jpmschweitzerandClaude
769c12b33b
Set up Python 3.12.11 FastAPI project with security-focused dependency management. Dependencies: - FastAPI 0.123.9: Modern web framework - Uvicorn 0.38.0: ASGI server with standard extras - Pydantic 2.12.5: Data validation (updated for pydantic-ai) - PydanticAI 1.27.0: LLM agent framework with Ollama support - HTTPX 0.28.1: Async HTTP client - SSE-Starlette 3.0.2: Server-Sent Events for streaming - python-dotenv 1.2.1: Environment configuration Security: - All packages checked for CVEs (as of 2025-12-06) - Minor version locking (>=X.Y,<X.(Y+1)) for supply chain protection - CVE status documented in requirements.txt Development tools: - pytest 8.3.5 + pytest-asyncio for async testing - pytest-cov 6.0.0 for coverage reporting - ruff 0.8.6 for linting and formatting - mypy 1.14.1 for type checking Configuration: - pyproject.toml: Build system, coverage, ruff, and mypy config - .env.example: Environment variable template - .gitignore: Comprehensive Python/FastAPI patterns Target model: mistral-nemo:latest on external Ollama instance 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
43 lines
1.4 KiB
Plaintext
43 lines
1.4 KiB
Plaintext
# Core FastAPI framework and server
|
|
# FastAPI: Modern, fast web framework for building APIs
|
|
# Latest: 0.123.9 (Dec 4, 2025) - No known CVEs
|
|
fastapi>=0.123,<0.124
|
|
|
|
# ASGI server for running FastAPI
|
|
# Latest: 0.38.0 (Oct 18, 2025) - No known CVEs
|
|
# Note: Old versions had CVE-2020-7694/7695, but 0.38.0 is secure
|
|
uvicorn[standard]>=0.38,<0.39
|
|
|
|
# Additional dependencies
|
|
# Pydantic for data validation (comes with pydantic-ai but pinning explicitly)
|
|
# Updated to >=2.11 due to ag-ui-protocol dependency requirement
|
|
# Latest: 2.12.4 (Nov 5, 2025) - No known CVEs
|
|
pydantic>=2.11,<2.13
|
|
|
|
# AI/LLM integration
|
|
# PydanticAI: Agent framework for using Pydantic with LLMs
|
|
# Latest: 1.27.0 (Dec 5, 2025) - No known CVEs
|
|
# Supports Ollama backend out of the box
|
|
pydantic-ai>=1.27,<1.28
|
|
|
|
# HTTP client for Ollama communication
|
|
# Latest: 0.28.1 - No known CVEs
|
|
httpx>=0.28,<0.29
|
|
|
|
# Server-Sent Events for streaming responses
|
|
# Required for OpenAI-compatible streaming endpoints
|
|
# Latest: 3.0.2 (Oct 30, 2025) - No known CVEs
|
|
sse-starlette>=3.0,<3.1
|
|
|
|
# Configuration management
|
|
# Latest: 1.2.1 (Oct 26, 2025) - No known CVEs
|
|
python-dotenv>=1.2,<1.3
|
|
|
|
# ASGI toolkit (dependency of FastAPI, pinning for security)
|
|
starlette>=0.45,<0.46
|
|
|
|
# Note on version locking strategy:
|
|
# Using >=X.Y,<X.(Y+1) format to lock to minor versions
|
|
# This protects against supply chain attacks while allowing patch updates
|
|
# Update regularly and review changelogs before upgrading minor versions
|