fastapi>=0.115
uvicorn[standard]>=0.32
httpx>=0.27
python-dotenv>=1.0
itsdangerous>=2.2
pydantic>=2.9
anthropic>=0.39
google-generativeai>=0.8
openai>=1.50
PyYAML>=6.0
bcrypt>=4.2

# Security floors on unbounded *transitive* deps (not direct imports). osv-scanner
# resolves an unpinned transitive package to its MINIMUM PyPI version, which surfaces
# CVEs in ancient releases pip would never actually install. These floors keep the
# Patchwatch radar (and any scan) anchored to the patched range.
#   tqdm <- google-generativeai ; GHSA-r7q7-xcjw-qx8q et al., fixed in 4.66.3
#   idna <- httpx / anthropic   ; GHSA-65pc-fj4g-8rjx,        fixed in 3.15
tqdm>=4.66.3
idna>=3.15