From 9fddf3f7992df2010191023ceb2ae057e68907c3 Mon Sep 17 00:00:00 2001
From: Jamie Pine <ijamespine@me.com>
Date: Sun, 26 Jul 2026 23:17:08 -0700
Subject: [PATCH] build: pin git dependencies to commits

linacodec and Zipvoice (both from a third-party personal account) and
Qwen3-TTS installed from branch HEADs, so a force-push upstream could
silently change what a release ships. linacodec/Zipvoice are pinned to
the commits resolved in the working venv; Qwen3-TTS to current
upstream HEAD, verified to be the installed 0.1.1.
---
 Dockerfile               | 2 +-
 backend/requirements.txt | 7 ++++---
 justfile                 | 4 ++--
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 2fe66e5a..5c2c8114 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,7 +61,7 @@ RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
 RUN pip install --no-cache-dir --prefix=/install --no-deps chatterbox-tts
 RUN pip install --no-cache-dir --prefix=/install --no-deps hume-tada
 RUN pip install --no-cache-dir --prefix=/install \
-    git+https://github.com/QwenLM/Qwen3-TTS.git
+    git+https://github.com/QwenLM/Qwen3-TTS.git@022e286b98fbec7e1e916cb940cdf532cd9f488e
 
 
 # === Stage 3: Runtime ===
diff --git a/backend/requirements.txt b/backend/requirements.txt
index caafc0e7..ef4d9f2b 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -17,9 +17,10 @@ qwen-tts>=0.0.5
 # LuxTTS (voice cloning engine)
 # piper-phonemize needs custom index (no PyPI wheels)
 --find-links https://k2-fsa.github.io/icefall/piper_phonemize.html
-# linacodec is a git-only dep of Zipvoice (uv-only source, pip can't resolve it)
-linacodec @ git+https://github.com/ysharma3501/LinaCodec.git
-Zipvoice @ git+https://github.com/ysharma3501/LuxTTS.git
+# linacodec is a git-only dep of Zipvoice (uv-only source, pip can't resolve it).
+# Both are pinned to commits so a force-push upstream can't change what we ship.
+linacodec @ git+https://github.com/ysharma3501/LinaCodec.git@c0ae7c7285e121475c27592cfbb600624b714290
+Zipvoice @ git+https://github.com/ysharma3501/LuxTTS.git@381b1609cb1d1afbf756b87809c623464cfd8ac5
 
 # Chatterbox TTS sub-dependencies (chatterbox-tts itself is installed
 # --no-deps in the setup script because it pins numpy<1.26 / torch==2.6
diff --git a/justfile b/justfile
index c80dc7a4..dcbc1f18 100644
--- a/justfile
+++ b/justfile
@@ -73,7 +73,7 @@ setup-python:
         echo "Detected Apple Silicon — installing MLX dependencies..."
         {{ pip }} install -r {{ backend_dir }}/requirements-mlx.txt
     fi
-    {{ pip }} install git+https://github.com/QwenLM/Qwen3-TTS.git
+    {{ pip }} install git+https://github.com/QwenLM/Qwen3-TTS.git@022e286b98fbec7e1e916cb940cdf532cd9f488e
     {{ pip }} install pyinstaller ruff pytest pytest-asyncio -q
     echo "Python environment ready."
 
@@ -109,7 +109,7 @@ setup-python:
     & "{{ pip }}" install -r {{ backend_dir }}/requirements.txt
     & "{{ pip }}" install --no-deps chatterbox-tts
     & "{{ pip }}" install --no-deps hume-tada
-    & "{{ pip }}" install git+https://github.com/QwenLM/Qwen3-TTS.git
+    & "{{ pip }}" install git+https://github.com/QwenLM/Qwen3-TTS.git@022e286b98fbec7e1e916cb940cdf532cd9f488e
     & "{{ pip }}" install pyinstaller ruff pytest pytest-asyncio -q
     Write-Host "Python environment ready."