# Auction NLQ Engine — pinned dependency lock (Findings 5 + 9, 2026 audit)
#
# requirements.txt states floors only (e.g. sqlalchemy>=2.0.0), which
# means two installs a month apart can resolve completely different
# dependency trees with no review and no signal — see
# tests/security_audit/test_supply_chain.py's module docstring for the
# full reasoning. This file pins every package requirements.txt pulls in,
# transitively, to the exact version this deployment was validated
# against. Install with:
#
#     pip install -r requirements.lock
#
# not `pip install -r requirements.txt` directly — see
# docs/deployment-runbook.md.
#
# sqlglot is pinned deliberately, not incidentally: security/sql_guard.py
# makes every one of its allow/deny decisions from that parser's AST, so a
# silent sqlglot upgrade is the one dependency change in this tree that can
# alter security behaviour without a single line of this repository
# changing.
#
# CI tests both this pinned set and the newest releases the floors in
# requirements.txt allow: every OS / Python leg of .github/workflows/ci.yml
# runs once from this file (the tree deployments install) and once from
# requirements.txt (the early warning that an upstream release has broken
# us), and the build's dependency audit covers this file.
#
# Provenance: generated via `pip freeze` against this project's current,
# already-installed development environment (Windows, CPython 3.13),
# filtered down to requirements.txt's own packages plus the transitive
# closure importlib.metadata reports for them — NOT a clean-room `pip
# install` into a fresh virtualenv followed by `pip-compile`/`pip freeze`
# there. That is a meaningfully weaker provenance guarantee than a clean
# resolve (this environment could already hold a locally-patched or
# otherwise nonstandard build of any package below) and should be
# re-generated from a clean venv — ideally on the target Linux deployment
# platform — before this lock is treated as authoritative for a
# production rollout. Two packages `uvicorn[standard]` can pull in on
# Linux, `uvloop` and (on Python < 3.11) `exceptiongroup`, are absent from
# this Windows/3.13 environment and therefore absent below; uvicorn works
# without `uvloop` (it falls back to asyncio's own event loop), so this is
# a performance gap on Linux, not a missing hard dependency — add it back
# explicitly if/when this lock is regenerated on the real deployment
# platform.
alembic==1.19.2
annotated-doc==0.0.5
annotated-types==0.6.0
anyio==4.14.2
certifi==2026.10.19
charset-normalizer==3.4.4
click==8.3.3
colorama==0.4.6
et-xmlfile==2.0.0
fastapi==0.141.1
greenlet==3.2.4
h11==0.16.0
httpcore==1.0.9
httptools==0.8.0
httpx==0.28.1
idna==3.15
importlib-metadata==8.7.0
mako==1.4.1
markdown-it-py==2.2.0
markupsafe==3.0.2
mdurl==0.1.2
numpy==2.3.5
openpyxl==3.1.5
pandas==2.3.3
prompt-toolkit==3.0.52
pydantic==2.12.4
pydantic-core==2.41.5
pygments==2.20.0
pyodbc==5.3.0
python-dateutil==2.9.0.post0
python-dotenv==1.2.4
pytz==2025.2
pyyaml==6.0.3
questionary==2.1.1
requests==2.33.0
rich==14.2.0
six==1.17.0
sniffio==1.3.0
sqlalchemy==2.0.43
sqlglot==30.18.0
starlette==1.6.0
tomli==2.2.1
typing-extensions==4.15.0
typing-inspection==0.4.2
tzdata==2025.2
urllib3==2.8.0
uvicorn==0.52.4
watchfiles==1.2.0
wcwidth==0.2.13
websockets==17.1
zipp==3.23.0