Merge branch 'master' into mh-release-scripts

Author: mhucka

.github/SECURITY.md

@@ -8,14 +8,9 @@ contributions.
 Please **do not** use GitHub issues to report security vulnerabilities; GitHub
 issues are public, and doing so could allow someone to exploit the information
 before the problem can be addressed. Instead, please use the *Report a
-vulnerability* interface from the *Security* tab at the top of this GitHub
+vulnerability* button from the *Security* tab at the top of this GitHub
 repository page.
 
-<div align="center">
-<img width="75%" alt="Location of the report button on the repository page"
-    src="/.github/report-vulnerability-button.png">
-</div>
-
 Please report security issues in third-party modules to the person or team
 maintaining the module rather than this project's stewards, unless you believe
 that some action needs to be taken specifically with this project in order to

.github/report-vulnerability-button.png

@@ -54,7 +54,7 @@ jobs:
     name: Library tests
     runs-on: linux-x86-n2-32
     container:
-      image: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:latest
+      image: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:infrastructure-public-image-82c7ac59ba4b
     timeout-minutes: 60
 
     steps:
@@ -103,7 +103,7 @@ jobs:
     name: Tutorial tests
     runs-on: linux-x86-n2-32
     container:
-      image: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:latest
+      image: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:infrastructure-public-image-82c7ac59ba4b
     timeout-minutes: 60
 
     steps:

.github/workflows/ci-build-checks.yaml

@@ -93,7 +93,9 @@ jobs:
     if: needs.Decision.outputs.run == 'true'
     name: Build and test
     needs: Decision
-    runs-on: ubuntu-22.04
+    container:
+      image: us-docker.pkg.dev/ml-oss-artifacts-published/ml-public-container/ml-build:infrastructure-public-image-82c7ac59ba4b
+    runs-on: linux-x86-n2-32
     steps:
       - name: Check out a copy of the TFQ git repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

.github/workflows/ci-nightly-build-test.yaml

@@ -3,6 +3,11 @@
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
+local_repository(
+    name = "pypi_setuptools",
+    path = "third_party/pypi_setuptools",
+)
+
 # TensorFlow's .bzl files, loaded later in this file, also load rules_python
 # but we need a slightly newer version that is still compatible with TF's.
 http_archive(
@@ -39,11 +44,14 @@ load("@pypi//:requirements.bzl", "install_deps")
 
 install_deps()
 
-EIGEN_COMMIT = "aa6964bf3a34fd607837dd8123bc42465185c4f8"
+# Eigen commit used by TensorFlow / TFQ.
+# This commit corresponds to Eigen version 3.4.90
+# (verified via Eigen/src/Core/util/Macros.h).
+EIGEN_COMMIT = "c1d637433e3b3f9012b226c2c9125c494b470ae6"
 
 http_archive(
     name = "eigen",
-    sha256 = "35ba771e30c735a4215ed784d7e032086cf89fe6622dce4d793c45dd74373362",
+    sha256 = "0992b93a590c39e196a9efdb5b4919fbf3fb485e7e656c6a87b21ddadb7f6ad2",
     build_file_content = """
 cc_library(
   name = "eigen3",
@@ -71,10 +79,9 @@ http_archive(
 
 http_archive(
     name = "org_tensorflow",
-    patches = ["//third_party/tf:tf.patch"],
-    sha256 = "c8c8936e7b6156e669e08b3c388452bb973c1f41538149fce7ed4a4849c7a012",
-    strip_prefix = "tensorflow-2.16.2",
-    urls = ["https://github.com/tensorflow/tensorflow/archive/refs/tags/v2.16.2.zip"],
+    sha256 = "75d63eab5c4b41a831e39e2e3795e1f9dcc247e8fcca11bf3f3e1a6ac35e55d0",
+    strip_prefix = "tensorflow-2.17.1",
+    urls = ["https://github.com/tensorflow/tensorflow/archive/refs/tags/v2.17.1.zip"],
 )
 
 

