Skip to content

build(deps): Bump the pip-sidecar-patch-minor group across 1 directory with 17 updates #450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): Bump the pip-sidecar-patch-minor group across 1 directory with 17 updates #450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions sidecar/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@ dependencies = [
"httpx>=0.27", # HTTP client for the llama.cpp OpenAI-compatible server (§7)
# P2 (T2, A6 lesson 5: PINNED). ⚠ human: verify current releases at install
# time. chatterbox-tts/torch must NOT be added here (isolated env asset only).
"kokoro-onnx==0.5.0", # A4: the onnx build — NEVER the torch `kokoro` package
"onnxruntime==1.28.0", # kokoro-onnx backend (or onnxruntime-gpu, same pin)
"kokoro-onnx==0.6.1", # A4: the onnx build — NEVER the torch `kokoro` package
"onnxruntime==1.29.0", # kokoro-onnx backend (or onnxruntime-gpu, same pin)
"edge-tts==7.2.8", # hosted TTS engine (network only at runtime)
# F3: PRIMARY system-RAM source for the device advisor (cross-platform), with
# an OS-stdlib fallback (Win32 GlobalMemoryStatusEx / POSIX sysconf) behind the
Expand Down Expand Up @@ -59,7 +59,7 @@ reframe-gpu = [
"safetensors==0.8.0", # verify-before-load safetensors weight reader (B4/I2)
"opencv-python-headless==4.14.0.94", # frame I/O + face-crop ops (headless: no GUI libs)
"python_speech_features==0.6", # MFCC features for the ASD audio frontend
"scipy==1.18.0", # face-track interpolation + median filter + wav read
"scipy==1.18.1", # face-track interpolation + median filter + wav read
# DIARIZE stage (VAD + ECAPA-TDNN) — the speaker turns the director fuses with
# visual ASD. Uses the ``speechbrain.inference`` API (requires >= 1.0.0). PINNED to
# 1.1.0: loads ``speechbrain/vad-crdnn-libriparty`` + ``spkrec-ecapa-voxceleb``, and
Expand All @@ -70,7 +70,7 @@ reframe-gpu = [
# bare ``revision=``). See ``pinned_fetch_kwargs``.
#
# HISTORY — this comment used to say "PINNED to 1.0.3 ... 1.1.0 is DELIBERATELY
# AVOIDED", six lines above a line that reads ``speechbrain==1.1.0``. The prose was
# AVOIDED", six lines above a line that reads ``speechbrain==1.1.1``. The prose was
# the stale half: the codebase was later adapted TO 1.1.0 (the FetchConfig probe and
# the two-shape ``pinned_fetch_kwargs``) and the note was never updated, leaving the
# file contradicting itself and three docs repeating the dead value.
Expand All @@ -84,7 +84,7 @@ reframe-gpu = [
#
# speechbrain missing at runtime still fails LOUD (typed
# ``DiarizeBackendUnavailableError``), never a silent ModuleNotFoundError.
"speechbrain==1.1.0",
"speechbrain==1.1.1",

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the SpeechBrain version documentation synchronized

When users consult the GPU setup documentation—or the repository's SSOT verifier is run—this new 1.1.1 pin conflicts with the live PINNED to 1.1.0 explanation above, docs/ROADMAP.md, and docs/WU-R1-MULTISPEAKER-ENGINE.md. Running python docs/validation/tools/verify_ssot_claims.py now reports C1b as broken because the documented and literal pins differ, so the version-coupled prose and verifier expectation should be updated with the dependency.

Useful? React with 👍 / 👎.

