47 lines
1.3 KiB
Plaintext
47 lines
1.3 KiB
Plaintext
# ---------------------------------------------------------------------------
|
|
# Runtime dependencies.
|
|
# Pinned with compatible-release specifiers so patch level security fixes are
|
|
# picked up while the API surface stays stable.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# Core framework
|
|
Django~=5.1.0
|
|
djangorestframework~=3.15.2
|
|
django-filter~=24.3
|
|
|
|
# Configuration & environment
|
|
django-environ~=0.11.2
|
|
|
|
# Database
|
|
psycopg[binary]~=3.2.3
|
|
|
|
# Authentication / authorisation
|
|
djangorestframework-simplejwt~=5.3.1
|
|
argon2-cffi~=23.1.0
|
|
|
|
# API schema & interactive documentation.
|
|
# The sidecar ships the Swagger UI / ReDoc bundles as static files. Without
|
|
# it drf-spectacular points the browser at cdn.jsdelivr.net, which the CSP in
|
|
# frontend/nginx.conf ("script-src 'self'") blocks, leaving a blank page - and
|
|
# the CDN URL is pinned to "@latest", which is a supply-chain risk in its own
|
|
# right. Self-hosting fixes both and lets the docs work air-gapped.
|
|
drf-spectacular~=0.27.2
|
|
drf-spectacular-sidecar~=2026.9.1
|
|
|
|
# Cross origin access for the SPA
|
|
django-cors-headers~=4.4.0
|
|
|
|
# Cache / throttle backend
|
|
redis~=5.1.1
|
|
django-redis~=5.4.0
|
|
|
|
# Search engine client
|
|
elasticsearch~=8.15.1
|
|
|
|
# Observability: ship structured logs to Logstash without blocking requests
|
|
python-logstash-async~=4.0
|
|
|
|
# Serving
|
|
gunicorn~=23.0.0
|
|
whitenoise~=6.7.0
|