[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
# Core Web & API
flask = "==3.1.3"
flask-cors = "==6.0.0"
flask-limiter = "==3.8.0"
requests = "==2.33.0"

# Audio I/O (no CUDA deps)
sounddevice = "==0.5.1"
soundfile = "==0.12.1"

# AI API clients (pure Python, no native GPU deps)
openai = "==1.57.0"
ollama = "==0.4.5"
transformers = "==5.5.0"

# Shared ML utility (compatible with numpy 1.x, no CUDA)
numpy = "==1.26.4"

# Testing & Environment
pytest = "==8.3.4"
python-dotenv = "==1.2.2"

# Web Scraping
beautifulsoup4 = "==4.12.3"

# Configuration / Validation
pydantic = "==2.10.5"

# Security-Critical Dependencies
# cryptography >=44.0.2 fixes GHSA-79v4-65xg-pq4j (Subgroup Attack on SECT curves)
cryptography = "==50.0.0"
setuptools = "==78.1.1"
pip = "==26.1.2"
werkzeug = "==3.1.6"
jinja2 = "==3.1.6"
# pillow >=11.2.0 fixes out-of-bounds write when loading PSD images
pillow = "==12.1.1"
urllib3 = "==2.7.0"
certifi = "==2024.12.14"

# MQTT Messaging
asyncio-mqtt = "==0.16.2"

# NOTE: The following ML/GPU packages are intentionally excluded from Pipfile
# because they pull in CUDA libraries or require numpy 2.x on Linux, which
# prevents Dependabot from running 'pipenv lock' on a clean system.
# They live in requirements-cpu.txt, requirements-gpu*.txt, and pyproject.toml [ml]:
#   torch, torchvision, torchaudio  -> requirements-cpu.txt / requirements-gpu*.txt
#   openai-whisper                  -> requirements-cpu.txt (numba/triton deps)
#   openwakeword                    -> requirements-cpu.txt (onnxruntime → numpy 2.x)
#   TTS (Coqui)                     -> requirements-cpu.txt (depends on torch)

[dev-packages]
pytest-cov = "*"
pip-audit = "*"

[requires]
python_version = "3.11"