# FastAPI & ASGI
fastapi==0.115.6          # >=0.115.3 fixes starlette multipart DoS (CVE-2024-47874)
uvicorn[standard]==0.34.0
python-multipart==0.0.32  # form parser. NOTE: no endpoint accepts multipart/form-data
                          # or file uploads (verified 2026-08-03), so its advisories
                          # -- arbitrary file write, unbounded-header DoS, quadratic
                          # querystring -- are unreachable in this application.

# Database
sqlalchemy==2.0.36
aiomysql==0.3.2           # 0.2.0 allowed arbitrary client file read via a malicious
                          # MySQL server (LOAD DATA LOCAL INFILE class). Low probability
                          # but the host is a SHARED Hostinger account.
                          # database.py monkeypatches Connection.ensure_closed -- see
                          # the comment there; re-verify against any future bump.
pymysql==1.1.1            # fixes SQL injection via crafted dates (CVE-2024-36039)
cryptography==50.0.1      # the reachable advisory is the vulnerable OpenSSL bundled in
                          # the wheels (affects TLS). PKCS#7 enveloped-data decryption
                          # and SECT-curve validation are not used anywhere here.
alembic==1.14.0

# Redis
redis==8.1.0
# aioredis removed — merged into redis-py 4.2+ and unmaintained since 2022

# celery removed 2026-08-17 with app/tasks/ — see docker-compose.yml. The beat schedule
# was commented out and the one live caller was dispatching into a broker that does not
# exist. redis-py stays: utils/rate_limiter still uses it.

# Validation & Serialization
pydantic==2.10.4
pydantic-settings==2.7.0
email-validator==2.2.0    # backs pydantic EmailStr

# HTTP Client
httpx==0.28.1
aiohttp==3.14.3           # NOT imported by this codebase -- it is a hard dependency of
                          # geoip2 (aiohttp <4.0.0,>=3.6.2), so it cannot be removed;
                          # the explicit pin is how its version stays under our control.
                          # Closes the client-side advisories that DO apply to feed
                          # fetching in principle: auto_decompress zip bomb, OOB heap
                          # read in the C response parser, and WebSocket accepting
                          # non-negotiated compressed frames.

# Enrichment
python-whois==0.9.6
dnspython==2.7.0
geoip2==4.8.0
# shodan==1.31.0  # Optional - not compatible with Vercel serverless (no binary wheels)

# Security
pyjwt==2.13.0             # replaces python-jose (unmaintained; CVE-2024-33663/33664).
                          # 2.13.0 closes CVE-2026-48526 (algorithm confusion) and the
                          # unknown-`crit`-header issue. Neither was exploitable here:
                          # the sole jwt.decode site passes algorithms=[JWT_ALGORITHM],
                          # a ONE-element list, and the CVE needs a symmetric AND an
                          # asymmetric algorithm in the same list plus a raw-JSON JWK
                          # as key=. The key here is a SECRET_KEY string.
passlib[bcrypt]==1.7.4
bcrypt==4.2.1

# STIX
stix2==3.0.1

# Utilities
python-dotenv==1.2.2
structlog==24.4.0
tenacity==9.0.0
croniter==6.0.0
jinja2==3.1.6             # fixes sandbox breakouts in <3.1.5

# REMOVED 2026-07-31 (owner decision): weasyprint==63.1 and pandas==2.2.3.
#
# Neither was imported anywhere in the codebase, and nothing generates a PDF at all -
# verified by grep across the repo. So they were not "heavy imports to defer", they were
# pure build and cold-start cost for capability that does not exist:
#
#   * weasyprint pulls cairo and pango as system libraries, on every build, against a
#     500-minute pipeline budget, for a PDF export feature that has never been written;
#   * pandas pulls numpy - the largest single install in this file - with no usage story
#     at all. The "# CSV parsing" heading it sat under was aspirational: exports are built
#     with the stdlib `csv` module in api/ioc.py.
#
# Add weasyprint back when PDF export is actually built. A heavy dependency for a
# hypothetical feature costs every build and every cold start on a 512 MB instance.
#
# tests/test_phase5_performance.py::TestHeavyDependenciesAreUnused fails the moment
# either package is imported, so re-adding one without also declaring it is caught.

# AI
groq>=0.13.0
