release-gate E2E jobs now use this combo.
• HuggingFace dependency map (docs/architecture/huggingface-dependency-map.md): exhaustive list of every HF call site in the project, the single sanctioned touch point (release.yml → latest-local), and the maintenance rule that every new HF dep must be opt-in.

Changed

• Backend + embedding-service migrated from pip to uv (#254, 4d9bcf6): document-parser/requirements*.txt and embedding-service/requirements.txt removed; uv.lock plus pyproject.toml's [project] / [dependency-groups] blocks are now the single source of truth. Dev workflow becomes uv sync --group dev (backend) / uv sync --group local (local Docling). PyTorch is redirected to the explicit CPU index via [tool.uv.sources] to avoid pulling the ~3 GB CUDA wheels into latest-local.
• latest-local ships with Docling model checkpoints baked at build time (#254, 9d62337): suppresses the cold-start HF Hub download on the first /api/convert. End users get an instant first-convert from the pulled GHCR image.
• .dockerignore hardened (#254, fe1dc16): tests, audit reports, .claude/, docker-compose*.yml and other build-irrelevant paths excluded — leaner build context, smaller intermediate layers.
• Reasoning stack made opt-in via WITH_REASONING build-arg (#254, d1ed61e, bb2fe2b): docling-agent and mellea moved out of [project.dependencies] into [dependency-groups.reasoning]. The default latest-local image no longer carries them — /api/reasoning responds 503 (graceful degrade). Building with --build-arg WITH_REASONING=true restores the 0.6.1 behaviour.
• BAKE_MODELS and BAKE_MODEL default to false (#audit-10): both document-parser/Dockerfile and embedding-service/Dockerfile now opt out of HuggingFace Hub by default at build time. The only sanctioned bake is release.yml → latest-local GHCR image, which sets BAKE_MODELS=true explicitly on the local matrix entry. See the new HF dependency map for details.

Fixed

• Remote-mode bbox overlay — second pass (3936166, follow-up to the 0.6.1 fix): a code path the 0.6.1 patch missed still dropped self_ref in ServeConverter. The Linked-view canvas overlay now lights up consistently in remote mode.
• Architecture test excludes generated files (d29360d): tests/test_architecture.py no longer scans uploads/, data/ or other runtime artifacts — keeps the layering rules clean without false positives.

CI

• STUDIO_MODE_ENABLED opted in on the main CI too (8a61c22): the @critical UI suite needs the legacy /studio surface; previously only release-gate.yml set the flag, leaving ci.yml E2E UI silently exercising the wrong surface.
• Docling model bake skipped during CI builds (051ac4a, #audit-10): both ci.yml E2E jobs and both release-gate.yml E2E jobs (e2e-api, e2e-ui) now build the image with BAKE_MODELS=false to avoid HuggingFace Hub 429 rate limits on shared GHA runners. release.yml keeps BAKE_MODELS=true so the published image still carries the baked checkpoints.
• Unit test no longer pulls HF tokenizer (#audit-10): test_rechunk_with_serve_document_json was instantiating a real LocalChunker, forcing HybridChunker to download sentence-transformers/all-MiniLM-L6-v2. Now mocks the DocumentChunker port — same intent, no public network in a unit test.

BREAKING CHANGES

• Backend dev workflow migrated to uv: pip install -r document-parser/requirements*.txt / pip install -r embedding-service/requirements.txt no longer work — these files are gone. Use uv sync (--group dev for tests, --group local for local Docling mode). Any third-party CI / IDE bootstrap script that relies on the old requirements*.txt layout must migrate.
• Reasoning runtime made opt-in: building latest-local without --build-arg WITH_REASONING=true produces an image where /api/reasoning responds 503. Operators who depended on the 0.6.1 default-on reasoning stack must add the build-arg to their pipeline.
• BAKE_MODELS default flipped from true to false in both document-parser/Dockerfile and embedding-service/Dockerfile. Operators who build their own local image from source and rely on the "instant first /api/convert" behaviour must now pass --build-arg BAKE_MODELS=true explicitly. The published ghcr.io/.../docling-studio:latest-local image is unaffected — release.yml opts in. Pulling that image (the documented path) continues to work as before. See docs/architecture/huggingface-dependency-map.md for the rationale and the full HF call-site map.