# Pinned to exact versions, not ranges: this bot can sign transactions with a
# live private key, so its dependencies are part of the trust boundary. An
# unbounded range means an install today and one in six months can resolve to
# different code - including a compromised release pushed under an existing
# package name. Bump these deliberately, one at a time, after testing.
#
# Always install into a virtual environment, so a newer solana/solders
# installed elsewhere on the machine can't shadow these.

aiohttp==3.9.5
python-telegram-bot==20.0
solana==0.34.3
solders==0.21.0
base58==2.1.1
python-dotenv==1.0.1
# Held at 11.x because solana 0.34.3 requires websockets<12.0.
websockets==11.0.3
# Faster event loop - Linux/macOS only, no Windows wheels exist.
uvloop==0.19.0 ; platform_system != "Windows"
