Fix generated requirements files to ensure hashes are includes in all (#4378)

Because of the presence of find-index some of packages which are present
in both the indexes weren't getting hashes.

Removed the pytorch index and pinned universal version of torch.

The `requirements/translate.txt` is renamed to
`requirements/translate-cpu.txt` as a specific requirement file for
linux and cpu. The `requirements/translate.txt` contains the universal
install of translate dependencies.

This PR also upgrade python packages, by using `uv lock --upgrade`, and
remove the qrcodes as a direct dependency, it's a dependency of the
two-factor package

- Updated django v4.2.18 -> v4.2.19
- Updated boto3 v1.35.98 -> v1.35.99
- Updated botocore v1.35.98 -> v1.35.99
- Updated certifi v2024.12.14 -> v2025.1.31
- Removed django-appconf v1.0.6
- Updated factory-boy v3.3.1 -> v3.3.3
- Updated faker v33.3.1 -> v35.2.0
- Updated filelock v3.16.1 -> v3.17.0
- Updated fsspec v2024.12.0 -> v2025.2.0
- Updated griffe v1.5.4 -> v1.5.6
- Updated identify v2.6.5 -> v2.6.6
- Updated marshmallow v3.25.1 -> v3.26.1
- Updated mkdocs-material v9.5.49 -> v9.6.2
- Updated mkdocstrings v0.27.0 -> v0.28.0
- Updated mkdocstrings-python v1.13.0 -> v1.14.4
- Updated mypy v1.14.1 -> v1.15.0
- Updated numpy v2.2.1 -> v2.2.2
- Updated phonenumbers v8.13.52 -> v8.13.54
- Updated pre-commit v4.0.1 -> v4.1.0
- Updated prompt-toolkit v3.0.48 -> v3.0.50
- Updated psycopg v3.2.3 -> v3.2.4
- Updated psycopg-binary v3.2.3 -> v3.2.4
- Updated pymdown-extensions v10.14 -> v10.14.3
- Updated pypdf v5.1.0 -> v5.2.0
- Updated pytz v2024.2 -> v2025.1
- Updated ruff v0.9.1 -> v0.9.4
- Updated types-pytz v2024.2.0.20241221 -> v2025.1.0.20250204
- Updated tzdata v2024.2 -> v2025.1
- Updated virtualenv v20.28.1 -> v20.29.1

Fixes #4339

---------

Co-authored-by: Wes Appler <[email protected]>

Author: theskumar

.pre-commit-config.yaml

@@ -3,7 +3,7 @@ repos:
     rev: "0.5.13"
     hooks:
       - id: uv-export
-        name: uv-export requirements.txt
+        name: uv-export requirements/prod.txt
         args:
           [
             "--frozen",
@@ -14,25 +14,26 @@ repos:
             "-o",
             "requirements/prod.txt",
           ]
+
       - id: uv-export
         name: uv-export requirements/dev.txt
         args: ["--frozen", "--group", "dev", "-o", "requirements/dev.txt"]
+
       - id: uv-export
         name: uv-export requirements/docs.txt
         args:
           ["--frozen", "--only-group", "docs", "-o", "requirements/docs.txt"]
 
-      # This is disabled because this doesn't export --find-links. The requirements-translate is maintained manually.
-      # - id: uv-export
-      #   name: uv-export requirements/translate.txt
-      #   args:
-      #     [
-      #       "--frozen",
-      #       "--only-group",
-      #       "translate",
-      #       "-o",
-      #       "requirements/translate.txt",
-      #     ]
+      - id: uv-export
+        name: uv-export requirements/translate.txt
+        args:
+          [
+            "--frozen",
+            "--only-group",
+            "translate",
+            "-o",
+            "requirements/translate.txt",
+          ]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: "v0.8.4"

