requirements.txt

# RAG Support Assistant — dependencies
# Install: python -m pip install -r requirements.txt

# === Core RAG ===
# langchain: floor at 1.3.9 clears PYSEC-2026-2192.
langchain>=1.3.9
# langchain-core: pinned >=1.3.3 to clear CVE-2026-44843 (was resolving to 1.3.2).
langchain-core>=1.3.3
langchain-community>=0.2.0
# Primary Ollama integration; avoids deprecated langchain_community fallback.
langchain-ollama>=1.0.0
langgraph>=0.1.0
# langsmith: floor at 0.8.18 clears GHSA-f4xh-w4cj-qxq8 (and earlier CVE-2026-45134).
langsmith>=0.8.18

# === Vector Store ===
langchain-chroma>=0.1.0
# chromadb: keep latest available while CVE-2026-45829 has no fixed_in release.
chromadb>=1.5.9

# === Embeddings (Level 1: BGE-M3 multilingual) ===
sentence-transformers>=2.5.0

# === Hybrid Search: BM25 keyword retrieval ===
rank-bm25>=0.2.2

# === Reranker: cross-encoder for post-retrieval reranking ===
# (uses sentence-transformers, no extra package needed)

# === Document Loaders ===
# Floor at 6.13.3: clears GHSA-jm82-fx9c-mx94 (and earlier CVE-2026-48155/48156).
# PDF parsing handles untrusted uploads.
pypdf>=6.13.3
python-docx>=1.0.0
langdetect>=1.0.9

# === Web Framework ===
# Floor 0.138.1: include_router no longer flattens nested route path_format.
# Metric labels used to drop the router prefix under 0.138+; production fix is
# api/app.py::_route_mount_prefix (version-agnostic). Lock stayed on 0.136.1
# until that fix landed; raise the floor so CI matches the verified runtime.
fastapi>=0.138.1
uvicorn[standard]>=0.20.0
pydantic>=2.0.0
jinja2>=3.1.0
itsdangerous>=2.2.0
prometheus-client>=0.20.0
# starlette: floor at 1.3.1 clears PYSEC-2026-248/249/2280/2281 (via fastapi).
starlette>=1.3.1

# === Text Splitting ===
langchain-text-splitters>=0.2.0
langchain-experimental>=0.0.50

# === Web Server extras ===
# python-multipart: floor at 0.0.31 clears PYSEC-2026-3036/3037/3040.
python-multipart>=0.0.31
sqlalchemy[asyncio]>=2.0.0
asyncpg>=0.29.0
psycopg2-binary>=2.9.0
redis[hiredis]>=5.0.0
celery[redis]>=5.3.0
alembic>=1.13.0

# === Rate Limiting ===
slowapi>=0.1.9

# === HTTP client (health checks) ===
httpx>=0.24.0
requests>=2.32.0
# idna: pinned >=3.15 to clear CVE-2026-45409 (transitive via requests/httpx).
idna>=3.15
# urllib3: pinned >=2.7.0 to clear PYSEC-2026-141 / PYSEC-2026-142 (transitive via requests/httpx).
urllib3>=2.7.0
# aiohttp: floor at 3.14.1 clears CVE-2026-54273..54280 (was resolving to 3.14.0).
aiohttp>=3.14.1
# cryptography: floor at 48.0.1 clears GHSA-537c-gmf6-5ccf (lock may resolve newer).
cryptography>=48.0.1
# setuptools: floor at 83.0.0 clears PYSEC-2026-3447 (transitive build/runtime dep).
setuptools>=83.0.0
PyJWT>=2.8.0
passlib[bcrypt]>=1.7.4
authlib>=1.3.0
langfuse>=2.0.0
python-telegram-bot>=21.0
opentelemetry-api>=1.27.0
opentelemetry-sdk>=1.27.0
opentelemetry-exporter-otlp>=1.27.0
opentelemetry-instrumentation-fastapi>=0.48b0
opentelemetry-instrumentation-httpx>=0.48b0
opentelemetry-instrumentation-sqlalchemy>=0.48b0
opentelemetry-instrumentation-redis>=0.48b0

# === Optional: Qdrant ===
# langchain-qdrant>=0.1.0
# qdrant-client>=1.7.0

# === Optional: HuggingFace embeddings (alternative) ===
# langchain-huggingface>=0.0.1