# Pinned to exact versions for reproducible builds — no silent dependency drift
# on every `docker compose up --build`. To update: bump a version here on purpose,
# run `pip-audit` against the result, and test. For supply-chain integrity, the
# next step is a hashed lockfile (`pip-compile --generate-hashes` → install with
# `pip install --require-hashes`).
fastapi==0.138.1
uvicorn[standard]==0.49.0
gunicorn==26.0.0
sqlalchemy==2.0.51
alembic==1.18.5             # database migrations
psycopg[binary]==3.3.4
pymssql==2.3.13             # read-only lookups against the Micron asset DB (SQL Server).
                            # Chosen over pyodbc because it ships self-contained wheels —
                            # pyodbc would also need msodbcsql18 + unixODBC installed in
                            # the image. To use pyodbc instead, add it here, install the
                            # Microsoft ODBC driver in the Dockerfile, and switch
                            # MICRON_DB_URL to mssql+pyodbc://…?driver=ODBC+Driver+18+for+SQL+Server
pydantic==2.13.4
python-dotenv==1.2.2
bcrypt==5.0.0               # password hashing
PyJWT==2.13.0              # signed session tokens
starlette==1.3.1           # pinned transitive (cookie / CORS handling — security-relevant)