fastapi==0.141.1
starlette==1.3.1
uvicorn[standard]==0.30.6
# Observability
prometheus-client==0.21.0
# prometheus-fastapi-instrumentator removed 2026-08-02: never imported (metrics.py
# uses prometheus_client directly), and its starlette<1.0.0 pin blocked the
# starlette 1.3.1 upgrade that closes the remaining 2026 starlette CVEs.
sentry-sdk[fastapi]==2.19.0
sqlalchemy[asyncio]==2.0.35
asyncpg==0.29.0
alembic==1.13.3
pydantic==2.9.2
pydantic-settings==2.5.2
python-jose[cryptography]==3.4.0
# Pinned explicitly (not just riding on python-jose's transitive pull) — used
# directly by ams/security/aes_gcm.py for AES-256-GCM application-layer encryption.
cryptography==49.0.0
passlib[bcrypt]==1.7.4
bcrypt==4.0.1
pyotp==2.9.0
python-multipart==0.0.31
# starlette 0.41.3 (with fastapi 0.115.6, which relaxed its <0.39 pin) closes the
# 0.38.6 DoS/multipart CVEs — no FastAPI major bump needed. See SAST-REPORT.
redis==5.1.1
rq==1.16.2
boto3==1.35.28
openpyxl==3.1.5
qrcode[pil]==7.4.2
reportlab==4.2.0
Pillow==12.3.0
httpx==0.27.2
aiosmtplib==5.1.1
pytest==8.3.3
pytest-asyncio==0.24.0
pytest-cov==5.0.0
httpx==0.27.2
ruff==0.6.9
mypy==1.11.2
brother_ql==0.9.4
python-barcode==0.15.1