Repository navigation
fix(deps): qualify Pillow 13 with headless Qwen inference packaging - #252
Merged
Merged
Conversation
This was referenced Oct 21, 2026
Lucas1479
marked this pull request as ready for review
October 21, 2026 13:32
Lucas1479
added a commit
that referenced
this pull request
Oct 21, 2026
#249) Cold Linux Voice builds wrote Meson/setuptools output into the vendored source and could mix regenerated SWIG wrappers with older packaged Python proxies. Git updates can preserve those local binding changes. Run setuptools hooks inside a disposable source copy, excluding prior build/install artifacts. Compile the committed wrapper/proxies after checking all three version headers before native work. Decode SWIG's decimal digit pairs correctly, including multi-digit version components, and fail with backup/restore guidance on mismatched or unreadable inputs. No user files are restored or deleted automatically. Preserve the Linux-only source selector and actual bundled Abseil 20240722.0 verification. The qualifier requires Python 3.12 and uses the running interpreter for the locked install, both distribution builds, and an isolated wheel environment. Remove inherited RUST_LOG only from child environments so uv's verbose build evidence remains available. Linux CI deliberately sets RUST_LOG=warn while checking cold builds, source cleanliness, sdist/wheel contents, and the installed public native API. Provenance and upgrade documentation include the complete verified upstream patch and legacy-checkout cleanup steps. Refs #247. The reporter completed the original Arch/system-Abseil-20260817 acceptance at `94b584c`, including an independent clean-source/cache/environment retest: #247 (comment). The remaining log-filter issue from that report is addressed here. The maintainer will close #247 after merge. Validation: - 207 combined AEC/profile/release, Electron smoke/launcher and Qwen packaging tests passed in a dedicated Python 3.12.10 environment after integrating main through #252. Four regression cases failed before the decimal-version/log-environment corrections and pass afterward; missing-evidence rejection remains enforced. - The previously added dirty-upgrade regression fails before the binding guard and passes after it. A real PEP 517 negative build also confirms that rejection occurs before native work without modifying source inputs. - The complete patch reproduces the modifications from the SHA256-verified official PyPI archive. Generated bindings are unchanged. Ruff, provenance and diff checks passed. - On integrated head `dca7904c`, all 16 checks across all six applicable workflows passed. The environment verifier reports all 110 core/dev packages compatible, and the existing-rule pip-audit reports no known vulnerabilities (the two existing ignored advisory aliases are unchanged). - [Linux Voice CI](https://github.com/Code-Amadeus/Amadeus/actions/runs/39613193275/job/119267202410) passed the cold-build qualifier with inherited `RUST_LOG=warn`, two actual bundled-Abseil 20240722.0 confirmations, standalone wheel/native smoke, source cleanliness, and 242 contract tests. Linux/macOS Electron smoke each passed all 15 checks; Windows source and packaged smoke both passed with Startup mode saving verified. Windows full suites, the installation matrix, and source release passed. The reporter's Arch evidence remains specifically attributed to `94b584c`; this is not a claim of audio-device or acoustic-quality testing. The independent dependency update #252 is merged into main and incorporated here. These results are for the integrated head `dca7904c` against main `1d9e88df`, rather than checks from an earlier revision. No runtime dependency upgrade or Windows/macOS registry-source change. SWIG's version encoding is documented at https://www.swig.org/Doc4.4/Preprocessor.html.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem and resulting behavior
The dependency audit rejects Pillow 12.3.0 and certifi 2026.7.22. Gradio caps Pillow below 13, and Qwen-ASR 0.0.6 declares that demo UI dependency for inference installs too.
Use Pillow 13.0.0 and certifi 2026.10.19. Move Gradio to Qwen's optional demo extra and defer Gradio/pandas imports in the inherited UI helpers. Loading local TTS through the shared audio decoder no longer imports that UI stack. This is a qualitative import-boundary improvement; no end-to-end startup or memory reduction is claimed.
There is no resolver override, Gradio downgrade, new audit exception or inference implementation change. This is the dependency prerequisite for #249 and #250; no dictionary resource or Pi behavior is changed.
Review follow-up
F1: restore all three package initializers to the official 0.0.6 sdist bytes and use the repository's existing Ruff exclusion convention for vendored sources. Tests compare upstream hashes directly; no regex reversal or bytecode equivalence remains.
F2: make the changes inside Qwen's packaging metadata:
setuptools==83.0.0,wheel==0.47.0, withsetuptools.build_meta.license = "Apache-2.0"andlicense-files = ["LICENSE"].demo = ["gradio>=6.16.0,<7"]separation and all other upstream fields.These are package-local build requirements, so AEC and other source packages do not receive a global uv build constraint. The lock check passes without changing the already qualified runtime resolution. The old license table's announced date is not described as an unconditional failure deadline; enforcement depends on the backend and
SETUPTOOLS_ENFORCE_DEPRECATION.Source and distribution integrity
Official sdist SHA-256:
294893f2340dc2d58d1f1d1cb8ce26ac0a79f254805ab432dda2892bd5c8d13c.All inference/model/CLI implementation and dictionary-resource bytes match upstream. Preserve its original license, headers, README and source inventory. The original
pyproject.tomlis also retained and hash-checked; a complete parsed comparison permits only the three packaging changes above. The modified packaging file carries an Amadeus change notice, and the provenance records describe the exact scope and removal condition.The distribution test invokes uv's normal isolated PEP 517 frontend: build an sdist, then build its wheel. It verifies all package members and bytes, the dictionary resource, backend version, all dependencies/extras and entry points, SPDX metadata and license files. It does not invoke a backend from the development environment.
Validation on updated main
Integrated main
37c46977325e624cbee4f452ef01639abf6a268e(#248) locally with the review fixes before pushing.Reproduce the packaging checks with:
For a cold build, copy
vendor/qwen-asrinto a disposable source directory, then run:All 18 applicable checks passed on final head
04112fc9406a575c8c411cb5ec612af615e07990, based on current main37c46977325e624cbee4f452ef01639abf6a268e: all Windows suites/smoke, Linux/macOS, local-model installation matrices, source checks and dependency audit. The new three-test packaging suite ran and passed in Windows CI. No CI retries or new audit exceptions were used. These are fresh results, not the previous head's 18 checks. Hosted install/import checks do not establish GPU acoustic/model-quality qualification.Qwen demo scripts still require a separate compatible demo environment. The temporary source is removed when upstream separates the UI dependency or a supported Gradio release accepts the patched Pillow and the Host's other constraints. See
vendor/qwen-asr.PROVENANCE.md.Merge scope
The final head includes latest main, all applicable checks passed, and the review follow-ups are resolved. Squash merge is authorized; the dependency branch is retained. This authorizes neither #250 merge nor any dictionary/resource publication.