| 1 | a2wsgi==1.10.8 |
| 2 | ansio==0.0.1 |
| 3 | docker==7.1.0 |
| 4 | duckduckgo-search==6.1.12 |
| 5 | pyreqwest-impersonate==0.5.3 # freeze nearest wheel-backed release; 0.5.5 is source-only |
| 6 | faiss-cpu==1.11.0 |
| 7 | fastmcp==3.2.4 |
| 8 | fasta2a==0.5.0 |
| 9 | flask[async]==3.0.3 |
| 10 | flask-basicauth==0.2.0 |
| 11 | flaredantic==0.1.5 |
| 12 | GitPython==3.1.43 |
| 13 | giturlparse==0.14.0 |
| 14 | inputimeout==1.0.4 |
| 15 | json_repair==0.63.4 |
| 16 | kokoro>=0.9.2 |
| 17 | simpleeval==1.0.3 |
| 18 | langchain-core==0.3.49 |
| 19 | langchain-community==0.3.19 |
| 20 | langchain-unstructured==0.1.6 |
| 21 | liteparse==2.0.3 |
| 22 | litellm==1.88.1 # CVE-2026-42271 fix: patched floor is 1.83.7 |
| 23 | openai==2.41.1 |
| 24 | openai-whisper==20250625 |
| 25 | lxml_html_clean>=0.4.0 # CVE-2024-52595 fix: XSS CWE-79 CVSS 8.4 |
| 26 | markdown==3.7 |
| 27 | mcp==1.27.0 |
| 28 | newspaper3k==0.2.8 |
| 29 | paramiko==3.5.0 |
| 30 | patchright==1.61.2 |
| 31 | pypdf==6.0.0 |
| 32 | python-dotenv==1.1.0 |
| 33 | pytz==2024.2 |
| 34 | sentence-transformers==3.0.1 |
| 35 | tiktoken==0.8.0 |
| 36 | unstructured[all-docs]==0.16.23 |
| 37 | unstructured-client==0.31.0 |
| 38 | webcolors==24.6.0 |
| 39 | nest-asyncio==1.6.0 |
| 40 | crontab==1.0.1 |
| 41 | markdownify==1.1.0 |
| 42 | pydantic==2.11.7 |
| 43 | pymupdf==1.25.3 |
| 44 | pytesseract==0.3.13 |
| 45 | pdf2image==1.17.0 |
| 46 | crontab==1.0.1 |
| 47 | pathspec>=0.12.1 |
| 48 | psutil>=7.0.0 |
| 49 | soundfile==0.13.1 |
| 50 | imapclient>=3.0.1 |
| 51 | html2text>=2024.2.26 |
| 52 | beautifulsoup4>=4.12.3 |
| 53 | boto3>=1.35.0 |
| 54 | chardet<6 # unstructured may pull chardet; requests warns when chardet>=6 is present |
| 55 | exchangelib>=5.4.3 |
| 56 | pywinpty==3.0.2; sys_platform == "win32" |
| 57 | python-socketio>=5.14.2 |
| 58 | uvicorn>=0.38.0 |
| 59 | watchdog==6.0.0 |
| 60 | wsproto>=1.2.0 |
| 61 | # Security floor pins for transitive dependencies |
| 62 | # These packages are pulled transitively — floor pins prevent resolver regressions |
| 63 | Pillow>=10.2.0 # security floor: heap buffer overflow CWE-122, eval injection CWE-95, DoS CWE-400 |
| 64 | nltk>=3.9.3 # security floor: RCE CWE-94, code injection CWE-94 |
| 65 | h11>=0.16.0 # security floor: HTTP request smuggling CWE-444 |
| 66 | urllib3>=2.6.0 # security floor: resource exhaustion CWE-770, data amplification CWE-409 |
| 67 | cryptography>=46.0.0 # security floor: insufficient data authenticity CWE-345 |
| 68 | werkzeug>=3.0.3 # security floor: RCE CWE-94 |
| 69 | starlette==1.0.1 # security fix: Host header validation bypass GHSA-86qp-5c8j-p5mr |