# Candidate v0.5 stack. Build and install the audited Cognee wheel with
# scripts/build_secure_cognee.py before resolving this file. The source wheel
# carries the reviewed one-line cryptography metadata correction.
cognee[fastembed]==1.4.1
ladybug==0.18.2
fastapi>=0.116.2,<1.0.0
google-auth>=2.40.0,<3.0.0
aiohttp>=3.14.3,<4.0.0
cryptography==50.0.0
mcp>=1.28.1,<2.0.0
pydantic>=2.10.5,<3.0.0
python-dotenv>=1.0.1,<2.0.0
qdrant-client==1.19.0
requests>=2.32.0,<3.0.0
starlette>=1.3.1,<2.0.0
# Real tokenizer for BGE chunk sizing; without it cognee's resolver falls back
# to approximate TikToken counts and mis-sizes every chunk.
transformers==5.15.0
# Freeze the verified companion set: hub 1.x and tokenizers<=0.23.0 are what
# transformers 5.15.0 resolves and what fastembed 0.8.0 was verified against.
huggingface-hub==1.27.0
tokenizers==0.22.2
tiktoken==0.13.0
uvicorn[standard]>=0.34.0,<1.0.0

# Transitive via cognee, which requires it unconstrained. Ten CVEs were
# disclosed against 0.59.0; the highest fix among them is 0.64.0. A floor here
# keeps the Railway install matching what CI audits, since this file is the
# deploy path and uv.lock is not. No conflict is possible: cognee sets no upper
# bound.
datamodel-code-generator>=0.64.0
