# Pinned to the 1.2.x line: ADR-0009 dataset attribution reads cognee PRIVATE
# internals (cognee.modules.data.models, get_default_user) that a 1.3.x could
# move, which would silently fail-closed and blank every scoped caller's vault.
# assert_cognee_dataset_api() (boot self-check + test) catches a bump; this pin
# stops Railway pulling one unattended on the next build.
cognee[fastembed,postgres-binary]>=1.2.2,<1.3.0
fastapi>=0.116.2,<1.0.0
google-auth>=2.40.0,<3.0.0
aiohttp>=3.14.1,<4.0.0
cryptography>=48.0.1,<49.0.0
mcp>=1.28.1,<2.0.0
pydantic>=2.10.5,<3.0.0
python-dotenv>=1.0.1,<2.0.0
requests>=2.32.0,<3.0.0
starlette>=1.3.1,<2.0.0
uvicorn[standard]>=0.34.0,<1.0.0