# speechbrain 1.0.x calls ``hf_hub_download(use_auth_token=...)``, an argument
# REMOVED in huggingface_hub 1.0. Cap below 1.0 so the diarize models actually
# fetch/load (validated at 0.36.2, the newest 0.x). huggingface_hub is otherwise a
Expand Down
28 changes: 14 additions & 14 deletions sidecar/requirements.lock.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ certifi==2026.7.22
# edge-tts
# httpcore
# httpx
click==8.4.2
click==8.5.0
# via
# huggingface-hub
# scenedetect
Expand All @@ -41,7 +41,7 @@ colorlog==6.12.0
# via kokoro-onnx
csvw==4.1.0
# via segments
ctranslate2==4.8.1
ctranslate2==4.8.2
# via faster-whisper
dlinfo==2.0.0
# via phonemizer-fork
Expand All @@ -51,7 +51,7 @@ espeakng-loader==0.2.4
# via kokoro-onnx
faster-whisper==1.2.1
# via media-studio-sidecar (sidecar/pyproject.toml)
filelock==3.32.2
filelock==3.32.5
# via huggingface-hub
flatbuffers==25.12.19
# via onnxruntime
Expand All @@ -71,26 +71,26 @@ httpx==0.28.1
# via
# media-studio-sidecar (sidecar/pyproject.toml)
# huggingface-hub
huggingface-hub==1.26.0
huggingface-hub==1.29.0
# via
# faster-whisper
# tokenizers
humanfriendly==10.0
# via coloredlogs
idna==3.18
idna==3.19
# via
# anyio
# httpx
# yarl
isodate==0.7.2
# via csvw
joblib==1.5.3
joblib==1.6.0
# via phonemizer-fork
jsonschema==4.26.0
# via csvw
jsonschema-specifications==2025.9.1
# via jsonschema
kokoro-onnx==0.5.0
kokoro-onnx==0.6.1
# via media-studio-sidecar (sidecar/pyproject.toml)
language-tags==1.3.1
# via csvw
Expand All @@ -104,14 +104,14 @@ multidict==6.7.1
# via
# aiohttp
# yarl
numpy==2.5.1
numpy==2.5.2
# via
# ctranslate2
# kokoro-onnx
# onnxruntime
# opencv-python
# scenedetect
onnxruntime==1.28.0
onnxruntime==1.29.0
# via
# media-studio-sidecar (sidecar/pyproject.toml)
# faster-whisper
Expand All @@ -124,17 +124,17 @@ packaging==26.3
# onnxruntime
phonemizer-fork==3.3.2
# via kokoro-onnx
platformdirs==4.11.0
platformdirs==4.11.7
# via scenedetect
propcache==0.5.2
# via
# aiohttp
# yarl
protobuf==7.35.1
protobuf==7.36.1
# via onnxruntime
psutil==7.2.2
# via media-studio-sidecar (F3 — primary system-RAM source)
pygments==2.20.0
pygments==2.21.0
# via rich
pyparsing==3.3.2
# via rdflib
Expand All @@ -152,7 +152,7 @@ referencing==0.37.0
# via
# jsonschema
# jsonschema-specifications
regex==2026.7.19
regex==2026.9.3
# via segments
rfc3986==1.5.0
# via csvw
Expand Down Expand Up @@ -187,7 +187,7 @@ tqdm==4.70.0
# faster-whisper
# huggingface-hub
# scenedetect
typer==0.27.1
typer==0.27.2
# via huggingface-hub
typing-extensions==4.16.0
# via
Expand Down
14 changes: 7 additions & 7 deletions sidecar/runtime_setup/requirements-sidecar.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,29 +22,29 @@
# lock is validated by media_studio.assets.manager.validate_hashed_lock first.

faster-whisper==1.2.1
ctranslate2==4.8.1
ctranslate2==4.8.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the exact-pin guards with the runtime bumps

When the default sidecar test suite runs, TestShippedRequirementFiles.test_sidecar_file_parses_with_expected_pins still asserts ctranslate2 == 4.8.1 (and separately nvidia-cudnn-cu12 == 9.24.0.43), so changing this manifest to 4.8.2/9.25.1.1 makes the blocking pytest gate fail. That test explicitly treats updating its expected values as the required human-review step, so the assertions and validation notes need to move with these pins.

Useful? React with 👍 / 👎.

scenedetect==0.7.1
opencv-python==4.14.0.94
httpx==0.28.1
numpy==2.5.1
numpy==2.5.2

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Re-provision legacy installs before recording the new pins

For a user upgrading from a release whose completed installation predates .first-run-requirements.json, these changed runtime pins are never installed: fingerprintInSync(null, shippedFp) deliberately returns true, classifyFirstRun therefore selects none, and main.ts backfills the current fingerprint without running bootstrap. The old environment is then permanently recorded as matching this manifest, so future launches cannot detect that it still contains the pre-update numpy, onnxruntime, Kokoro, and related packages; this dependency-changing release needs a migration signal that distinguishes a genuinely current legacy environment from one requiring re-provisioning.

Useful? React with 👍 / 👎.

av==17.1.0
onnxruntime==1.28.0
huggingface_hub==1.26.0
onnxruntime==1.29.0

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Make re-bootstrap replace the previously installed packages

For an existing packaged installation upgraded to this build, the requirements fingerprint correctly triggers a re-bootstrap, but runtime_setup.bootstrap.build_pip_steps runs pip install --target <existing-env> without --upgrade or first clearing the target. The inspected pip install --help states that --target “by default ... will not replace existing files/folders” and requires --upgrade to replace them, so the run can leave old versions such as onnxruntime 1.28.0 in place and then write the new sentinel/fingerprint as though 1.29.0 were installed, preventing another retry.

Useful? React with 👍 / 👎.

huggingface_hub==1.29.0
tokenizers==0.23.1

# TTS (kokoro default engine — the onnx build, NEVER the torch pip package; A4)
# CONTRACT-NOTE: kokoro-onnx is not in the dev venv yet (T2 lane); 0.4.9 is the
# pinned choice per the T5 brief ("latest pinned by exact version you choose").
kokoro-onnx==0.5.0
kokoro-onnx==0.6.1

# CUDA runtime wheels for ctranslate2/onnxruntime GPU paths (pins = dev venv)
nvidia-cublas-cu12==12.9.2.10
nvidia-cudnn-cu12==9.24.0.43
nvidia-cudnn-cu12==9.25.1.1

# DELIBERATELY NOT HERE: mediapipe. The claudeshorts reframe engine's optional
# MediaPipe backend uses the LEGACY Solutions API (`mp.solutions.face_detection`),
# which only exists in mediapipe <=0.10.21 — and those wheels declare `numpy<2`,
# a hard conflict with the `numpy==2.5.1` above (required by ctranslate2 / av /
# a hard conflict with the `numpy==2.5.2` above (required by ctranslate2 / av /
# onnxruntime / kokoro-onnx). mediapipe >=0.10.31 (numpy-2 clean) REMOVED the
# Solutions API entirely, so pinning it would install a mediapipe whose
# `mp.solutions` is missing -> the backend crashes at job time -> a SILENT drop
Expand Down
Loading