From cbfb2f96c8d1e636aae2b85e7ea0897dee89cb10 Mon Sep 17 00:00:00 2001
From: Josue Zamudio <josuezamudio1@gmail.com>
Date: Wed, 16 Sep 2026 02:41:25 +0000
Subject: [PATCH] pin exact dependency versions: curl_cffi impersonation churn
 must never update silently

---
 requirements.txt | 36 +++++++++---------------------------
 1 file changed, 9 insertions(+), 27 deletions(-)

diff --git a/requirements.txt b/requirements.txt
index db1dd26..45b5e24 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,29 +1,11 @@
-# Full freeze of the runtime env (2026-09-15) — curl_cffi version churn =
-# impersonation churn = silent upstream 403 waves, so nothing here floats;
-# bump deliberately (uv pip install --python .venv/bin/python -r requirements.txt).
-annotated-doc==0.0.5
-annotated-types==0.8.0
-anyio==4.14.2
-certifi==2026.7.22
-cffi==2.1.1
-click==8.4.2
-curl-cffi==0.16.0
+# exact pins on purpose: curl_cffi behavior = impersonation behavior; an
+# unpinned bump is a silent upstream-403 wave. Bump one at a time, re-run
+# the upstream self-check (.venv/bin/python server/upstream.py) per bump.
 fastapi==0.141.1
-greenlet==3.5.5
-h11==0.16.0
-idna==3.19
-iniconfig==2.3.0
-itsdangerous==2.2.0
-packaging==26.3
-playwright==1.62.0
-pluggy==1.6.0
-pycparser==3.0
-pydantic==2.13.4
-pydantic-core==2.46.4
-pyee==13.0.1
-pygments==2.21.0
-pytest==9.1.1
-starlette==1.6.0
-typing-extensions==4.16.0
-typing-inspection==0.4.4
 uvicorn==0.52.4
+curl_cffi==0.16.0
+itsdangerous==2.2.0
+
+# tests
+pytest==9.1.1
+playwright==1.62.0