CI failed at 'pip install -r requirements.txt' with Pillow 10.4.0 sdist
building from source under Python 3.14 and exiting with KeyError: '__version__'
(no 3.14 wheel exists for the 10.x line). The same risk applied to
asyncpg 0.29 (also no 3.14 wheel) and to psycopg 3.1.x (dep resolver was
backtracking through every minor trying to find a 3.14-compatible combo).
Bumps:
- pillow: 10.2-10.x -> 11.1-11.x (11.x has 3.13+ wheels)
- asyncpg: 0.29 -> 0.30 (0.30 added 3.13/3.14 wheels)
- psycopg: 3.1.x -> 3.2.x (current line, stable resolver)
- cryptography: 42 -> 44-45 (current abi3 wheels; the 42 line
worked via abi3 but bumping aligns
with the newer cffi-on-3.14 path)
This is the operator-flagged risk from FC-1 ("scientific stack may still be
catching up on 3.14 wheels — worth confirming before locking in"), realized.
The fix is to pin newer minimums, not to back off to 3.13.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pins runtime and ML deps separately so the regular web image stays lean.
Configures ruff for py312 with bugbear, async, and pyupgrade lints enabled.
psycopg sync driver included up-front for alembic.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
bvandeusen