Remove gradio dependency in trackio -- only gradio_client is needed locally anymore. Also lazily import pandas and remove it as a dependency

[abidlabs]

This PR drops the dependency on gradio, fastapi, and pandas for local Trackio usage. The dashboard and CLI now rely on gradio-client, Starlette, and Uvicorn, with small vendored copies of the Gradio pieces we still need (tunneling, networking helpers, and shared exceptions). Server startup and ASGI wiring were refactored accordingly (launch.py, asgi_app.py, server.py, etc.). Note that when we deploy on Gradio Spaces, we still use gradio as but not locally.

Before: Non-editable install (pip install .) on macOS, Python 3.10.19. Figures are total size of site-packages after dependency resolution.

	Before (main)	After (this branch)
site-packages on disk	~230.8 MB	~99.9 MB
Packages (pip freeze)	57	37

Comparing to other packages:

Package	site-packages on disk	Packages (pip freeze)
Trackio (this branch)	~99.9 MB	37
wandb	~119.6 MB	20
mlflow	~558.5 MB	91

(It feels like the local Trackio dashboard is even snappier now though that's just based on my vibes)

[gradio-pr-bot]

🪼 branch checks and previews

•	Name	Status	URL
🦄	Changes	detected!	Details

[gradio-pr-bot]

🦄 change detected

This Pull Request includes changes to the following packages.

Package	Version
trackio	minor

---

• Remove gradio dependency in trackio -- only gradio_client is needed locally anymore. Also lazily import pandas and remove it as a dependency

---

‼️ Changeset not approved. Ensure the version bump is appropriate for all packages before approving.

• Maintainers can approve the changeset by checking this checkbox.

Something isn't right?

• Maintainers can change the version label to modify the version bump.
• If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

[HuggingFaceDocBuilderDev]

🪼 branch checks and previews

•	Name	Status	URL
	Spaces	ready!	Spaces preview

---

Install Trackio from this PR (includes built frontend)

pip install "https://huggingface.co/buckets/trackio/trackio-wheels/resolve/193508f83dee4006cd17fe1f5cb41e508de282f4/trackio-0.22.0-py3-none-any.whl"

[HuggingFaceDocBuilderDev]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Copilot]

Pull request overview

This PR refactors Trackio’s local dashboard/server stack to remove the heavyweight gradio and pandas dependencies for local usage, replacing Gradio’s local server/API surface with a Starlette + Uvicorn ASGI app and a Trackio-specific HTTP API (while preserving compatibility with existing Gradio-based Spaces via a fallback client).

Changes:

• Replace local Gradio server/API with a Starlette-based HTTP API (/version, /api/{name}, /api/upload, /file) and update frontend API calls accordingly.
• Remove pandas dependency by converting DataFrame-centric code paths to operate on row dictionaries (and adding pyarrow-based parquet IO for Spaces export/import).
• Introduce a new RemoteClient that negotiates a Trackio HTTP transport when supported and falls back to gradio_client for older deployments.

Reviewed changes

Copilot reviewed 33 out of 34 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
trackio/utils.py	Removes pandas usage and refactors downsample() + missing-value checks; updates logo URL paths to /file?path=....
trackio/typehints.py	Switches FileData import to gradio_client.
trackio/table.py	Removes pandas DataFrame dependency by normalizing inputs to row dicts; updates image URLs to /file?path=....
trackio/sqlite_storage.py	Replaces pandas-based flattening/parquet IO with row-dict + pyarrow-based helpers and SQL row replacement.
trackio/server.py	Refactors request types to Starlette, replaces gr.Error with TrackioAPIError, and replaces Gradio server wiring with Starlette app builder.
trackio/run.py	Uses new RemoteClient instead of gradio_client.Client for remote logging initialization.
trackio/remote_client.py	Adds transport negotiation + HTTP API client with a Gradio-compat fallback.
trackio/mcp_setup.py	Adds optional MCP integration mounted at /mcp with mutation access checks.
trackio/launch_utils.py	Adds environment checks (Colab/IPython/hosted notebooks) used for share behavior.
trackio/launch.py	Adds Uvicorn-based server launcher and Gradio-compatible tunnel sharing flow.
trackio/imports.py	Removes pandas-based CSV import and uses stdlib csv; updates TF events import missing-value checks.
trackio/frontend_server.py	Updates module docstring to reflect Trackio HTTP API (not Gradio API).
trackio/frontend/src/lib/api.js	Switches frontend API calls from /gradio_api SSE flow to direct JSON POSTs to /api/...; updates file URLs.
trackio/exceptions.py	Introduces TrackioAPIError for HTTP API error handling.
trackio/deploy.py	Updates dependency handling for Spaces installs and switches deploy-time README templating behavior.
trackio/asgi_app.py	Introduces Starlette app with /version, /api, /api/upload, and /file endpoints.
trackio/_vendor/tunneling.py	Vendors Gradio tunnel client (frpc download/verification + tunnel lifecycle).
trackio/_vendor/networking.py	Vendors Gradio networking helpers for share URL setup and liveness checks.
trackio/_vendor/gradio_exceptions.py	Vendors minimal exception types used by tunnel/networking helpers.
trackio/_vendor/init.py	Adds vendor package marker.
trackio/init.py	Updates public show() path to launch Starlette/Uvicorn dashboard and adds share/server_port parameters.
tests/unit/test_utils.py	Updates downsample tests to use row dicts instead of pandas DataFrame.
tests/unit/test_table.py	Removes pandas dependency from most tests; adds importorskip pandas compatibility test; updates URL assertions.
tests/unit/test_deploy.py	Adds tests ensuring MCP deps are included in requirements generation.
tests/e2e-spaces/test_throughput.py	Uses RemoteClient for Spaces tests.
tests/e2e-spaces/test_sync_and_freeze.py	Replaces pandas parquet read with pyarrow; uses RemoteClient; updates assertions for row dicts.
tests/e2e-spaces/test_spaces_features.py	Uses RemoteClient for Spaces tests.
tests/e2e-spaces/test_metrics_on_spaces.py	Uses RemoteClient for Spaces tests.
tests/e2e-spaces/test_data_robustness.py	Uses RemoteClient for Spaces tests.
tests/e2e-spaces/conftest.py	Uses RemoteClient fixture in Spaces E2Es.
tests/e2e-local/test_table_with_images.py	Removes pandas usage by constructing Table from rows.
tests/e2e-local/test_api.py	Adds e2e coverage for RemoteClient against local dashboard + MCP exposure.
pyproject.toml	Drops pandas and gradio; adds gradio-client, starlette, uvicorn; adds mcp optional extra.
.changeset/great-trams-double.md	Declares a minor release for the dependency/API refactor.

Comments suppressed due to low confidence (1)

trackio/server.py:385

• uploaded_db["path"] is treated as a trusted server-local filesystem path and copied directly into the project DB location. This should be constrained to files produced by the upload endpoint (e.g., a temp upload directory) and ideally removed after the copy to avoid leaking arbitrary server files and accumulating temp files.

def upload_db_to_space(project: str, uploaded_db: dict, hf_token: str | None) -> None:
    check_hf_token_has_write_access(hf_token)
    db_project_path = SQLiteStorage.get_project_db_path(project)
    os.makedirs(os.path.dirname(db_project_path), exist_ok=True)
    shutil.copy(uploaded_db["path"], db_project_path)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[abidlabs]

@copilot do another pass over the latest changes

[abidlabs]

@copilot review this PR again