# starlette is pinned explicitly, not just inherited from fastapi's range: the
# versions fastapi would otherwise accept include ones with published advisories
# (notably a FileResponse Range-header CPU DoS, which matters because / and the
# static assets are publicly reachable).
fastapi==0.141.1
starlette==1.6.0
uvicorn[standard]==0.52.4
pydantic==2.13.4