build(deps): pin apache-tvm-ffi, flashlib, triton to exact versions

freetoken-kernel-cache/pyproject.toml

@@ -9,7 +9,7 @@ requires = [
     "setuptools>=77",
     "wheel",
     "torch>=2.11,<2.12",
-    "apache-tvm-ffi>=0.1.4,<0.2",
+    "apache-tvm-ffi==0.1.13.post3",
 ]
 build-backend = "build_backend"
 backend-path = ["."]
@@ -20,7 +20,7 @@ dynamic = ["version"]
 description = "Prebuilt TVM FFI kernel cache for FreeToken"
 requires-python = ">=3.10"
 license = "Apache-2.0"
-dependencies = []
+dependencies = ["apache-tvm-ffi==0.1.13.post3"]
 
 # cu130 wheels are not published to PyPI, and uv applies these to build-system.requires
 # when this directory is the build root — without them an isolated build pulls PyPI's

pyproject.toml

@@ -19,11 +19,11 @@ license-files = ["LICENSE"]
 # resolve, tight enough to bar a silent breaking bump). These ranges are the contract;
 # there is no lockfile.
 dependencies = [
-    "apache-tvm-ffi>=0.1.4,<0.2",
+    "apache-tvm-ffi==0.1.13.post3", # pin it
     "einops>=0.8,<1",
     "fastapi>=0.115,<1",
     # slot_cache: the device-side LRU admission kernel behind the MoE expert cache.
-    "flashlib>=0.3,<1",
+    "flashlib==0.3.0", # pin it
     "gguf>=0.19,<1",
     "huggingface_hub>=1.5,<2",
     "msgpack>=1.1,<2",
@@ -42,7 +42,7 @@ dependencies = [
     "torch>=2.11,<2.12",
     "tqdm>=4.66,<5",
     "transformers>=5.5,<6",
-    "triton>=3.6,<4",  # e4m3_compat needs tl.target_info + constexpr_function (3.5+); tested on 3.6
+    "triton==3.6.0",
     "uvicorn>=0.30,<1",
 ]
 

scripts/ci/manylinux-build.sh

@@ -76,7 +76,7 @@ uv venv --quiet --python "$PYBIN" "$VENV"
 uv pip install --quiet --python "$VENV/bin/python" \
   --index-url https://download.pytorch.org/whl/cu130 "torch>=2.11,<2.12"
 uv pip install --quiet --python "$VENV/bin/python" \
-  "setuptools>=77" wheel ninja "apache-tvm-ffi>=0.1.4,<0.2"
+  "setuptools>=77" wheel ninja "apache-tvm-ffi==0.1.13.post3"
 
 export FREETOKEN_BUILD_PYTHON="$VENV/bin/python"
 export FREETOKEN_BUILD_OUT_DIR=/ci-out