Merge pull request #14 from fairdataihub/dependency-lock

chore: 📌 add pinned dependency lockfile

Author: slugb0t

Dockerfile

@@ -33,12 +33,15 @@ RUN ln -sf /usr/bin/python3.10 /usr/bin/python
 # Set working directory
 WORKDIR /app
 
-# Copy requirements and install Python dependencies
+# Install the exact, pinned dependency set for reproducible builds.
+# Regenerate requirements-lock.txt from the running container when bumping deps.
 # IMPORTANT: rebuild with `docker build --no-cache` when poster2json has a new release
-COPY requirements-prod.txt requirements.txt
+COPY requirements-lock.txt .
 RUN pip3 install --upgrade pip && \
-    pip3 install --no-cache-dir -r requirements.txt
+    pip3 install --no-cache-dir -r requirements-lock.txt
 
+# Layer the newest poster2json on top of the pinned base (kept intentionally latest).
+# pip's default only-if-needed strategy leaves the rest of the stack at locked versions.
 RUN pip3 install --no-cache-dir --upgrade poster2json
 
 # Copy application code (poster extraction logic comes from poster2json library)

requirements-lock.txt

@@ -0,0 +1,115 @@
+# Pinned dependency snapshot — ALL direct and transitive dependencies.
+#
+# Source of truth: `pip freeze` from the known-good production container
+# (poster-extraction image built 2026-07-26, Python 3.10.12), captured after a
+# real extraction job completed successfully. Every package below is pinned to
+# an exact version so builds are reproducible.
+#
+# Why this exists:
+#   requirements-prod.txt uses open ranges (>=) and the Dockerfile installs the
+#   latest poster2json, so every `--no-cache` build could resolve a different
+#   dependency tree. That is exactly what caused the July outage: an unpinned
+#   rebuild pulled a newer bitsandbytes/transformers that routes the quantized
+#   model through Triton, which JIT-compiles a cuda_utils helper and needs
+#   Python.h — a header the image was silently missing. This lockfile removes
+#   that class of surprise by freezing the whole tree to a verified-good set.
+#
+# To regenerate after an intentional dependency bump (from the running container):
+#   docker exec poster-extraction pip3 freeze | sort -f > requirements-lock.txt
+#
+# The Dockerfile installs the runtime environment from this file; the newest
+# poster2json is then layered on top (kept intentionally latest).
+
+absl-py==2.5.0
+accelerate==1.14.0
+annotated-doc==0.0.4
+anyio==4.14.2
+art==6.5
+attrs==26.1.0
+av==17.1.0
+bitsandbytes==0.50.0
+blinker==1.9.0
+certifi==2026.7.22
+cffi==2.1.0
+charset-normalizer==3.4.9
+click==8.4.2
+cryptography==49.0.0
+cuda-bindings==13.3.1
+cuda-pathfinder==1.6.0
+cuda-toolkit==13.0.3.0
+defusedxml==0.7.1
+exceptiongroup==1.3.1
+filelock==3.32.0
+Flask==3.1.3
+flask-cors==6.0.5
+fsspec==2026.6.0
+h11==0.16.0
+hf-xet==1.5.2
+httpcore==1.0.9
+httpx==0.28.1
+huggingface_hub==1.24.0
+idna==3.18
+itsdangerous==2.2.0
+Jinja2==3.1.6
+joblib==1.5.3
+json_repair==0.61.7
+jsonschema==4.26.0
+jsonschema-specifications==2025.9.1
+lingua-language-detector==2.1.1
+markdown-it-py==4.2.0
+MarkupSafe==3.0.3
+mdurl==0.1.2
+mpmath==1.3.0
+networkx==3.4.2
+nltk==3.10.0
+numpy==2.2.6
+nvidia-cublas==13.1.1.3
+nvidia-cuda-cupti==13.0.85
+nvidia-cuda-nvrtc==13.0.88
+nvidia-cuda-runtime==13.0.96
+nvidia-cudnn-cu13==9.20.0.48
+nvidia-cufft==12.0.0.61
+nvidia-cufile==1.15.1.6
+nvidia-curand==10.4.0.35
+nvidia-cusolver==12.0.4.66
+nvidia-cusparse==12.6.3.3
+nvidia-cusparselt-cu13==0.8.1
+nvidia-nccl-cu13==2.29.7
+nvidia-nvjitlink==13.3.33
+nvidia-nvshmem-cu13==3.4.5
+nvidia-nvtx==13.0.85
+packaging==26.2
+pdfminer.six==20260107
+pdfplumber==0.11.10
+pillow==12.3.0
+poster2json==0.9.23
+psutil==7.2.2
+psycopg2-binary==2.9.12
+pycparser==3.0
+Pygments==2.20.0
+pymupdf==1.28.0
+pypdfium2==5.12.1
+python-dotenv==1.2.2
+PyYAML==6.0.3
+qwen-vl-utils==0.0.14
+referencing==0.37.0
+regex==2026.7.19
+requests==2.34.2
+rich==15.0.0
+rouge_score==0.1.2
+rpds-py==0.30.0
+safetensors==0.8.0
+sentencepiece==0.2.2
+shellingham==1.5.4
+six==1.17.0
+sympy==1.14.0
+tokenizers==0.22.2
+torch==2.13.0
+torchvision==0.28.0
+tqdm==4.69.1
+transformers==5.14.1
+triton==3.7.1
+typer==0.27.0
+typing_extensions==4.16.0
+urllib3==2.7.0
+Werkzeug==3.1.8

requirements.txt

@@ -2,41 +2,41 @@
 poster2json
 
 # Core dependencies (required by poster2json, included for explicit pinning)
-transformers>=4.40.0
-torch>=2.0.0
-torchvision>=0.15.0
-accelerate>=0.20.0
-bitsandbytes>=0.41.0
-safetensors
-sentencepiece
+transformers==5.14.1
+torch==2.13.0
+torchvision==0.28.0
+accelerate==1.14.0
+bitsandbytes==0.50.0
+safetensors==0.8.0
+sentencepiece==0.2.2
 
 # Flash Attention 2 for faster inference (optional but recommended)
 # Requires CUDA 11.6+ and compatible GPU (Ampere, Ada Lovelace, Hopper)
 # Install with: pip install flash-attn --no-build-isolation
 flash-attn>=2.5.0; platform_system == "Linux"
 
 # Text processing
-rouge-score
-numpy
+rouge-score==0.1.2
+numpy==2.2.6
 
 # Image/PDF processing
-Pillow
-pymupdf
+Pillow==12.3.0
+pymupdf==1.28.0
 
 # API
-python-dotenv>=1.0.0
-flask>=2.3.0
-flask-cors>=4.0.0
-requests>=2.31.0
-jsonschema>=4.20.0
-psycopg2-binary>=2.9.0
+python-dotenv==1.2.2
+flask==3.1.3
+flask-cors==6.0.5
+requests==2.34.2
+jsonschema==4.26.0
+psycopg2-binary==2.9.12
 
 # ipynb dependencies (for testing and development)
 ipykernel
 jupyterlab
 
 # Development (optional)
-tqdm
+tqdm==4.69.1
 # black
 # isort
 # flake8