requirements.txt

# Full pinned dependency list for SecOpsTM — core + AI/ML extras.
#
# WHY THIS FILE EXISTS SEPARATELY FROM pyproject.toml
# ----------------------------------------------------
# pyproject.toml [project.dependencies] lists only the *minimal runtime* deps
# needed to run the core threat modeling pipeline (no AI, no LangChain, no
# vector store).  This lets users install a lightweight version with:
#     pip install -e .
#
# This file adds the AI/ML layer on top.  Use it when you need AI enrichment:
#     pip install -r requirements.txt
#
# Alternatively, install only the curated AI extras group from pyproject.toml:
#     pip install -e ".[ai]"
# (lighter than requirements.txt — omits langchain, jq, unstructured)
#
# INTENTIONAL DIFFERENCES vs pyproject.toml
# ------------------------------------------
# - Includes langchain, langchain-community, langchain-chroma, langchain-litellm,
#   langchain-huggingface (not in pyproject.toml [ai] extras — too heavy for most)
# - Includes jq and unstructured[all] (tooling / data pipeline only)
# - Versions are pinned with >= lower-bounds (not exact) to stay compatible with
#   fresh environments while avoiding known-bad releases.
pytm==1.3.1  # pinned exact: newer releases turned pytm.Threat into a strict-typed
             # pydantic model (likelihood/impact must be str), breaking ExtendedThreat
             # construction in ai_service.py and causing a pydantic __eq__ RecursionError
             # in pytm's _match_responses(). Revisit when upgrading — see decisions.md.
Flask[async]>=3.1.1
openpyxl>=3.1.0
Jinja2>=3.1.6
pandas>=2.3.0
PyYAML>=6.0.1
graphviz>=0.21
aiohttp>=3.13.4
langchain>=0.1.16
langchain-community>=0.0.33
langchain-text-splitters>=0.0.1
litellm>=1.32.2
chromadb>=0.4.24
sentence-transformers>=2.7.0
lxml>=6.1.0
jq>=1.7.0
unstructured[all]>=0.14.0
langchain-huggingface>=0.0.3
msoffcrypto-tool>=5.0.0
langchain-chroma>=0.1.2
langchain-litellm>=0.1.0