# Python code quality tools
# Pin versions for reproducible builds

ruff==0.14.10
mypy==1.13.0
pytest==8.3.4
pytest-cov==6.0.0
pytest-mock==3.15.1
pytest-asyncio==0.24.0

# Type stubs and runtime deps needed for mypy to check optional modules
# (pinned for reproducibility)
types-requests==2.32.0.20250602
pydantic==2.10.4
# FastAPI 0.128.0 includes starlette fixes for:
# - CVE-2025-54121 (GHSA-2c2j-9gv5-cj73) - DoS via multipart forms
# - CVE-2025-62727 (GHSA-7f5h-v6xp-fcq8) - DoS via Range header merging
fastapi==0.128.0
httpx==0.28.1

# Security: Pin filelock to fix GHSA-qmgc-5h2g-mvrw
# Minimum version 3.20.3 required for security fix
filelock>=3.20.3

# Security scanning tools
pip-audit==2.7.3
safety==3.7.0
bandit==1.8.0
