requirements.txt

# --- Index URLs ---
--extra-index-url https://download.pytorch.org/whl/cpu

# --- Core ML & Computer Vision (CPU Versions) ---
torch>=2.1.0
torchvision>=0.16.0
torchaudio>=2.1.0

# --- Data Science Stack ---
numpy>=1.26.0
pandas>=2.1.1
scikit-learn>=1.3.0
matplotlib>=3.7.0
seaborn>=0.12.0
pytz>=2023.3
# pandas.read_excel() engines: xlrd for legacy .xls, openpyxl for .xlsx
# (used by BioAnalyzerCLI._read_excel_via_docker for --file <xls/xlsx>)
xlrd>=2.0.1
openpyxl>=3.1.0

# --- NLP & LLM Ecosystem ---
tiktoken>=0.5.0
google-generativeai>=0.7.2
# litellm 1.98.0 does `from typing import NotRequired` in
# llms/anthropic/experimental_pass_through/context_management/editors/compact.py,
# which only exists in stdlib typing on Python >=3.11 - `import litellm` raises
# ImportError on 3.10 (upstream bug from commit 6b5249bc). Cap below it until fixed.
litellm>=1.83.7,<1.98.0
paper-qa>=5.0.0
# Transitive deps (google-generativeai -> google-auth -> cryptography;
# paper-qa -> paper-qa-pypdf -> pypdf); pinned explicitly to versions
# without known CVEs (GHSA-537c-gmf6-5ccf; CVE-2026-54530/54531).
cryptography>=48.0.1
pypdf>=6.13.3

# --- Vector Database ---
qdrant-client>=1.7.0

# --- Local ontology store (app/normalization/grounding/local_backend.py) ---
# Offline SQLite/DuckDB-backed grounding backend; imported lazily and falls
# back to Python's stdlib sqlite3 if unavailable, so this is declared for
# full DuckDB-backed local grounding support but isn't a hard runtime
# requirement - see local_backend.py's module docstring.
duckdb>=1.1.0

# --- Web Framework & API ---
fastapi>=0.104.0
uvicorn[standard]>=0.23.2
starlette>=1.3.1
pydantic>=2.4.2
# Transitive dep of paper-qa; pinned explicitly to a version without known
# CVEs (GHSA-4xgf-cpjx-pc3j) since paper-qa's own constraint allows older.
pydantic-settings>=2.14.2

# --- Networking & Web Scraping ---
requests>=2.31.0
aiohttp>=3.14.1
beautifulsoup4>=4.12.2
defusedxml>=0.7.1
# Transitive dep of fastapi/streamlit (form-data parsing); pinned explicitly
# to a version without known CVEs since neither's own constraint requires it.
python-multipart>=0.0.31

# --- File Processing ---
python-dotenv>=1.2.2
PyYAML>=5.4.1

# --- Utilities ---
psutil>=5.9.0
word2number>=1.1

# --- Curator table (Streamlit) ---
streamlit>=1.28.0
pyarrow>=14.0.0

# --- Test-only (used by tests/, not by app/ runtime code) ---
pytest-asyncio>=0.21.0
sentence-transformers>=2.2.0