# Pip-only extras layered into the NGC TensorFlow 25.02 base image
# (nvcr.io/nvidia/tensorflow:25.02-tf2-py3 already ships with numpy, scipy,
# scikit-learn, matplotlib, pandas, h5py, psutil, pytest, tensorflow 2.17, and
# tf_keras 2.17 -- so tf_keras is omitted here; pyproject.toml / environment.yml declare it
# for the base-less pip/conda paths that back legacy-Keras mode, #323).
# Version ranges should be kept in lockstep with conda environment that targets the
# Ampere cluster (see environment.yml)

# Foundational deps -- already present in the NGC base; pinning here prevents
# transitive bumps from upgrading them past TF 2.17's supported range.
numpy>=1.26,<2.0
scipy>=1.13,<1.14
scikit-learn>=1.5,<1.6
matplotlib>=3.9,<3.10

# Aetherscan extras layered on top.
astropy>=6.1,<7
scikit-image>=0.24,<0.25
joblib>=1.4,<2
imageio>=2.34,<3
umap-learn>=0.5.6,<0.6
shap>=0.46.0,<0.47
slack-sdk>=3.31.0,<4
# Floor >=1.2.2 per GHSA-mf9w-mj56-hr94 (CVE-2026-28684, set_key symlink following;
# fixed in 1.2.2).
python-dotenv>=1.2.2,<2
# Model weight distribution via the HuggingFace Hub (upload after training, download for
# inference). 1.22 per SECURITY.md's version policy: two minors below the latest stable
# (1.24) at pin time; the client-side upload/download API is unchanged from 1.21.
huggingface_hub>=1.22,<1.23
# setuptools provides pkg_resources, which blimpy (transitive via setigen)
# imports at module load. Recent pip / Python releases dropped setuptools
# from the bootstrap, so we install it explicitly. Upper-bound at <81 because
# setuptools 81 removed pkg_resources as a vendored submodule -- revisit
# once blimpy migrates off pkg_resources (upstream issue). Floor >=78.1.1 per
# GHSA-5rjg-fvgr-3xxf (CVE-2025-47273, path traversal; fixed in 78.1.1).
setuptools>=78.1.1,<81
# Range covers the proven 2.6/2.7 line (2.7.0 in current use) and blocks a future
# major-version break; keep in lockstep with environment.yml and pyproject.toml.
setigen>=2.6,<3
# Live monitoring dashboard (aetherscan/dashboard.py, auto-launched by main.py). streamlit 1.54
# fixes GHSA-7p48-42j8-8846 (SSRF, <1.54.0) and GHSA-vqwp-45wm-r9r5 (cache hash collision, <1.53.1);
# it still accepts protobuf>=3.20,<7 and numpy>=1.23, so it coexists with TF 2.17's protobuf 4.x pin
# and the numpy<2 ceiling (pyarrow/tornado/altair pulled transitively). plotly is pure-Python (no
# numpy ABI coupling). pandas is already shipped by the NGC base, so it is not repinned here.
streamlit>=1.54.0,<1.55
plotly>=5.24,<6
