requirements.txt

# Video Subtitle Remover Pro - Dependencies
# ==========================================
# Install through setup.py, or constrain a manual install with one of the
# generated dependency_profiles/{cpu,nvidia,directml}.txt files. Edit
# dependency_profiles.json and run `python -m backend.dependency_profiles
# update` when intentionally changing reviewed versions.

# Core
# opencv-python >= 5.0.0.93 patches CVE-2025-53644 and bundles libpng 1.6.57,
# above the 1.6.54 floor for CVE-2026-22801. It also enables PP-OCRv6 and LaMa
# ONNX execution through cv2.dnn without ONNX Runtime.
# Pillow >= 12.3.0 patches CVE-2026-55798 command injection,
# CVE-2026-54059/54060/55379/55380 decompression bombs, and multiple
# image-operation out-of-bounds reads/writes fixed by the 2026-07-01 release.
#
# OpenCV 5 enables the built-in cv2.dnn PP-OCRv6 and LaMa backends, which
# need only OpenCV + numpy plus RapidOCR's pure-Python processing/model assets (no
# onnxruntime, no torch). Download the model from
# https://huggingface.co/opencv/inpainting_lama and set
# VSR_OPENCV_LAMA=path/to/inpainting_lama_2025jan.onnx, or place it in
# %APPDATA%/VideoSubtitleRemoverPro/models/ for auto-discovery. The
# 4.x floor is kept for users who have not upgraded yet.
numpy>=1.21.0
opencv-python>=5.0.0.93
Pillow>=12.3.0
# idna 3.15 fixes CVE-2026-45409/PYSEC-2026-215 resource exhaustion in
# alternate per-label and codec APIs; requests and Hugging Face use it.
idna>=3.15

# AI/ML Frameworks (choose based on your GPU)
# ------------------------------------------
# IMPORTANT: torch >= 2.10.0 is required.
# CVE-2026-24747 / CVE-2025-32434: torch.load weights_only RCE in PyTorch
# 2.9.1 and earlier. simple-lama-inpainting loads weights via torch.load,
# so this is a runtime concern, not just a transitive-dependency one.

# Python compatibility: VSR requires Python 3.11+. PyTorch publishes Windows
# CUDA wheels through Python 3.13. Python 3.14 currently resolves CPU-only torch;
# setup.py blocks that NVIDIA path unless VSR_ALLOW_PY314_CPU=1 is set.

# ONNX Runtime >= 1.26.0 is required for CPU/CUDA. Older builds predate
# OOB/overflow hardening in 1.26.0 (unrestricted setattr allowlist,
# MaxPoolGrad indices bounds, sparse tensor conversion checks) and parser
# integer-truncation fixes from 1.25.0. VSR runs untrusted OCR/inpaint
# ONNX models through this runtime. The self-test and strict release
# validation flag onnxruntime / -gpu below 1.26.0. DirectML is a separate
# sustained-engineering line, pinned below to its latest PyPI build.
#
# For NVIDIA RTX 20/30/40-series (Turing/Ampere/Ada):
# pip install torch>=2.10.0 torchvision>=0.25.0 --index-url https://download.pytorch.org/whl/cu128
# pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu118/
# pip install onnxruntime-gpu>=1.26.0

# For NVIDIA RTX 50-series (Blackwell, sm_120 -- e.g. RTX 5070/5080/5090):
# Blackwell needs CUDA 12.8 wheels. The cu118/cu121 builds have no Blackwell
# kernels and do not carry the current torch security floor.
# pip install torch>=2.10.0 torchvision>=0.25.0 --index-url https://download.pytorch.org/whl/cu128
# pip install paddlepaddle-gpu==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cu126/
# pip install onnxruntime-gpu>=1.26.0
# (Run_VSR_Pro.bat / setup.py use cu128 for NVIDIA PyTorch wheels.)
# CUDA 13 ONNX Runtime wheels are currently a nightly/custom-channel path,
# not the stable PyPI default.

# For AMD/Intel (DirectML via ONNX Runtime):
# pip install onnxruntime-directml==1.24.4
# Intel CPU/iGPU users can add OpenVINO for RapidOCR:
# pip install openvino>=2025.0.0
# pip install torch>=2.10.0 torchvision>=0.25.0 --index-url https://download.pytorch.org/whl/cpu
# pip install paddlepaddle==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cpu/

# For CPU only:
# pip install torch>=2.10.0 torchvision>=0.25.0 --index-url https://download.pytorch.org/whl/cpu
# pip install paddlepaddle==3.0.0 -i https://www.paddlepaddle.org.cn/packages/stable/cpu/

# Text Detection (install at least one, listed in priority order)
# OCR engines are capped to their tested major versions; numpy/opencv stay
# uncapped because the OpenCV 5 DNN path is the documented upgrade route.
# RapidOCR runs PP-OCR via ONNX Runtime by default, can use OpenVINO when
# openvino is installed on CPU/Intel systems, and stays free of the upstream
# paddlepaddle memory-leak issues.
rapidocr>=2.0.0,<4.0.0
# Optional fallback engines are intentionally not part of the default resolver:
# PaddleOCR installs opencv-contrib-python and EasyOCR installs
# opencv-python-headless, both of which compete with the GUI runtime's single
# opencv-python cv2 owner. Their reviewed versions remain in the generated
# dependency profiles for explicit, isolated installs.
# paddleocr>=3.0.0,<4.0.0
# surya-ocr>=0.9.0  # Optional: fast layout-aware detection (GPL -- see license)
# easyocr>=1.7.0

# Real AI Inpainting (LAMA mode)
# simple-lama-inpainting is now an optional fallback dependency. The
# preferred backends (ONNX Runtime or OpenCV 5 DNN) avoid the torch.load
# CVE surface entirely. Install simple-lama-inpainting only if neither
# onnxruntime nor opencv-python >= 5.0 is available. Its NumPy <2 requirement
# is incompatible with the reviewed OpenCV 5 / NumPy 2 runtime, so install
# it only in an isolated legacy environment.
# simple-lama-inpainting>=0.1.0

# GUI Enhancement (optional)
# tkinterdnd2>=0.3.0  # For native drag-drop support