[deps] Bump numpy/librosa for numpy 2.x compatibility; make torch family optional, fixes #48

[warptengood]

Description:

Summary

This PR updates pyproject.toml to unblock users who need numpy >= 2.x and librosa >= 0.11.0, which are increasingly required by modern audio/ML stacks. No changes were made to any source code.

Changes

• librosa: ^0.10.1 → >=0.11.0
• numpy: ^1.23.0 → >=2.2.6
• torch, torchaudio, torchlibrosa: moved to optional, exposed via pip install msclap[torch]

Why make torch optional?

torch and its sibling libraries (torchaudio, torchlibrosa) are highly environment-sensitive. The correct version
depends on the user's CUDA version, driver, and other installed torch-family packages - and they must all match
exactly. Installing torch from PyPI as a hard dependency frequently results in a CPU-only build being pulled in,
silently overriding a user's carefully configured GPU environment.

The established convention in the ML ecosystem (e.g. accelerate, sentence-transformers) is to treat torch as a
pre-condition that users manage themselves via the official PyTorch install matrix. Making it optional in
pyproject.toml respects that convention without removing any functionality.

Testing

All example scripts were executed successfully without any modifications to source code:

• examples/zero_shot_predictions.py
• examples/zero_shot_classification.py
• examples/audio_captioning.py

Test environment:

Package	Version
Python	3.10.8
numpy	2.26
librosa	0.11.0
torch	2.8.0+cu129
torchaudio	2.8.0+cu129
torchlibrosa	0.1.0
pandas	2.3.3
transformers	4.39.0
pyyaml	6.0.2
scikit-learn	1.7.2

Since no source code was modified, the behavior is identical to the current release - this is purely a dependency
constraint update.

[warptengood]

@microsoft-github-policy-service agree

[racinmat]

This would be awesome to have merged.
ping @bmartin1 and @hykilpikonna

[hykilpikonna]

This would be awesome to have merged. ping @bmartin1 and @hykilpikonna

unfortunately I don't have the permission to merge pull requests here

[warptengood]

This would be awesome to have merged. ping @bmartin1 and @hykilpikonna

unfortunately I don't have the permission to merge pull requests here

Are you the trusted publisher in PyPI for msclap? I noticed that version in PyPI diverges with version here. What was the reason for it?

[hykilpikonna]

This would be awesome to have merged. ping @bmartin1 and @hykilpikonna

unfortunately I don't have the permission to merge pull requests here

Are you the trusted publisher in PyPI for msclap? I noticed that version in PyPI diverges with version here. What was the reason for it?

The msclap==1.3.4 (latest) package on pypi is the current main branch of this repository.

Timeline of what happened:

• 2023-10-20: msclap==1.3.3 published on PyPI
• 2024-09-06: I opened this pull request fixing a dependency issue: Remove torchvision dependency and solve pytorch vulnerability #41
• 2024-10-03: The PR is merged, I sent an email to Benjamin with instructions to bump the version and deploy to PyPI.
• 2025-05-23: I needed to use msclap in a new research project. I realized he hasn't deployed it after my email, so I bumped the version and deployed it from my end. I didn't submit another pull request just to change the version number because I don't want to be occupying a researcher's time over this trivial change.

Diff: (as you can see, the only diff between 1.3.3 and 1.3.4 on PyPI is PR#41, and the only diff between 1.3.4 and the current main branch is the version number).