# Pinned to a minor, not left open. Unpinned, the SAME middleware code
# deadlocked every POST on starlette 0.27.0, returned 500 on every POST on
# 0.36.3, and worked on 1.6.0 - so a developer machine, CI and a fresh
# install each got different behaviour from one commit, and a Docker build
# rolled the dice at exactly the moment of deploying. This range is what CI
# resolves and tests against.
fastapi>=0.110,<0.111
starlette>=0.36,<0.37
uvicorn
pydantic
python-multipart
PyYAML
pyflakes>=3.2.0,<4
# Phase 3 promotes ruff's undefined-name findings (F811/F821/F822/F823) to
# blockers. Without ruff those checks are skipped and the run says so, but it
# checks nothing -- so it is a runtime dependency of the backend, not just a
# CI tool. The Dockerfile installs it from this file, so Docker and non-Docker
# deploys share this one pin and see the same rule semantics.
ruff==0.16.6
deep_translator
bocl == 1.0.3
cryptography
openpyxl >= 3.1.0
openai >= 1.40.0
# Governance DSL parser for governed merging gateways (Docker Compose swarms).
# It depends on besser itself (besser>=6.5.2) and on
# antlr4-python3-runtime==4.13.1, which the root requirement
# antlr4-python3-runtime>=4.13.1 admits. Install it after the local besser
# (the Dockerfile does) so pip never pulls besser from PyPI.
governancedsl==0.1.1
# The Spec-Driven Agent's Claude client; 1.x changes the SDK surface.
anthropic >= 0.88.0, < 1
websockets >= 15.0
