parahub/requirements.txt at master · parahub-io/parahub · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
Django==5.2.16           # was 5.2.15 — HIGH (GDALRaster over-read, cache Vary, DomainNameValidator)
psycopg2-binary==2.9.12
django-environ==0.11.2
python-ulid==3.1.0
django-cors-headers==4.9.0
channels==4.3.2
# daphne removed 2026-06-19 — unused (not in INSTALLED_APPS, ASGI server is uvicorn);
# it was the only path to twisted's HIGH CVEs. channels runs under uvicorn via parahub.asgi.
redis==7.2.1
Pillow==12.3.0
django-storages==1.14.6
uvicorn[standard]==0.50.0
whitenoise==6.12.0
django-extensions==3.2.3
python-decouple==3.8
cryptography==49.0.0
django-allauth==65.18.0

# Django Ninja API Framework
django-ninja==1.6.2
django-ninja-jwt==5.4.4
pydantic>=2.0.0

# PGP Cryptography
python-gnupg==0.5.6  # Replaced pgpy (doesn't support SHA-256)

# Additional security & validation
pydantic-settings==2.14.2

# Social authentication providers
django-allauth[socialaccount]==65.18.0

# OIDC Provider
django-oauth-toolkit==3.3.0
jwcrypto==1.5.8

# HTTP client for async requests (Matrix integration)
httpx==0.28.1

# Neo4j Graph Database for Barter Exchange Matching
neo4j==6.2.0
coolname==2.2.0

# Web Push Notifications
pywebpush==2.3.0

# Para-ID Badge Generation
reportlab==4.5.1
qrcode==8.2

# Language detection + GeoIP for market filtering
langdetect==1.0.9
geoip2==5.2.0

# AI/ML APIs (Zenith assistant, AI Vision)
google-genai==2.8.0
google-cloud-vision==3.14.0
anthropic==0.109.1
openai==2.41.0
nh3==0.3.5

# ── Security pins: transitive deps with critical/high CVEs (triaged 2026-06-19) ──
# Floors to clear Dependabot critical/high; parents don't yet pull fixed versions.
# Removed instead of bumped (dead, unreachable in prod): starlette (orphan),
# twisted+daphne+autobahn (daphne unused; prod ASGI server is uvicorn) — see git log.
pyjwt==2.13.0             # was 2.10.1 — HIGH (auth: django-ninja-jwt)
urllib3==2.7.0           # was 2.6.3 — HIGH (via requests)
python-multipart==0.0.31  # was 0.0.22 — HIGH (multipart uploads)
gitpython==3.1.55        # was 3.1.50 — HIGH (OTS audit)
lxml==6.1.0              # was 6.0.2 — HIGH
Mako==1.3.12             # was 1.3.10 — HIGH
nltk==3.9.4              # was 3.9.3 — HIGH; PYSEC-2026-597 open upstream, no fixed release
pyasn1==0.6.4            # was 0.6.3 — HIGH
tornado==6.5.7           # was 6.5.2 — HIGH

# ── moderate/low CVEs (triaged 2026-06-19) ──
aiohttp==3.14.1          # was 3.13.3 — MODERATE (via geoip2/pywebpush)
idna==3.15               # was 3.10 — MODERATE (via requests/httpx)
requests==2.33.0         # was 2.32.4 — MODERATE
python-dotenv==1.2.2     # was 1.1.1 — MODERATE (via pydantic-settings)
pygments==2.20.0         # was 2.19.2 — LOW
# rembg removed (orphan, unused) — cleared its MODERATE; pip upgraded in venv (MODERATE)