# fastapi's OWN pin is what held Starlette at 0.37.2 (CVE-2024-47874, multipart DoS, fixed 0.40.0) —
# bumped together with an explicit Starlette pin so the fix can't regress silently on a re-resolve.
fastapi==0.141.1
starlette==0.52.1
uvicorn==0.30.1
# uvicorn needs a WebSocket library or it answers every /ws/ upgrade with a 404. fastapi 0.111 pulled
# one in transitively (uvicorn[standard]); the 0.141 bump dropped it silently and 1.0 shipped with no
# display socket — no heartbeat, no remote, watchdog "gave up" (TestClient doesn't need it, so tests
# stayed green). Pinned explicitly; tests/test_ws_runtime_dep.py guards it.
websockets==13.1
pydantic==2.13.5
# The only range pin in this file; bounded to fastapi's own floor (>=0.0.18) plus an explicit ceiling
# so an appliance that rebuilds itself unattended can't drift onto an untested next-major release.
python-multipart>=0.0.18,<0.1
python-dotenv==1.0.1
sqlalchemy==2.0.30
# Pillow 13 fixes ~35 CVEs incl. a heap write in the bundled libopenjp2 reachable via Image.open()+load();
# we open uploaded/downloaded images without a formats= restriction, so stay current.
Pillow==13.0.0
# Bumped alongside Pillow 13 (its floor is pillow>=11.1.0; 1.8.1 is current).
pillow-heif==1.8.1
# Explicit pin (was only transitive): 2026.7.22 still trusts the eMudhra emSign ECC Root CA - G3 whose
# intermediates have compromised keys (GHSA-6q48-6c7w-9gw2, fixed in 2026.10.19).
certifi==2026.10.23
wikipedia==1.4.0
httpx==0.28.1
alembic==1.13.1
samsungtvws==3.0.5
PyNaCl==1.6.2
# python:3.11-slim ships NO zone data, so zoneinfo.available_timezones() is empty in the container
# and a timezone the user picks can only be shape-checked, never verified (ADR-118/119).
tzdata==2024.1