grabowski
b03318210c
security.yml previously ran safety/bandit/semgrep with `|| true` and could not go red. Now: pip-audit on requirements.txt is a hard gate (dev deps reported only), bandit HIGH fails (B104 bind-all skipped: intended behind Cloudflare/Caddy), pip-licenses uploaded as a report. Weekly + on dependency/source changes. Running it locally found 29 advisories, all in pinned-and-forgotten runtime deps: starlette 0.27 (7, incl. Host-header path confusion and form DoS), fastapi 0.104, requests 2.31 (3), pymysql 1.1. Bumped to current: fastapi 0.141.1 / starlette 1.6.0, pydantic 2.13.5, uvicorn 0.52.4, requests 2.34.2, pymysql 1.2.0; dev: pytest 9.1.1, black 26.5.1. pip-audit is now clean. requires-python narrowed to 3.11 (the truth: psycopg2-binary 2.9.9 fails on 3.13; pandas 2.0.3 has no 3.12 wheels). Full suite passes; API smoke-tested (health, stations, forecast, history, stats, docs, openapi) on the new stack. black 26 reformatted 8 files.
35 lines
586 B
Plaintext
35 lines
586 B
Plaintext
# Core dependencies
|
|
requests==2.34.2
|
|
schedule==1.2.0
|
|
pandas==2.0.3
|
|
numpy>=1.24,<2 # pandas 2.0.3 wheels are ABI-incompatible with numpy 2.x
|
|
|
|
# Flood forecasting (ML)
|
|
scikit-learn==1.9.0
|
|
|
|
# Web API framework
|
|
fastapi==0.141.1
|
|
uvicorn[standard]==0.52.4
|
|
pydantic==2.13.5
|
|
|
|
# Database adapters
|
|
sqlalchemy==2.0.23
|
|
influxdb==5.3.1
|
|
pymysql==1.2.0
|
|
psycopg2-binary==2.9.9
|
|
|
|
# Monitoring and metrics
|
|
psutil==5.9.6
|
|
|
|
# Development dependencies (optional)
|
|
pytest==9.1.1
|
|
pytest-cov==4.1.0
|
|
black==26.5.1
|
|
flake8==6.1.0
|
|
mypy==1.7.1
|
|
pre-commit==3.5.0
|
|
|
|
# Documentation
|
|
sphinx==7.2.6
|
|
sphinx-rtd-theme==1.3.0
|