docs/setup/administrators/machine-translations.md

@@ -11,6 +11,13 @@ As referenced in the [production deployment guide](../deployment/production/stan
 python3 -m pip install -r requirements/translate.txt
 ```
 
+or, if you are on a platform that does not support GPU processing:
+
+```bash
+python3 -m pip install -r requirements/translate-cpu.txt
+```
+
+
 This requirements file will specifically attempt to install the CPU version of [PyTorch](https://pytorch.org/) if available on the detected platform to play better with heroku (doesn't support GPU processing) and to minimize package bloat (CPU package is ~300MB less than the normal GPU). Depending on your use case, you may want to adjust this.
 
 

docs/setup/deployment/production/stand-alone.md

@@ -110,6 +110,11 @@ If utilizing application machine translations, install the required dependencies
 ```shell
 python3 -m pip install -r requirements/translate.txt
 ```
+or, if you are on a platform that does not support GPU processing:
+```shell
+python3 -m pip install -r requirements/translate-cpu.txt
+```
+
 
 ### Install Node packages
 

pyproject.toml

@@ -2,7 +2,7 @@
 name = "hypha"
 description = "A open source submission management platform to receive and manage applications for funding."
 readme = "README.md"
-version = "5.21.0"
+version = "5.24.0"
 requires-python = ">=3.10"
 license = { text = "BSD-3-Clause" }
 
@@ -52,7 +52,6 @@ dependencies = [
     "Pillow~=10.4.0",
     "psycopg[binary]~=3.2.3",
     "pwned-passwords-django~=5.1.1",
-    "qrcode~=7.4.2",
     "reportlab~=4.2.5",
     "setuptools>=75.1.0",
     "social_auth_app_django~=5.4.1",
@@ -100,16 +99,10 @@ dependencies = [
 ]
 
 # Requirements for machine translations
-# NOTE: If you update this section please manual update `requirements/translate.txt` as well.
-"translate" = [
-    # Only install the CPU version of torch when available (linux)
-    "torch==2.3.1+cpu; sys_platform == 'linux'",
-    "argostranslate~=1.9.6",
-]
+"translate" = ["torch~=2.3", "argostranslate~=1.9.6"]
 
 [tool.uv]
 default-groups = ["dev", "docs"]
-find-links = ["https://download.pytorch.org/whl/torch_stable.html"]
 
 [tool.mypy]
 plugins = ["mypy_django_plugin.main"]

requirements/dev.txt

@@ -6,9 +6,9 @@ babel==2.16.0 \
 bracex==2.5.post1 \
     --hash=sha256:12c50952415bfa773d2d9ccb8e79651b8cdb1f31a42f6091b804f6ba2b4a66b6 \
     --hash=sha256:13e5732fec27828d6af308628285ad358047cec36801598368cb28bc631dbaf6
-certifi==2024.12.14 \
-    --hash=sha256:1275f7a45be9464efc1173084eaa30f866fe2e47d389406136d332ed4967ec56 \
-    --hash=sha256:b650d30f370c2b724812bee08008be0c4163b163ddaec3f2546c1caf65f191db
+certifi==2025.1.31 \
+    --hash=sha256:3d5da6925056f6f18f119200434a4780a94263f10d1c21d032a6f6b2baa20651 \
+    --hash=sha256:ca78db4565a652026a4db2bcdf68f2fb589ea80d0be70e03929ed730746b84fe
 charset-normalizer==3.4.1 \
     --hash=sha256:0924e81d3d5e70f8126529951dac65c1010cdf117bb75eb02dd12339b57749dd \
     --hash=sha256:09b26ae6b1abf0d27570633b2b078a2a20419c99d66fb2823173d73f188ce601 \
@@ -67,7 +67,9 @@ charset-normalizer==3.4.1 \
 click==8.1.8 \
     --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
     --hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
-colorama==0.4.6
+colorama==0.4.6 \
+    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
 ghp-import==2.1.0 \
     --hash=sha256:8337dd7b50877f163d4c0289bc1f1c7f127550241988d568c1db512c4324a619 \
     --hash=sha256:9c535c4c61193c2df8871222567d7fd7e5014d835f97dc7b7439069e2413d343
@@ -77,9 +79,9 @@ gitdb==4.0.12 \
 gitpython==3.1.44 \
     --hash=sha256:9e0e10cda9bed1ee64bc9a6de50e7e38a9c9943241cd7f585f6df3ed28011110 \
     --hash=sha256:c87e30b26253bf5418b01b0660f818967f3c503193838337fe5e573331249269
-griffe==1.5.4 \
-    --hash=sha256:073e78ad3e10c8378c2f798bd4ef87b92d8411e9916e157fd366a17cc4fd4e52 \
-    --hash=sha256:ed33af890586a5bebc842fcb919fc694b3dc1bc55b7d9e0228de41ce566b4a1d
+griffe==1.5.6 \
+    --hash=sha256:181f6666d5aceb6cd6e2da5a2b646cfb431e47a0da1fda283845734b67e10944 \
