# Backend dependency SPEC — the versions Synapse supports.
#
# Every entry carries an upper bound. This is not stylistic: `mcp` was once a
# bare name here, a fresh install resolved the mcp 2.0.0 rewrite, and every
# native tool server died at import while the backend started with no tools.
# A floor-only spec ships the next major release straight to users.
#
# Installers and CI resolve backend/requirements.lock (exact, transitive) rather
# than this file. Regenerate the lock with scripts/lock-deps.sh after editing.
#
# mcp<2 is load-bearing: 2.0 removed the lowlevel Server decorator API that all
# of backend/tools/ uses and changed ClientSession read_timeout_seconds from
# timedelta to float. Upstream's guidance for anyone not ready to migrate is to
# stay on 1.x, which is in maintenance mode.

cffi>=2.0.0,<3
fastapi>=0.110,<1
uvicorn>=0.29,<1
httpx>=0.27,<1
google-api-python-client>=2.0,<3
google-auth-oauthlib>=1.0,<2
mcp>=1.29,<2
chromadb>=0.5,<2
ollama>=0.2,<1
beautifulsoup4>=4.12,<5
playwright>=1.44,<2
boto3>=1.34,<2
sqlalchemy>=2.0,<3
sqlalchemy[asyncio]>=2.0,<3
asyncpg>=0.29,<1
psycopg2-binary>=2.9,<3
pymysql>=1.1,<2
pdfplumber>=0.10,<1
pandas>=2.0,<4
openpyxl>=3.1,<4
requests>=2.31,<3
anthropic>=0.28,<1
google-genai>=1.0,<3
pyinstrument>=4.6,<6
croniter>=2.0,<7
crawl4ai>=0.4,<1
arq>=0.26,<1
redis[hiredis]>=5.0,<9
async-timeout>=4.0,<6
pyyaml>=6.0,<7
