# requirements.txt — Lumen Bot
# Python 3.10+
#
# NOTE: versions are pinned with == (not >=) because HF Spaces rebuilds the
# Docker image from scratch on every deploy — without an upper bound a fresh
# `pip install` could silently pull a new major with breaking API changes.
# This matters most for google-genai, whose API (types.GoogleSearch,
# types.GoogleMaps, types.UrlContext, etc.) is used heavily in bot.py and
# has changed between majors. Bumping a version here is a deliberate decision
# followed by a /diag check plus a manual smoke test of the main commands,
# never a side effect of a random redeploy.
#
# UPDATED (dependency audit, 2026-08-16) — all packages raised to the PyPI
# versions current at the time, each changelog checked for breaking changes
# against the API actually used in bot.py (see commit history).
# aiohttp/mutagen/pytest/pyflakes were already latest — left untouched.
# UPDATED AGAIN (tech-debt audit, 2026-09-07) — aiogram/google-genai/
# sentry-sdk/uvicorn had lagged a few minor releases (no known CVEs per
# pip-audit); raised to the stable versions current at the time.
# fastapi/aiohttp/mutagen/tzdata were already latest — untouched.
# Full suite (390 tests) passed under the new versions with zero code changes —
# that does not cover live API behavior (Gemini/Telegram), so a manual
# /diag + main-commands smoke test is still due before deploy.
aiohttp==3.14.3
aiogram==3.31.0
fastapi==0.141.1
google-genai==2.24.0
mutagen==1.48.1
uvicorn==0.53.0
# tzdata — python:3.13-slim (see Dockerfile) ships no system timezone database
# via apt, while stdlib zoneinfo (used in _current_quota_day for the daily
# quota reset on America/Los_Angeles — Google's midnight for RPD limits)
# raises ZoneInfoNotFoundError without it. The code already falls back to UTC
# safely (see try/except in _current_quota_day), but then the quota reset
# drifts 7-8 hours off Google's real reset — with this package it lands right.
# Pure-pip IANA tzdb data, no compilation — does not bloat the image.
tzdata==2026.4
# sentry-sdk — optional (see SENTRY_DSN in bot.py) persistent error tracking:
# bot.log lives on the ephemeral HF Spaces disk and is lost on every redeploy
# (see README, "Known limitations" — that used to be the only open item there).
# Without SENTRY_DSN, sentry_sdk.init() is never called — the package just
# sits unused and changes nothing for whoever did not configure it.
sentry-sdk==2.69.2