WORKSPACE

@@ -0,0 +1,89 @@
+# Copyright 2025 The TensorFlow Quantum Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# =============================================================================
+
+# Summary: build file for making isolated Docker environments for testing.
+# This accepts 2 optional build arguments to set the Ubuntu & Python versions.
+# Usage example:
+#
+#   docker build --no-cache --build-arg PYTHON_VERSION=3.10 \
+#     --build-arg UBUNTU_VERSION=24.04 -t my-image:latest .
+#
+# Note that the name and tag ("my-image" and "latest" in the example above) are
+# yours to choose. They're not set using the arguments or linked to their values.
+
+# Default values for build arguments:
+ARG PYTHON_VERSION=3.10
+ARG UBUNTU_VERSION=22.04
+
+FROM ubuntu:${UBUNTU_VERSION}
+
+# Make the Python version argument visible to the rest of this file after FROM.
+ARG PYTHON_VERSION
+ENV PYTHON_VERSION=${PYTHON_VERSION}
+
+ENV LANG=C.UTF-8
+ENV LC_ALL=C.UTF-8
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Ensure the shell is Bash.
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Tell the Dockerfile linter not to warn about how we use apt.
+# hadolint global ignore=DL3008,DL3009
+
+RUN apt-get -q update -q && \
+    apt-get install -y --no-install-recommends ca-certificates \
+         pkg-config gnupg curl lsb-release git zip unzip
+
+# We avoid the use of "add-apt-repository" because it is only available from the
+# "software-properties-common" package, and installing that package brings in a
+# lot of other unrelated unnecessary packages. Instead, we fetch the GPG key for
+# the deadsnakes package archive and install it where apt can find it.
+ENV ID=0xF23C5A6CF475977595C89F51BA6932366A755776
+ENV GPG_FILE="/etc/apt/trusted.gpg.d/deadsnakes.gpg"
+RUN curl -sSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=${ID}" | \
+    gpg --dearmor -o ${GPG_FILE}
+
+ENV PPA_URL="https://ppa.launchpadcontent.net/deadsnakes/ppa/ubuntu"
+ENV APT_FILE="/etc/apt/sources.list.d/deadsnakes.list"
+RUN echo "deb [signed-by=${GPG_FILE}] ${PPA_URL} $(lsb_release -cs) main" > "${APT_FILE}"
+
+RUN apt-get -q update -q && \
+    apt-get install -yq --no-install-recommends make clang g++ zlib1g-dev \
+        python${PYTHON_VERSION} python${PYTHON_VERSION}-dev \
+        python${PYTHON_VERSION}-venv python-is-python3
+
+# Use update-alternatives to make the desired version be the default.
+# hadolint ignore=SC3010
+RUN python_path="" bin="/usr/bin" && \
+    case "$(lsb_release -rs)" in \
+        "24.04") python_path="${bin}/python3.12" ;; \
+        "22.04") python_path="${bin}/python3.10" ;; \
+        "20.04") python_path="${bin}/python3.8"  ;; \
+        *) python_path=$(readlink -f ${bin}/python3) ;; \
+    esac && \
+    update-alternatives --install ${bin}/python3 python3 "${python_path}" 1 && \
+    update-alternatives --install ${bin}/python3 python3 "${bin}/python${PYTHON_VERSION}" 2
+
+# Install pip, trying ensurepip first and falling back to get-pip.py.
+RUN export PIP_BREAK_SYSTEM_PACKAGES=1 PIP_ROOT_USER_ACTION=ignore && \
+    (python3 -m ensurepip --upgrade --default-pip || \
+        (curl -sS https://bootstrap.pypa.io/get-pip.py | python3)) && \
+    python3 -m pip install --no-cache-dir --upgrade 'pip>19'
+
+# Clean up before finishing.
+RUN apt-get clean
+
+CMD ["/bin/bash"]

release/docker/Dockerfile

@@ -0,0 +1,31 @@
+# Docker images for basic testing
+
+This directory contains a [`Dockerfile`](Dockerfile) for creating Ubuntu
+containers with Python installed and very little else compared to the stock
+Ubuntu images from https://hub.docker.com/_/ubuntu/. These can be used for
+testing TensorFlow Quantum builds and tutorials in relatively isolated
+environments.
+
+The script [`create_docker_images.sh`](create_docker_images.sh) creates separate
+images with a range of Python versions installed in Ubuntu 22.04 and 24.04. The
+result is a set of images with names like `ubuntu22-cp310`, `ubuntu22-cp311`,
+etc. The script `create_docker_images.sh` is meant to be run simply like this:
+
+```shell
+./create_docker_images.sh
+```
+
+The configuration in `Dockerfile` runs a Bash shell as the last step if a
+container is not started with any other command to run. When combined with
+Docker's `-v` argument, you can easily run commands inside the container
+environment while accessing your TensorFlow Quantum source files. For example:
+
+```shell
+# The next cd command moves to the root of the source tree.
+cd $(git rev-parse --show-toplevel)
+docker run -it --rm --network host -v .:/tfq ubuntu24-cp312
+```
+
+will leave you with a shell prompt inside a basic Ubuntu 24.04 environment with
+Python 3.12 preinstalled and your local TensorFlow Quantum source directory
+accessible at `/tfq` from inside the container.

