Further constrain dependency versions in setup.py and requirements.txt

release/setup.py

@@ -49,7 +49,10 @@ def finalize_options(self):
     "cirq-core==1.3.0",
     "cirq-google==1.3.0",
     "sympy==1.14",
+    "numpy<2.0",
     "tf-keras~=2.16.0",
+    "scipy<=1.12.0",
+    "contourpy<=1.3.2",
     # The following makes it easier to get the right version on Colab. Once
     # TFQ works with the latest version of TF, this may become unnecessary.
     "protobuf==4.25.8",

requirements-pins.txt

@@ -0,0 +1,12 @@
+# Summary: requirements constraints for TensorFlow Quantum.
+#
+# This file is used to constrain the versions of transitive dependencies during
+# the 'pip-compile' process. This is the recommended way to apply security
+# patches without polluting requirements.in.
+#
+# This file currently requires manual updates when necessary, such as when
+# Dependabot opens PRs to update a transitive dependency in requirements.txt.
+
+fonttools>=4.60.2
+urllib3>=2.6.0
+werkzeug>=3.1.4

requirements.in

@@ -18,6 +18,11 @@
 # scripts/generate_requirements.sh.
 cirq-core~=1.3.0
 cirq-google~=1.3.0
+# Contourpy 1.3.3 requires Python >= 3.11, so we need to limit to 1.3.2.
+contourpy<=1.3.2
+numpy<2.0
+# SciPy 1.13 allows for NumPy 2.x, which leads to conflicts at install time.
+scipy<=1.12.0
 tensorflow>=2.16,<2.17
 tf-keras~=2.16.0
 

requirements.txt

@@ -2,9 +2,8 @@
 # This file is autogenerated by pip-compile with Python 3.11
 # by the following command:
 #
-#    pip-compile --allow-unsafe --no-strip-extras
+#    ./scripts/generate_requirements.sh
 #
-
 absl-py==2.1.0
     # via
     #   keras
@@ -34,7 +33,9 @@ cirq-core==1.3.0
 cirq-google==1.3.0
     # via -r requirements.in
 contourpy==1.3.2
-    # via matplotlib
+    # via
+    #   -r requirements.in
+    #   matplotlib
 cycler==0.12.1
     # via matplotlib
 dill==0.4.0
@@ -43,8 +44,10 @@ duet==0.2.9
     # via cirq-core
 flatbuffers==25.9.23
     # via tensorflow
-fonttools==4.60.1
-    # via matplotlib
+fonttools==4.61.1
+    # via
+    #   -c requirements-pins.txt
+    #   matplotlib
 gast==0.6.0
     # via tensorflow
 google-api-core[grpc]==2.28.1
@@ -128,6 +131,7 @@ networkx==3.4.2
     # via cirq-core
 numpy==1.26.4
     # via
+    #   -r requirements.in
     #   cirq-core
     #   contourpy
     #   h5py
@@ -209,8 +213,10 @@ rpds-py==0.29.0
     #   referencing
 rsa==4.9.1
     # via google-auth
-scipy==1.15.3
-    # via cirq-core
+scipy==1.12.0
+    # via
+    #   -r requirements.in
+    #   cirq-core
 six==1.17.0
     # via
     #   astunparse
@@ -258,10 +264,14 @@ typing-extensions==4.15.0
     #   tensorflow
 tzdata==2025.2
     # via pandas
-urllib3==2.5.0
-    # via requests
-werkzeug==3.1.3
-    # via tensorboard
+urllib3==2.6.2
+    # via
+    #   -c requirements-pins.txt
+    #   requests
+werkzeug==3.1.4
+    # via
+    #   -c requirements-pins.txt
+    #   tensorboard
 wheel==0.45.1
     # via astunparse
 wrapt==1.17.3

scripts/generate_requirements.sh

@@ -15,28 +15,50 @@
 # ==============================================================================
 
 # Summary: produce requirements.txt using pip-compile & munging the result.
-# Usage: ./generate_requirements.sh
+# Usage: ./scripts/generate_requirements.sh from the top dir of the repo.
 
 set -eu
 
 # Find the top of the local TFQ git tree. Do it early in case this fails.
-thisdir=$(CDPATH="" cd -- "$(dirname -- "$0")" && pwd -P)
+thisdir=$(CDPATH="" cd -- "$(dirname -- "${0}")" && pwd -P)
 repo_dir=$(git -C "${thisdir}" rev-parse --show-toplevel 2>/dev/null || \
   echo "${thisdir}/..")
 
+# Ensure we have pip-compile.
+if ! pip show -qq pip-tools; then
+    echo "Python pip-tools not found. Please run 'pip install pip-tools'."
+    exit 1
+fi
+
+declare -a constraint=()
+pins_file="$(realpath --relative-to=. "${repo_dir}/requirements-pins.txt")"
+if [[ -e "${pins_file}" ]]; then
+    constraint+=(--constraint "${pins_file}")
+fi
+
+# Tell pip-compile to reference this script in the requirements.txt comments.
+export CUSTOM_COMPILE_COMMAND="${0}"
+
 echo "Running pip-compile in ${repo_dir} …"
-pip-compile -q --no-strip-extras --allow-unsafe
+pip-compile -q \
+    --rebuild \
+    --allow-unsafe \
+    --no-strip-extras \
+    --no-emit-index-url \
+     "${constraint[@]}"
 
 declare -a inplace_edit=(-i)
 if [[ "$(uname -s)" == "Darwin" ]]; then
   # macOS uses BSD sed, which requires a suffix for -i.
   inplace_edit+=('')
 fi
 
+# Pyyaml is a transitive dependency, and pinning the version (as pip-compile
+# does) leads to unsatisfiable constraints on some platforms. However, we don't
+# need pyyaml to be a particular version. Unfortnately, there's no easy way to
+# tell pip-compile not to constrain a particular package, so we do this:
 echo "Adjusting output of pip-compile …"
 sed "${inplace_edit[@]}" \
-  -e '/^--index-url/d' \
-  -e '/^--extra-index-url/d' \
   -e 's/^pyyaml==.*/pyyaml/' \
   requirements.txt