# Tested dependency versions (pip constraints). run.sh and deploy/Dockerfile install with:
#   pip install -r requirements.txt -c constraints.txt
# AlphaTown supports Python 3.13 only. These pins are the versions the full test suite passed with on Python 3.13.7,
# 2026-10-08. Newer major versions (pandas 3, anthropic 1.x …) are not yet tested — update these pins
# only together with a full test run on Python 3.13.
# Security upgrades 2026-10-08 (pip-audit clean on PyPI's advisory data — for the packages pinned here only, not the
# bundled Python interpreter or pip): pillow 11.3.0 → 12.3.0, starlette 0.49.3 → 1.3.1 (needs fastapi 0.128.8 →
# 0.133.1; 0.133 is the first FastAPI line that allows Starlette 1.x), anyio 4.12.1 → 4.14.2, python-dotenv 1.2.1 →
# 1.2.2, pytest 8.4.2 → 9.0.3 (with pytest-asyncio 1.2.0 → 1.3.0, the first that allows pytest 9). The three major
# steps have no fix on the old line: pillow 11.x ends at 11.3.0, starlette 0.x ends at 0.52.1 (still affected), pytest
# 8.x ends at 8.4.2. pillow 12.3.0 has cp313 wheels for macosx_11_0_arm64,
# manylinux_2_27_aarch64.manylinux_2_28_aarch64 (needs glibc ≥ 2.27; pillow 11.3.0 also had a manylinux_2_17 wheel)
# and win_amd64; the rest are pure-Python wheels. scripts/check_deps.py compares an environment with these pins (run.sh
# on a linked .venv, desktop/build.sh on the site-packages it bundles, tests/test_deps_compat.py on the test run).
# python-multipart 0.0.32 includes the fixes for the multipart DoS advisories (GHSA-mj87-hwqh-73pj,
# GHSA-pp6c-gr5w-3c5g and others fixed in 0.0.22–0.0.31).
# PyMySQL 1.2.3 (数据接口 · MySQL / MariaDB, added 2026-10-06): the connector's plaintext-auth guards use its
# private auth methods — change this pin only together with tests/test_cn_mysql_fake.py and a full test run.
annotated-doc==0.0.5
annotated-types==0.7.0
anthropic==0.125.0
anyio==4.14.2
certifi==2026.7.22
charset-normalizer==3.5.2
click==8.1.8
distro==1.9.0
docstring_parser==0.18.0
fastapi==0.133.1
h11==0.16.0
httpcore==1.0.9
httptools==0.8.0
httpx==0.28.1
idna==3.20
iniconfig==2.1.0
jiter==0.16.0
numpy==2.2.6
packaging==26.3
pandas==2.3.3
pillow==12.3.0
pluggy==1.6.0
pydantic==2.13.5
pydantic_core==2.46.5
Pygments==2.21.0
PyMySQL==1.2.3
pypdf==6.19.0
pytest==9.0.3
pytest-asyncio==1.3.0
python-dateutil==2.9.0.post0
python-dotenv==1.2.2
python-multipart==0.0.32
pytz==2026.5
PyYAML==6.0.3
reportlab==5.0.1
six==1.17.0
sniffio==1.3.1
starlette==1.3.1
typing-inspection==0.4.2
typing_extensions==4.16.0
tzdata==2026.5
uvicorn==0.39.0
uvloop==0.23.0
watchfiles==1.1.1
websockets==15.0.1
