aiohttp==3.14.5
aniso8601==9.0.1
annotated-types==0.8.0
anyio==4.14.2
appnope==0.1.4
APScheduler==3.11.3
argon2-cffi==23.1.0
argon2-cffi-bindings==21.2.0
asttokens==3.0.2
attrs==24.2.0
bcrypt==5.0.0
bidict==0.24.1
blinker==1.9.0
cachetools==7.1.7
# Not below 2026.10.19: older bundles still trust the emSign ECC Root CA - G3,
# removed after a CA key beneath it was compromised (GHSA-6q48-6c7w-9gw2).
certifi==2026.10.19
cffi==2.1.1
charset-normalizer==3.5.1
choreographer==1.3.0
click==8.5.0
colorama==0.4.6
comm==0.2.3
cryptography==50.0.1
darkdetect==0.8.0
debugpy==1.8.21
decorator==5.3.1
Deprecated==1.3.1
dnspython==2.9.0
duckdb==1.5.5
email-validator==2.3.0
executing==2.2.1
fastjsonschema==2.22.2
Flask==3.1.3
Flask-Bcrypt==1.0.1
Flask-Cors==6.0.5
Flask-Limiter==4.1.1
Flask-Login==0.6.3
flask-restx==1.3.2
Flask-SocketIO==5.6.1
Flask-SQLAlchemy==3.1.1
Flask-WTF==1.3.0
greenlet==3.5.5
h11==0.16.0
h2==4.4.1
hpack==4.2.0
httpcore==1.0.9
httpx[http2]==0.28.1
httpx-sse==0.4.3
hyperframe==6.1.0
idna==3.19
importlib-resources==6.5.2
iniconfig==2.3.0
ipykernel==6.29.5
ipython==9.16.1
ipython-pygments-lexers==1.1.1
itsdangerous==2.2.0
jedi==0.20.0
Jinja2==3.1.6
joserfc==1.7.4
jsonschema==4.26.0
jsonschema-specifications==2023.12.1
jupyter-client==8.9.1
jupyter-core==5.9.1
kaleido==1.3.0
limits==5.8.0
logistro==2.0.1
logzero==1.7.0
markdown-it-py==4.2.0
MarkupSafe==2.1.5
marshmallow==3.26.2
matplotlib-inline==0.2.2
mcp==1.30.0
mdurl==0.1.2
msgpack==1.2.3
multidict==6.9.1
opengreeks==0.2.0
narwhals==2.25.0
nbformat==5.11.1
nest-asyncio==1.6.0
numpy==2.4.4
openalgo==2.0.5
ordered-set==4.1.0
orjson==3.12.0
packaging==24.1
pandas==2.3.3
pyarrow==23.0.1
fastparquet==2025.12.0
parso==0.8.7
pexpect==4.9.0
# Not below 13.0.0: 12.3.0, the previous pin, is affected by 28 advisories
# (three critical) that only 13.0.0 fixes.
pillow==13.0.0
platformdirs==4.11.5
plotly==6.8.0
pluggy==1.6.0
prompt-toolkit==3.0.53
protobuf==6.33.5
psutil==7.2.2
ptyprocess==0.7.0
pure-eval==0.2.3
pycparser==2.22
pydantic==2.13.4
pydantic-core==2.46.4
pydantic-settings==2.15.0
Pygments==2.21.0
PyJWT==2.15.1
pyngrok==7.5.1
pyotp==2.10.0
pytest==9.1.1
pytest-timeout==2.4.0
python-dateutil==2.9.0.post0
python-dotenv==1.2.3
python-engineio==4.13.5
python-multipart==0.0.32
python-socketio==5.16.4
python-telegram-bot==22.8
wars==0.1.4
pytz==2026.3.post1
PyYAML==6.0.3
pyzmq==27.2.0
qrcode==8.2
referencing==0.37.0
requests==2.34.2
rich==13.7.1
rpds-py==0.30.0
setuptools==84.1.0
simple-websocket==1.1.0
simplejson==3.20.2
six==1.17.0
sniffio==1.3.1
SQLAlchemy==2.0.52
sse-starlette==3.4.8
stack-data==0.6.3
starlette==1.6.0
tornado==6.6
traitlets==5.16.1
typing-extensions>=4.12.2
typing-inspection>=0.4.1
tzdata==2026.3
tzlocal==5.4.4
urllib3==2.8.0
uvicorn==0.52.4
wcwidth==0.8.2
websocket-client==1.9.0
websockets==15.0.1
Werkzeug==3.1.9
wheel==0.48.0
wrapt==1.16.0
wsproto==1.3.2
WTForms==3.2.2
zipp==3.23.1

# Portfolio analytics for the Portfolio Backtester (metrics + tearsheets).
# Pure-NumPy kernels -- no Numba, so nothing pins numpy's upper bound.
openstatz==0.4.1

# The engine that runs a compiled OpenScript strategy on the server. Without it
# a native install shows the OpenScript editor but cannot run a strategy.
openscript==0.8.1

# The /agent module and the /trading agent side tab. They are imported only when
# someone uses the agent, so a missing package does not stop the app starting;
# it fails the first chat instead.
litellm==1.106.6
agno==3.0.5
ddgs>=9.16.0
