# Upper bounds are deliberate. Every line here was `>=` with no ceiling, so a
# fresh `pip install -r requirements.txt` resolved to whatever was newest that
# day — and several already crossed a major release without anyone choosing to:
# textual 0.61 -> 8.2, starlette 0.37 -> 1.3, pytest 8 -> 9. Nothing broke, but
# nothing prevented it either; the failure would have been at runtime, not at
# install.
#
# The floors are unchanged (they exclude nobody who works today). The ceilings
# are the next major above a set verified green: 177 tests passing, 2026-07-27.
# Raise one deliberately when you have run against it.

textual>=0.61.0,<9
psycopg2-binary>=2.9.0,<3
cryptography>=42.0.0,<50
aiohttp>=3.9.0,<4

# Floor raised to match willow-mcp's own pin (`mcp>=1.28.1,<2.0.0`). Grove and
# willow-mcp speak the same protocol to each other, so they should not be able
# to resolve to different SDK majors. The MCP 2026-07-28 revision is the largest
# since launch and breaks the handshake, session IDs and the version string, so
# an unbounded pin here was a live risk rather than a theoretical one.
mcp>=2.0.0,<3.0.0

starlette>=0.37.0,<2
uvicorn>=0.30.0,<1
pytest>=8.0.0,<10
