# Pinned to exact versions for reproducible builds — no silent dependency drift
# on every `docker compose up --build`. To update: bump a version here on purpose,
# run `pip-audit` against the result, and test. For supply-chain integrity, the
# next step is a hashed lockfile (`pip-compile --generate-hashes` → install with
# `pip install --require-hashes`).
fastapi==0.138.1
uvicorn[standard]==0.49.0
gunicorn==26.0.0
sqlalchemy==2.0.51
alembic==1.18.5             # database migrations
psycopg[binary]==3.3.4
pydantic==2.13.4
python-dotenv==1.2.2
bcrypt==5.0.0               # password hashing
PyJWT==2.13.0              # signed session tokens
starlette==1.3.1           # pinned transitive (cookie / CORS handling — security-relevant)