# Pip-only extras layered into the NGC TensorFlow 25.02 base image
# (nvcr.io/nvidia/tensorflow:25.02-tf2-py3 already ships with numpy, scipy,
# scikit-learn, matplotlib, pandas, h5py, psutil, pytest, tensorflow 2.17, and
# tf_keras 2.17 -- so tf_keras is omitted here; pyproject.toml / environment.yml declare it
# for the base-less pip/conda paths that back legacy-Keras mode, #323).
# Version ranges should be kept in lockstep with conda environment that targets the
# Ampere cluster (see environment.yml)

# Foundational deps -- already present in the NGC base; pinning here prevents
# transitive bumps from upgrading them past TF 2.17's supported range.
numpy>=1.26,<2.0
scipy>=1.13,<1.14
scikit-learn>=1.5,<1.6
matplotlib>=3.9,<3.10

# Aetherscan extras layered on top.
astropy>=6.1,<7
# 0.26 needs Python >=3.11; 0.25.2 is the newest line supporting 3.10 (sole use:
# downscale_local_mean).
scikit-image>=0.25.2,<0.26
# Minor-bounded to the proven-in-use lines per SECURITY.md (was major-bounded, which
# floated to whatever minor was newest at install time).
joblib>=1.5,<1.6
imageio>=2.37,<2.38
umap-learn>=0.5.6,<0.6
# 0.50 needs Python >=3.11 AND numpy >=2; 0.49.x is upstream's last 3.10 line. We call
# only stock TreeExplainer (never approximate= or the legacy bar plot), so the 0.47
# deprecations don't apply.
shap>=0.49.1,<0.50
slack-sdk>=3.43,<3.44
# Floor >=1.2.2 per GHSA-mf9w-mj56-hr94 (CVE-2026-28684, set_key symlink following;
# fixed in 1.2.2).
python-dotenv>=1.2.2,<2
# Model weight distribution via the HuggingFace Hub (upload after training, download for
# inference). 1.25 per SECURITY.md's version policy: two minors below the latest stable
# (1.27) at pin time. hf_hub.py never passes allow_patterns/ignore_patterns, so the
# 1.25.0 case-sensitivity change is moot; 1.23.0 fixed a 1.22 CLI enum regression.
huggingface_hub>=1.25.1,<1.26
# setuptools provides pkg_resources, which blimpy (transitive via setigen)
# imports at module load. Recent pip / Python releases dropped setuptools
# from the bootstrap, so we install it explicitly. Upper-bound at <81 because
# setuptools 81 removed pkg_resources as a vendored submodule -- revisit
# once blimpy migrates off pkg_resources (upstream issue). Floor >=78.1.1 per
# GHSA-5rjg-fvgr-3xxf (CVE-2025-47273, path traversal; fixed in 78.1.1).
setuptools>=78.1.1,<81
# Minor-bounded to the proven 2.7 line per SECURITY.md; keep in lockstep with
# environment.yml and pyproject.toml.
setigen>=2.7,<2.8
# Live monitoring dashboard (aetherscan/dashboard.py, auto-launched by main.py). The
# streamlit floor stays above the GHSA-7p48-42j8-8846 (SSRF, <1.54.0) and
# GHSA-vqwp-45wm-r9r5 (cache hash collision, <1.53.1) fixes; 1.59.2 per the 2026-W33 check —
# constraints still hold (protobuf>=3.20,<8, numpy>=1.23, pandas<4, py>=3.10; pyarrow/
# tornado/altair pulled transitively), and the use_container_width deprecation (removed
# after 2025-12-31) is migrated in dashboard.py (width="stretch"). plotly is pure-Python
# (no numpy ABI coupling). pandas is already shipped by the NGC base, so not repinned here.
streamlit>=1.59.2,<1.60
# 6.x removals (transforms API, pointcloud/heatmapgl, mapbox->MapLibre) don't touch
# dashboard.py, which uses only plotly.express + graph_objects.
plotly>=6.7,<6.8
