v7: huggingface_hub<1.0 (Gradio 5.5 oauth still imports HfFolder)

requirements.txt

@@ -1,17 +1,17 @@
-# Gradio 5 — escapes the 4.x dep-pinning rabbit hole.
-# 4.44.1 + new Starlette (0.40+) is broken: 4.x calls TemplateResponse with
-# the pre-0.40 positional-args signature, so jinja2's cache lookup gets a
-# dict as a key → TypeError. Gradio 5 uses the new Starlette API.
+# Gradio 5 (avoids 4.x's Starlette template signature breakage).
 gradio>=5.5,<6.0
 
+# CRITICAL: gradio 5.5's oauth.py still does `from huggingface_hub import
+# HfFolder` — HfFolder was removed in huggingface_hub 1.0. Pin <1.0.
+# (Newer gradio 5.20+ uses get_token instead, but the 5.5 LTS line we use
+# is more conservative and well-tested on Spaces.)
+huggingface_hub>=0.24,<1.0
+
 matplotlib>=3.7
 numpy>=1.24
 torch>=2.0
 pillow>=10.0
 
-# huggingface_hub stays <2.0 (pinning broad — Gradio 5 handles 1.x+).
-huggingface_hub>=0.24,<2.0
-
 # Prebuilt llama-cpp-python wheel from AIencoder/llama-cpp-wheels.
 # CPU-only, AVX2 + FMA + F16C — works on every HF Space x86_64 host.
 https://huggingface.co/datasets/AIencoder/llama-cpp-wheels/resolve/main/llama_cpp_python-0.3.16%2Bbasic_avx2_fma_f16c-cp312-cp312-manylinux_2_31_x86_64.whl