# Runtime dependencies (also declared in pyproject.toml)
fastapi>=0.111.0
uvicorn[standard]>=0.29.0
# uvloop 0.23.0 ignores UV_USE_IO_URING=0 and opens an io_uring ring (REG-D67).
uvloop<0.23; sys_platform != 'win32'
httpx>=0.27.0
pydantic>=2.7.0
pydantic-settings>=2.3.0
# NumPy 2.5+ requires Python 3.12; retain the advertised Python 3.11 floor.
numpy>=1.26.0,<2.5
python-dotenv>=1.0.0
structlog>=24.1.0
protobuf>=5.0.0
redis>=5.0.0
requests>=2.31.0
cryptography>=50.0.0,<51.0.0
cbor2>=5.9.0
# Core dependency in pyproject.toml; without it InMemoryRateLimiter falls back to an
# unbounded dict (REG-D70).
cachetools>=5.3.0
# The image installs the SQLite storage backend (`.[storage-sqlite]`). Locked here so
# the image installs exclusively from this hash-pinned set (REG-D69).
aiosqlite>=0.20.0
# PostgreSQL global evidence sequence for multi-replica deployments (aegis.core.ha,
# AEGIS_HA_SEQUENCER_URL=postgresql://...). Locked so the image can use it.
asyncpg>=0.29.0
# /metrics, including the aegis_security_enforcement_mode posture gauge the monitoring
# runbook alerts on. Without it the image served no /metrics at all (REG-D86).
prometheus-client>=0.20.0
# Security floors for transitive deps (Dependabot / PYSEC advisories)
# certifi (transitive via requests/httpx): PYSEC-2026-4320 / GHSA-6q48-6c7w-9gw2
certifi>=2026.10.23
idna>=3.15
# urllib3 (transitive via requests): PYSEC-2026-141 / PYSEC-2026-142; 2.8.0 for
# GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g, GHSA-vxq7-64xx-v4gw (REG-D106)
urllib3>=2.8.0
# anyio (transitive via fastapi/httpx/starlette): GHSA-82r6-8w77-94w6 (critical,
# IDNA 2003 TLS hostname encoding enables certificate spoofing) and
# GHSA-5p39-cfhj-2xmp (process-pool workers can block indefinitely on
# undrained stderr) — both fixed in 4.14.2; requirements.lock now pins 4.15.1
anyio>=4.15.1