+    --hash=sha256:b2a3afe497c6c1f952e54a23095ecc09435016293e77af8478ed65df1022a394
 hjson==3.1.0 \
     --hash=sha256:55af475a27cf83a7969c808399d7bccdec8fb836a07ddbd574587593b9cdcf75 \
     --hash=sha256:65713cdcf13214fb554eb8b4ef803419733f4f5e551047c9b711098ab7186b89
@@ -168,18 +170,18 @@ mkdocs-git-revision-date-localized-plugin==1.3.0 \
 mkdocs-macros-plugin==1.3.7 \
     --hash=sha256:02432033a5b77fb247d6ec7924e72fc4ceec264165b1644ab8d0dc159c22ce59 \
     --hash=sha256:17c7fd1a49b94defcdb502fd453d17a1e730f8836523379d21292eb2be4cb523
-mkdocs-material==9.5.49 \
-    --hash=sha256:3671bb282b4f53a1c72e08adbe04d2481a98f85fed392530051f80ff94a9621d \
-    --hash=sha256:c3c2d8176b18198435d3a3e119011922f3e11424074645c24019c2dcf08a360e
+mkdocs-material==9.6.2 \
+    --hash=sha256:71d90dbd63b393ad11a4d90151dfe3dcbfcd802c0f29ce80bebd9bbac6abc753 \
+    --hash=sha256:a3de1c5d4c745f10afa78b1a02f917b9dce0808fb206adc0f5bb48b58c1ca21f
 mkdocs-material-extensions==1.3.1 \
     --hash=sha256:10c9511cea88f568257f960358a467d12b970e1f7b2c0e5fb2bb48cab1928443 \
     --hash=sha256:adff8b62700b25cb77b53358dad940f3ef973dd6db797907c49e3c2ef3ab4e31
-mkdocstrings==0.27.0 \
-    --hash=sha256:16adca6d6b0a1f9e0c07ff0b02ced8e16f228a9d65a37c063ec4c14d7b76a657 \
-    --hash=sha256:6ceaa7ea830770959b55a16203ac63da24badd71325b96af950e59fd37366332
-mkdocstrings-python==1.13.0 \
-    --hash=sha256:2dbd5757e8375b9720e81db16f52f1856bf59905428fd7ef88005d1370e2f64c \
-    --hash=sha256:b88bbb207bab4086434743849f8e796788b373bd32e7bfefbf8560ac45d88f97
+mkdocstrings==0.28.0 \
+    --hash=sha256:84cf3dc910614781fe0fee46ce8006fde7df6cc7cca2e3f799895fb8a9170b39 \
+    --hash=sha256:df20afef1eafe36ba466ae20732509ecb74237653a585f5061937e54b553b4e0
+mkdocstrings-python==1.14.4 \
+    --hash=sha256:12e1b1a3848554484896b602dda1096033adeb2715fef421f47d6a163d6c983d \
+    --hash=sha256:35d73fdf2079a2a4e2c8e8ff52976463a75d138f97ffadbc7d29108c6de11b35
 natsort==8.4.0 \
     --hash=sha256:45312c4a0e5507593da193dedd04abb1469253b601ecaf63445ad80f0a1ea581 \
     --hash=sha256:4732914fb471f56b5cce04d7bae6f164a592c7712e1c85f9ef585e197299521c
@@ -198,15 +200,15 @@ platformdirs==4.3.6 \
 pygments==2.19.1 \
     --hash=sha256:61c16d2a8576dc0649d9f39e089b5f02bcd27fba10d8fb4dcc28173f7a45151f \
     --hash=sha256:9ea1544ad55cecf4b8242fab6dd35a93bbce657034b0611ee383099054ab6d8c
-pymdown-extensions==10.14 \
-    --hash=sha256:202481f716cc8250e4be8fce997781ebf7917701b59652458ee47f2401f818b5 \
-    --hash=sha256:741bd7c4ff961ba40b7528d32284c53bc436b8b1645e8e37c3e57770b8700a34
+pymdown-extensions==10.14.3 \
+    --hash=sha256:05e0bee73d64b9c71a4ae17c72abc2f700e8bc8403755a00580b49a4e9f189e9 \
+    --hash=sha256:41e576ce3f5d650be59e900e4ceff231e0aed2a88cf30acaee41e02f063a061b
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
     --hash=sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427
-pytz==2024.2 \
-    --hash=sha256:2aa355083c50a0f93fa581709deac0c9ad65cca8a9e9beac660adcbd493c798a \
-    --hash=sha256:31c7c1817eb7fae7ca4b8c7ee50c72f93aa2dd863de768e1ef4245d426aa0725
+pytz==2025.1 \
+    --hash=sha256:89dd22dca55b46eac6eda23b2d72721bf1bdfef212645d81513ef5d03038de57 \
+    --hash=sha256:c2db42be2a2518b28e65f9207c4d05e6ff547d1efa4086469ef855e4ab70178e
 pyyaml==6.0.2 \
     --hash=sha256:0833f8694549e586547b576dcfaba4a6b55b9e96098b36cdc7ebefe667dfed48 \
     --hash=sha256:0a9a2848a5b7feac301353437eb7d5957887edbf81d56e903999a75a3d743086 \
@@ -326,6 +328,9 @@ super-collections==0.5.3 \
 termcolor==2.5.0 \
     --hash=sha256:37b17b5fc1e604945c2642c872a3764b5d547a48009871aea3edd3afa180afb8 \
     --hash=sha256:998d8d27da6d48442e8e1f016119076b690d962507531df4890fcd2db2ef8a6f
+typing-extensions==4.12.2 ; python_full_version < '3.11' \
+    --hash=sha256:04e5ca0351e0f3f85c6853954072df659d0d13fac324d0072316b67d7794700d \
+    --hash=sha256:1a7ead55c7e559dd4dee8856e3a88b41225abfe1ce8df57b7c13915fe121ffb8
 urllib3==2.3.0 \
     --hash=sha256:1cee9ad369867bfdbbb48b7dd50374c0967a0bb7710050facf0dd6911440e3df \
     --hash=sha256:f8c5449b3cf0861679ce7e0503c7b44b5ec981bec0d1d3795a07f1ba96f0204d