# starlette is pinned explicitly, not just inherited from fastapi's range: the
# versions fastapi would otherwise accept include ones with published advisories
# (notably a FileResponse Range-header CPU DoS, which matters because / and the
# static assets are publicly reachable).
fastapi==0.141.1
starlette==1.6.0
uvicorn[standard]==0.52.4
pydantic==2.13.4
# Needed for multipart photo uploads. 0.0.20 carried advisories; 0.0.32 is clean.
python-multipart==0.0.32