Spaces:
Running
Running
| # requirements.txt — Lumen Bot | |
| # Python 3.10+ | |
| # | |
| # NOTE: versions are pinned with == (not >=) because HF Spaces rebuilds the | |
| # Docker image from scratch on every deploy — without an upper bound a fresh | |
| # `pip install` could silently pull a new major with breaking API changes. | |
| # This matters most for google-genai, whose API (types.GoogleSearch, | |
| # types.GoogleMaps, types.UrlContext, etc.) is used heavily in bot.py and | |
| # has changed between majors. Bumping a version here is a deliberate decision | |
| # followed by a /diag check plus a manual smoke test of the main commands, | |
| # never a side effect of a random redeploy. | |
| # | |
| # UPDATED (dependency audit, 2026-08-16) — all packages raised to the PyPI | |
| # versions current at the time, each changelog checked for breaking changes | |
| # against the API actually used in bot.py (see commit history). | |
| # aiohttp/mutagen/pytest/pyflakes were already latest — left untouched. | |
| # UPDATED AGAIN (tech-debt audit, 2026-09-07) — aiogram/google-genai/ | |
| # sentry-sdk/uvicorn had lagged a few minor releases (no known CVEs per | |
| # pip-audit); raised to the stable versions current at the time. | |
| # fastapi/aiohttp/mutagen/tzdata were already latest — untouched. | |
| # Full suite (390 tests) passed under the new versions with zero code changes — | |
| # that does not cover live API behavior (Gemini/Telegram), so a manual | |
| # /diag + main-commands smoke test is still due before deploy. | |
| aiohttp==3.14.3 | |
| aiogram==3.31.0 | |
| fastapi==0.141.1 | |
| google-genai==2.24.0 | |
| mutagen==1.48.1 | |
| uvicorn==0.53.0 | |
| # tzdata — python:3.13-slim (see Dockerfile) ships no system timezone database | |
| # via apt, while stdlib zoneinfo (used in _current_quota_day for the daily | |
| # quota reset on America/Los_Angeles — Google's midnight for RPD limits) | |
| # raises ZoneInfoNotFoundError without it. The code already falls back to UTC | |
| # safely (see try/except in _current_quota_day), but then the quota reset | |
| # drifts 7-8 hours off Google's real reset — with this package it lands right. | |
| # Pure-pip IANA tzdb data, no compilation — does not bloat the image. | |
| tzdata==2026.4 | |
| # sentry-sdk — optional (see SENTRY_DSN in bot.py) persistent error tracking: | |
| # bot.log lives on the ephemeral HF Spaces disk and is lost on every redeploy | |
| # (see README, "Known limitations" — that used to be the only open item there). | |
| # Without SENTRY_DSN, sentry_sdk.init() is never called — the package just | |
| # sits unused and changes nothing for whoever did not configure it. | |
| sentry-sdk==2.69.2 | |