release/docker/README.md

@@ -0,0 +1,68 @@
+#!/bin/bash
+# Copyright 2025 The TensorFlow Quantum Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# =============================================================================
+
+# Summary: create a set of Docker images for testing TFQ distributions.
+# This loops over a set of Ubuntu versions and Python versions, and builds
+# Docker images using the Dockerfile in this directory.
+#
+# Example of how the resulting images can be run
+#   docker run -it --rm --network host -v .:/tfq ubuntu22-cp310
+
+set -e
+
+declare -a ubuntu_versions=()
+declare -a python_versions=()
+
+ubuntu_versions+=( "22.04" "24.04" )
+python_versions+=( "3.10" "3.11" "3.12" "3.13" )
+
+usage="Usage: ${0} [OPTIONS]
+
+Build a set of basic Ubuntu Linux x86_64 Docker images with
+Python preinstalled.
+
+General options:
+  -h     Show this help message and exit
+  -v     Run Docker build with verbose progress output"
+
+while getopts "hv" opt; do
+  case "${opt}" in
+        h) echo "${usage}"; exit 0 ;;
+        v) export BUILDKIT_PROGRESS=plain ;;
+        ?) echo "${usage}"; exit 1 ;;
+    esac
+done
+
+total_items=$(( ${#ubuntu_versions[@]} * ${#python_versions[@]}))
+echo "Building a total of ${total_items} Docker images."
+
+start_time="$(date +"%Y-%m-%d-%H%M")"
+for os_version in "${ubuntu_versions[@]}"; do
+    for py_version in "${python_versions[@]}"; do
+        echo
+        echo "~~~~ Python ${py_version} on Ubuntu ${os_version}"
+        # shellcheck disable=SC2086  # Lack of quotes around vars is ok here.
+        docker build --no-cache --label "build-datetime=${start_time}" \
+            --build-arg PYTHON_VERSION="${py_version}" \
+            --build-arg UBUNTU_VERSION="${os_version}" \
+            -t ubuntu${os_version%%.*}-cp${py_version//./}:latest .
+    done
+done
+
+echo
+echo "~~~~ Done. The following Docker images were created:"
+echo
+docker images --filter "label=build-datetime=${start_time}"

release/docker/create_docker_images.sh

@@ -48,31 +48,29 @@ def finalize_options(self):
 REQUIRED_PACKAGES = [
     "cirq-core==1.3.0",
     "cirq-google==1.3.0",
-    "numpy<2.0",
-    "protobuf==4.25.8",
-    "scipy<=1.12.0",
     "sympy==1.14",
-    "tf-keras~=2.16.0",
-
+    "tf-keras~=2.17.0",
     # The following are transitive dependencies that need to be constrained to
     # avoid incompatible versions or because some (e.g., contourpy 1.3.3)
     # require Python 3.11+ and we want to maintain Python 3.10 compatibility.
     # TODO: revisit after we reach compatibility with TensorFlow 2.19+.
-    "contourpy<=1.3.0",
+    "contourpy<=1.3.2",
     "h5py==3.10.0",
     "importlib_metadata<5",
-    "jax<0.4.24",
-    "jaxlib<0.4.24",
+    "jax<=0.5",
     "matplotlib<3.10",
-    "networkx<3.3",
-    "pillow<=11.0",
+    "numpy<2.0",
+    "scipy<=1.12.0",
+    # The following makes it easier to get the right version on Colab. Once
+    # TFQ works with the latest version of TF, this may become unnecessary.
+    "protobuf==4.25.8",
 ]
 
 # TF requirement is placed as an extras to avoid overwriting existing nightly TF
 # installations. Users can run "pip install tensorflow-quantum[and-tensorflow]"
 # to get everything in one go (or "pip install tensorflow tensorflow-quantum").
 EXTRA_PACKAGES = {}
-EXTRA_PACKAGES["and-tensorflow"] = ["tensorflow>=2.16,<2.17"]
+EXTRA_PACKAGES["and-tensorflow"] = ["tensorflow>=2.17,<2.18"]
 # "extras" was used before 0.7.4. Prefer "and-tensorflow" in 0.7.4+.
 EXTRA_PACKAGES["extras"] = EXTRA_PACKAGES["and-tensorflow"]
 # Add an alias in case people type an underscore instead of a dash.
@@ -103,6 +101,7 @@ def has_ext_modules(self):
     version=BUILD_VERSION,
     description="Library for hybrid quantum-classical machine learning.",
     long_description="\n".join(DOCLINES[2:]),
+    long_description_content_type="text/plain",
     author="The TensorFlow Quantum Authors",
     author_email="tensorflow-quantum-team@google.com",
     url="https://github.com/tensorflow/quantum/",
@@ -122,6 +121,7 @@ def has_ext_modules(self):
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
         "Topic :: Scientific/Engineering",
         "Topic :: Scientific/Engineering :: Artificial Intelligence",
         "Topic :: Scientific/Engineering :: Mathematics",

release/setup.py

@@ -18,8 +18,14 @@
 # scripts/generate_requirements.sh.
 cirq-core~=1.3.0
 cirq-google~=1.3.0
-tensorflow>=2.16,<2.17
-tf-keras~=2.16.0
+tensorflow>=2.17,<2.18
+keras==3.12.0
+tf-keras~=2.17.0
+setuptools==75.0.0
+wheel==0.46.2
+contourpy<=1.3.2
+networkx<=3.4.2
+scipy==1.15.3
 
 # TODO: the next ones are not truly core requirements. A better place should be
 # found for them (long with others needed by scripts/*). They're here as a