a2wsgi==1.10.8
ansio==0.0.1
docker==7.1.0
duckduckgo-search==6.1.12
pyreqwest-impersonate==0.5.3  # freeze nearest wheel-backed release; 0.5.5 is source-only
faiss-cpu==1.11.0
fastmcp==3.2.4
fasta2a==0.5.0
flask[async]==3.0.3
flask-basicauth==0.2.0
flaredantic==0.1.5
GitPython==3.1.43
giturlparse==0.14.0
inputimeout==1.0.4
kokoro>=0.9.2
simpleeval==1.0.3
langchain-core==0.3.49
langchain-community==0.3.19
langchain-unstructured==0.1.6
liteparse==2.0.3
litellm==1.88.1  # CVE-2026-42271 fix: patched floor is 1.83.7
openai==2.41.1
openai-whisper==20250625
lxml_html_clean>=0.4.0  # CVE-2024-52595 fix: XSS CWE-79 CVSS 8.4
markdown==3.7
mcp==1.27.0
newspaper3k==0.2.8
paramiko==3.5.0
playwright==1.52.0
pypdf==6.0.0
python-dotenv==1.1.0
pytz==2024.2
sentence-transformers==3.0.1
tiktoken==0.8.0
unstructured[all-docs]==0.16.23
unstructured-client==0.31.0
webcolors==24.6.0
nest-asyncio==1.6.0
crontab==1.0.1
markdownify==1.1.0
pydantic==2.11.7
pymupdf==1.25.3
pytesseract==0.3.13
pdf2image==1.17.0
crontab==1.0.1
pathspec>=0.12.1
psutil>=7.0.0
soundfile==0.13.1
imapclient>=3.0.1
html2text>=2024.2.26
beautifulsoup4>=4.12.3
boto3>=1.35.0
chardet<6  # unstructured may pull chardet; requests warns when chardet>=6 is present
exchangelib>=5.4.3
pywinpty==3.0.2; sys_platform == "win32"
python-socketio>=5.14.2
uvicorn>=0.38.0
watchdog==6.0.0
wsproto>=1.2.0
# Security floor pins for transitive dependencies
# These packages are pulled transitively — floor pins prevent resolver regressions
Pillow>=10.2.0  # security floor: heap buffer overflow CWE-122, eval injection CWE-95, DoS CWE-400
nltk>=3.9.3  # security floor: RCE CWE-94, code injection CWE-94
h11>=0.16.0  # security floor: HTTP request smuggling CWE-444
urllib3>=2.6.0  # security floor: resource exhaustion CWE-770, data amplification CWE-409
cryptography>=46.0.0  # security floor: insufficient data authenticity CWE-345
werkzeug>=3.0.3  # security floor: RCE CWE-94
starlette==1.0.1  # security fix: Host header validation bypass GHSA-86qp-5c8j-p5mr
