# Runtime dependencies, pinned.
#
# These were previously floating lower bounds (`Flask>=2.0.0`), so every build
# produced a different application and a regression upstream was indistinguishable
# from a regression here. Dependabot (.github/dependabot.yml) opens a PR when any
# of these has an update, and CI has to pass before it can be merged.

# Core
Flask==3.1.3
Werkzeug==3.1.9            # 2.3.7 had a DoS advisory; do not float back below 3.0.6
Jinja2==3.1.6
itsdangerous==2.2.0        # signs the session cookie
MarkupSafe==3.0.4
click==8.5.1
blinker==1.9.0

# PDF / OCR / output
Pillow==13.0.0             # image handling
pytesseract==0.3.13        # Tesseract wrapper
pdf2image==1.17.0          # PDF -> image, shells out to Poppler
python-docx==1.2.0         # DOCX creation
lxml==6.1.3                # python-docx dependency

# Serving
gunicorn==26.2.0           # WSGI server used by entrypoint.sh
python-dotenv==1.2.4       # loads .env in local development

# --- Optional OCR engines --------------------------------------------------
# Not installed by default; each is a large dependency tree pulled in lazily by
# app.py only when that engine is selected.
#   EasyOCR   -> pip install -r requirements-easyocr.txt
#   PaddleOCR -> pip install -r requirements-paddleocr.txt
#   PyOCR     -> pip install pyocr

# --- External system dependencies (not installed via pip) ------------------
# Poppler:   macOS `brew install poppler`   Debian `apt-get install poppler-utils`
# Tesseract: macOS `brew install tesseract tesseract-lang`
#            Debian `apt-get install tesseract-ocr tesseract-ocr-<lang>`
# Both are already present in the Docker image.