# fastapi>=0.138.1 — starlette 1.0 지원 첫 릴리스 (include_router → _IncludedRouter 지연 포함).
#   이전 CVE-2024-47874 / CVE-2025-54121(starlette) 패치는 아래 starlette>=1.3.1 로 승계.
# fastapi>=0.138.1 — first release supporting starlette 1.0 (include_router → lazy _IncludedRouter).
#   Prior CVE-2024-47874 / CVE-2025-54121 (starlette) fixes are carried by starlette>=1.3.1 below.
# 🔴 0.142.0+ 는 semgrep 과 함께 설치되지 않는다 — 아래 semgrep 주석 · #1733.
# 🔴 0.142.0+ cannot be installed alongside semgrep — see the semgrep comment below · #1733.
fastapi==0.141.1
slowapi==0.1.10
uvicorn[standard]==0.54.0
pydantic-settings==2.16.2
sqlalchemy==2.1.6
alembic==1.20.1
# 온프레미스 프로덕션: psycopg2-binary → psycopg2 + libpq-dev(Ubuntu) / postgresql-devel(RHEL) 설치 권장
# On-premises production: replace psycopg2-binary with psycopg2 + libpq-dev (Ubuntu) / postgresql-devel (RHEL).
psycopg2-binary==2.9.13
PyGithub==2.10.0
httpx==0.28.1
defusedxml==0.7.1
# authlib>=1.7.2 — GHSA-jj8c-mmj3-mmgv (OAuth cache CSRF) fix
authlib==1.9.1
itsdangerous==2.2.0
# starlette>=1.3.1 — PYSEC-2026-161 / CVE-2026-48710 패치 (Host 헤더 미검증 → request.url.path 오염 → 경로 인증 우회; ≤1.0.0 전체 취약, 1.0.1 단독 수정).
# starlette>=1.3.1 — fixes PYSEC-2026-161 / CVE-2026-48710 (Host header not validated → request.url.path poisoning → path-auth bypass; all ≤1.0.0 affected, fixed only in 1.0.1).
starlette==1.10.0
python-telegram-bot==22.8
anthropic==2.3.0
# openai — 머지 검증자(2nd-LLM cross-vendor) 런타임 의존 + (dev) DALL-E 일러스트 도구. 키 미설정 시 비활성
# openai — runtime dep for the 2nd-LLM merge verifier (+ dev DALL-E tool). Inert without OPENAI_API_KEY.
openai==3.41.0
aiosmtplib==5.1.3
pylint==4.1.3
flake8==7.5.0
bandit==1.9.4
# 🔴 semgrep 핀이 전이 의존 넷을 좁게 정한다 — pyjwt · mcp · click · opentelemetry-api.
#   1.170.x 는 pyjwt~=2.13.0 을 강제해 pyjwt 권고가 pip-audit 를 막았고, 1.180.0 은 예외 없이 감사 0건이다.
#   opentelemetry-api~=1.37 을 강제해 fastapi 0.142.0+(>=1.44)와 공존할 수 없다 → fastapi 보류(#1733).
#   `mcp==1.29.0` 정확 핀이 CVE-2026-59951, `opentelemetry-api~=1.37` 이 CVE-2026-114603 을 막는다
#   — 감사 예외와 제거 조건은 ci.yml pip-audit 스텝.
# 🔴 The semgrep pin narrowly fixes four transitives — pyjwt · mcp · click · opentelemetry-api.
#   1.170.x forced pyjwt~=2.13.0 and failed pip-audit; 1.180.0 audits clean with no ignores.
#   It forces opentelemetry-api~=1.37, which fastapi 0.142.0+ (>=1.44) cannot share → fastapi hold (#1733).
#   Its exact `mcp==1.29.0` pin trips CVE-2026-59951 and `opentelemetry-api~=1.37` trips
#   CVE-2026-114603 — exceptions and removal terms live in ci.yml (pip-audit).
semgrep==1.183.0
slither-analyzer==0.11.6
sqlfluff==4.4.0
jinja2==3.1.6
# python-multipart>=0.0.32 — CVE-2026-40347 (preamble/epilogue CPU DoS) fix
python-multipart==0.0.32
yamllint==1.38.0
# cryptography>=50.0.0 — CVE-2026-69247 fix (pkcs7_decrypt_* 가 RecipientInfo 복호 결과를
#   보고해 padding-oracle 성립). 이전 핀 사유: CVE-2026-26007/34073/39892.
cryptography==50.0.2