requirements.txt

Rama main · réplica de lectura del repositorio original.

# CV/ML stack is pinned-exact for reproducible Docker builds. torch 2.11 /
# mediapipe 0.10.14 are aging; UPGRADE PROCEDURE (do in Docker, one bump at a
# time, then run `pytest -m integration`): bump torch>=2.4 + matching
# torchvision, rebuild the CUDA image, verify YOLO + MediaPipe load and a clip
# reframes correctly before committing the new pin.
# 0.7.2 permits patched Click >=8.3.3; the old 0.6.7.1 required <8.3.
# Scene/timecode API changed in 0.7: Docker integration must validate behavior.
scenedetect==0.7.2
ultralytics==8.4.33
torch==2.11.0
torchvision==0.26.0
tqdm==4.67.3
# Floor raised to 2026.6.9: that release fixes CVE-2026-50023 (dangerous
# file-type creation via insufficient filename sanitization, bypass of
# CVE-2024-38519) and CVE-2026-50574 (aria2c manifest arbitrary file write).
# Earlier 2026.3.x releases are vulnerable, so the floor must not permit them.
yt-dlp>=2026.6.9,<2027
faster-whisper==1.2.1
# Capped below 2.0 so an unattended rebuild can't pull a breaking major
# release of the SDK (gemini_service / gemini_parser depend on the 1.x API).
google-genai>=1.70.0,<2.0.0
python-dotenv==1.2.2
mediapipe==0.10.14
fastapi==0.135.3
# Explicit Starlette floor: 1.0.1 fixes CVE-2026-48710 ("BadHost" — a malformed
# Host header reparse let request.url.path diverge from the routed path, an
# auth/security-control bypass). fastapi 0.135.3 already resolves to a safe
# Starlette (1.3.x), but pinning the floor guarantees a rebuild can never
# regress to a vulnerable 0.x/1.0.0.
starlette>=1.0.1
uvicorn==0.42.0
# Click 8.3.3 fixes command injection in click.edit() (PYSEC-2026-2132).
# Ensure the resolved transitively imported CLI package is patched.
click>=8.3.3,<9
# 0.0.31 fixes CVE-2026-40347/42561/53538/53539/53540 (multipart parser DoS).
python-multipart==0.0.31
# Fonts/emoji rendering in subtitles.py + hook_overlay.py assume the Pillow 12.x
# FreeType/OTF API. Allow patch/minor security updates, block the next major.
# 12.3.0 floor: PYSEC-2026-2254 (FontFile.compile decompression bomb).
Pillow>=12.3.0,<13
# Used by social_publisher.py for the Zernio REST client (presign upload,
# scheduled-post lookup, post creation). Standard library `urllib` would
# work but `requests` gives us session reuse + better error messages.
requests>=2.32,<3
opencv-python==4.13.0.92
psutil==7.0.0
# Fallback repair library for Gemini viral-detection JSON parsing
# (level 3 of the gemini_parser.py chain). Pure Python, no native deps.
# If throughput becomes a bottleneck, `fast-json-repair` (Rust-based,
# Python 3.11+, released Oct 2025) is a drop-in faster alternative —
# swap only if profiling shows the parse step is >5% of request time.
json-repair>=0.30
# Kick live-monitor (kick_client.py): Cloudflare-gated Kick API needs browser
# TLS/JA3 impersonation; plain requests gets 403. Imported lazily so host tests
# and upload-only setups don't require the wheel. Reuses cffi/certifi (already
# pinned above). Also enables yt-dlp's curl_cffi impersonation (auto-detected
# when installed — defense-in-depth against YouTube bot detection).
curl-cffi>=0.15,<1.0
# IANA time zones for zoneinfo (Zernio scheduling, API timezone validation).
# Linux and macOS read the system database; Windows has none, so zoneinfo
# needs this package there. The Linux lock and the Docker image skip it. The
# floor is the first release with 2026 rules, the ones future posts fall under;
# no cap because new rule changes only reach Windows through new releases.
tzdata>=2026.1; sys_platform == "win32"
# Optional: speaker diarization via pyannote.audio. main.py:_diarize_with_pyannote
# imports it lazily and skips with a soft warning if absent, so it is intentionally
# NOT installed by default (it pulls torchaudio + a gated HF model download).
# Enable by installing manually: `pip install pyannote.audio` + set HF_TOKEN.
# Deepgram's built-in diarization (DEEPGRAM_DIARIZE=true) covers the cloud path.
#
# Note: auto-editor is NOT a pip dep. It's installed as a Nim binary
# (v30.x track) by the Dockerfile from GitHub releases, and kept up-to-date
# at runtime by auto_editor_updater.py. The legacy v29.x PyPI release is
# frozen and not used here.