# Direct dependencies of the agent system, resolved from the code by parsing its
# imports. Not a freeze -- a freeze of this environment was not installable.
#
# There was no dependency manifest of any kind before this file. 200+ packages
# had been installed by hand with .venv gitignored, so a fresh clone could not
# run at all, and nothing flagged that pydantic-ai had sat on a version with
# four known CVEs since June.
#
# Verify the security posture with:
#     .venv/bin/pip-audit
# and add any fix version here. Known floors:
#     pydantic-ai      >=2.53.0   PYSEC-2026-4276, PYSEC-2026-4281
#     pydantic-ai-slim >=2.53.0   PYSEC-2026-4285, PYSEC-2026-4290
#
# gTTS is deliberately NOT listed here. It declares click<8.2 while gradio's
# huggingface-hub declares click>=8.4.2, and pip cannot solve both: listing it
# makes `pip install -r requirements.txt` fail for the entire file, which is
# exactly what happened to a fresh clone. gTTS uses click only for its own
# command line tool, so setup.sh installs it with --no-deps after this file.
# Do not "fix" the click floor by downgrading huggingface-hub -- faster-whisper,
# tokenizers and gradio all need it.
alpaca-py==0.44.0
ddgs==9.16.0
fastapi==0.141.1
faster-whisper==1.2.1
gradio==6.28.0
httpx==0.28.1
kokoro-onnx==0.4.7
Markdown==3.11
numpy==2.5.3
pillow==12.3.0
playwright==1.63.0
psutil==7.2.2
pydantic==2.13.5
# pydantic-ai requires one exact pydantic-ai-slim version, so let it pull that
# in. Pinning slim here as well only creates a second version that can drift.
pydantic-ai==2.57.0
pytest==9.1.1
schedule==1.2.2
soundfile==0.14.0
starlette==1.7.0
uvicorn==0.54.0
websocket-client==1.9.2
yfinance==1.7.0
youtube-transcript-api==1.2.4

# Transitive packages pinned to the versions pip-audit clears (see the audit note above).
aiohttp==3.14.4
authlib==1.9.1
brotli==1.2.1
certifi==2026.10.23
dnspython==2.9.0
filelock==4.2.1
joserfc==1.7.6
pyasn1==0.6.5
pypdf==6.20.0
opentelemetry-api==1.45.2
opentelemetry-sdk==1.45.2
opentelemetry-semantic-conventions==0.66b2
opentelemetry-instrumentation==0.66b2
opentelemetry-instrumentation-httpx==0.66b2
opentelemetry-exporter-otlp-proto-http==1.45.2
logfire==5.4.0
click==8.5.0
