# Training dependencies. Deliberately separate from the library's, and nothing here is a
# runtime dependency: pyproject.toml packages src/flowx_border only, so none of this
# reaches a wheel.
#
# torch is absent on purpose. The Deep Learning VM image carries it already, built
# against that image's driver, and installing a different one over the top is how a run
# gets an hour in and then cannot see the GPU.
#
# transformers floor is 5.10, not 4.49: CVE-2026-9856 (GHSA-xrqw-3rrv-vx5w), a path
# traversal in save_pretrained() via an attacker-crafted chat_template dict, fixed
# only at 5.10. The old <5 ceiling made every version this ever installed
# vulnerable. train.py's TrainingArguments(warmup_steps=...) already accounts for
# the one breaking change this bump crosses: warmup_ratio was removed as its own
# field, folded into warmup_steps, which now treats a value below 1 as a ratio.
transformers>=5.10,<6
peft>=0.14,<1
accelerate>=1.4,<2
datasets>=3.3,<4
pyyaml>=6.0
onnx>=1.17
onnxruntime>=1.20
# torch 2.9's default ONNX exporter imports it even when dynamo=False is requested.
onnxscript>=0.1
