# Pip-only extras layered into the NGC TensorFlow 25.02 base image
# (nvcr.io/nvidia/tensorflow:25.02-tf2-py3 already ships with numpy, scipy,
# scikit-learn, matplotlib, pandas, h5py, psutil, pytest, and tensorflow 2.17).
# Version ranges should be kept in lockstep with conda environment that targets the
# Ampere cluster (see environment.yml)

# Foundational deps -- already present in the NGC base; pinning here prevents
# transitive bumps from upgrading them past TF 2.17's supported range.
numpy>=1.26,<2.0
scipy>=1.13,<1.14
scikit-learn>=1.5,<1.6
matplotlib>=3.9,<3.10

# Aetherscan extras layered on top.
astropy>=6.1,<7
scikit-image>=0.24,<0.25
joblib>=1.4,<2
imageio>=2.34,<3
umap-learn>=0.5.6,<0.6
shap>=0.46.0,<0.47
slack-sdk>=3.31.0,<4
# Floor >=1.2.2 per GHSA-mf9w-mj56-hr94 (CVE-2026-28684, set_key symlink following;
# fixed in 1.2.2).
python-dotenv>=1.2.2,<2
# Model weight distribution via the HuggingFace Hub (upload after training, download for
# inference). 1.21 per SECURITY.md's version policy: two minors below the latest stable
# (1.23) at pin time, newer than the newest >=6-month-old release.
huggingface_hub>=1.21,<1.22
# setuptools provides pkg_resources, which blimpy (transitive via setigen)
# imports at module load. Recent pip / Python releases dropped setuptools
# from the bootstrap, so we install it explicitly. Upper-bound at <81 because
# setuptools 81 removed pkg_resources as a vendored submodule -- revisit
# once blimpy migrates off pkg_resources (upstream issue). Floor >=78.1.1 per
# GHSA-5rjg-fvgr-3xxf (CVE-2025-47273, path traversal; fixed in 78.1.1).
setuptools>=78.1.1,<81
# Range covers the proven 2.6/2.7 line (2.7.0 in current use) and blocks a future
# major-version break; keep in lockstep with environment.yml and pyproject.toml.
setigen>=2.6,<3
# Live monitoring dashboard (aetherscan/dashboard.py, auto-launched by main.py). streamlit 1.39
# per SECURITY.md's version policy (proven, >=6-month-old); it accepts protobuf>=3.20,<6 and
# numpy>=1.23, so it coexists with TF 2.17's protobuf 4.x pin and the numpy<2 ceiling (pyarrow
# /tornado/altair pulled transitively). plotly is pure-Python (no numpy ABI coupling). pandas
# is already shipped by the NGC base, so it is not repinned here.
streamlit>=1.39,<1.41
plotly>=5.24,<6
