[darksim33]

Summary

requirements.txt is now a fully pinned (==), hash-verified lock file compiled from the pyproject.toml. The version ranges (what the project supports) live in pyproject.toml; the exact versions and hashes (what was tested) live in requirements.txt. Added ranges where a break is plausible or already enforced by a dependency: numpy>=2,<3 (nlopt requires numpy 2.x), scipy>=1.13 (cvxpy), torch>=2.2,<3, torchio>=1.2,<2, dipy>=1.12.1,<2, pandas>=2.2,<4. Added a preproc extra (nipype, itk, pyyaml), which the preprocessing code imports, and included it in all.

requirements.txt is generated from pyproject.toml with:

uv pip compile pyproject.toml --extra all --universal --python-version 3.11 --generate-hashes -o requirements.txt

• --extra all covers the runtime dependencies plus the test, docs, plot and preproc extras.
• --generate-hashes pins every package (direct and transitive) with sha256 hashes. Installing with pip enables hash checking automatically.
• --universal resolves for all platforms in one pass. Platform-specific packages carry environment markers, e.g. colorama and win32-setctime are sys_platform == 'win32', and the nvidia-*/triton CUDA stack is sys_platform == 'linux'.
• --python-version 3.11 matches the requires-python = ">=3.11" floor in pyproject.toml.

Installing necessary packages like before:

pip install -r requirements.txt

CI changes (.github/workflows/unit_test.yml)

• build (unchanged matrix): installs from pyproject.toml, so it tests the version ranges.
• lock (new, Ubuntu + Python 3.11): installs from requirements.txt and runs the same tests, to check the pinned, hash-locked file installs and passes.

Downsides

• requirements.txt only resolves Python 3.11
  • for all other python versions pip install . from pyproject.toml
• 'torch' package pulls full CUDA stack regardless of an available Nvidia GPU
• hash pinning is really strickt and can lead to failed installs when packages arent available or matching
• changing the dependencies in pyproject.toml forces a re-compilation of the requirements.txt

[IvanARashid]

Looks good to me, thanks!