Pin VTK stack (pyvista 0.48.4 / vtk-osmesa 9.3.1) for reproducible builds

The last rebuild floated pyvista (pulled transitively by cadgenbench) and the
headless vtk-osmesa swap to latest, producing a mismatched pair that failed at
import (libvtkWrappingPythonCore3.12.so not found) and broke the Space. Pin both
to the known-good versions.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -58,9 +58,12 @@ RUN pip install --no-cache-dir \
 # CPU software rasteriser, self-contained, no display server required).
 # This is the canonical PyVista headless-Docker recipe; the wheel
 # comes from Kitware's index, not PyPI proper.
+# Pinned to match pyvista==0.48.4 (vtk 9.3.1). An unpinned vtk-osmesa floats
+# to the latest build, which mismatches the pinned pyvista on rebuild and
+# fails at import (libvtkWrappingPythonCore3.12.so not found).
 RUN pip uninstall -y vtk \
     && pip install --no-cache-dir \
-        --extra-index-url https://wheels.vtk.org vtk-osmesa
+        --extra-index-url https://wheels.vtk.org "vtk-osmesa==9.3.1"
 
 # Drop privileges. HF Spaces conventionally run as uid 1000 with
 # WORKDIR /home/user/app.

requirements.txt

@@ -23,3 +23,9 @@ requests>=2.31
 # input_files) to build the Task-browser tab. Pinned explicitly even
 # though it rides in transitively via gradio/huggingface_hub.
 pyyaml>=6.0
+# Pin the VTK stack so image rebuilds are reproducible. pyvista is pulled
+# transitively by cadgenbench (unpinned); without an explicit pin a rebuild
+# floats to the latest pyvista/vtk, which then mismatches the headless
+# `vtk-osmesa` swap in the Dockerfile (ImportError: libvtkWrappingPythonCore
+# *.so not found). 0.48.4 / vtk 9.3.1 is the known-good pair.
+pyvista==0.48.4