# ---------------------------------------------------------------------------
# Runtime dependencies.
# Pinned with compatible-release specifiers so patch level security fixes are
# picked up while the API surface stays stable.
# ---------------------------------------------------------------------------

# Core framework
Django~=5.1.0
djangorestframework~=3.15.2
django-filter~=24.3

# Configuration & environment
django-environ~=0.11.2

# Database
psycopg[binary]~=3.2.3

# Authentication / authorisation
djangorestframework-simplejwt~=5.3.1
argon2-cffi~=23.1.0

# API schema & interactive documentation.
# The sidecar ships the Swagger UI / ReDoc bundles as static files.  Without
# it drf-spectacular points the browser at cdn.jsdelivr.net, which the CSP in
# frontend/nginx.conf ("script-src 'self'") blocks, leaving a blank page - and
# the CDN URL is pinned to "@latest", which is a supply-chain risk in its own
# right.  Self-hosting fixes both and lets the docs work air-gapped.
drf-spectacular~=0.27.2
drf-spectacular-sidecar~=2026.9.1

# Cross origin access for the SPA
django-cors-headers~=4.4.0

# Cache / throttle backend
redis~=5.1.1
django-redis~=5.4.0

# Search engine client
elasticsearch~=8.15.1

# Observability: ship structured logs to Logstash without blocking requests
python-logstash-async~=4.0

# Serving
gunicorn~=23.0.0
whitenoise~=6.7.0