# exact pins on purpose: curl_cffi behavior = impersonation behavior; an
# unpinned bump is a silent upstream-403 wave. Bump one at a time, re-run
# the upstream self-check (.venv/bin/python server/upstream.py) per bump.
fastapi==0.141.1
uvicorn==0.52.4
curl_cffi==0.16.0
itsdangerous==2.2.0

# tests
pytest==9.1.1
playwright==1.62.0