# Floors are raised deliberately, not decoratively.
#
# The sidecar runs on a partner's game server, so a vulnerable dependency here
# is one we put on someone else's machine. osv-scanner resolves ">=" to the
# lowest permitted version, and at the previous floor (aiohttp>=3.9) that
# resolved to 3.9.5 carrying 68 known vulnerabilities.
#
# anyio and idna are transitive, via httpx. They are pinned explicitly because
# nothing in the direct requirements forces a version that clears their
# advisories, and the sidecar is not somewhere to hope for a good resolve.

aiohttp>=3.14.3
httpx>=0.27

# transitive, pinned for advisories
anyio>=4.14.2
idna>=3.15
