From e8f32da42d9a8a5c853feb7d8b86a4d1baddc34f Mon Sep 17 00:00:00 2001
From: Eric <ciregenz@berkeley.edu>
Date: Thu, 28 May 2026 00:55:55 -0700
Subject: [PATCH] [eric] backend: pin the six previously-unpinned requirements
 (jsonschema, fastapi, pillow, httpx, trafilatura, tzlocal) to the exact
 versions baked into the last working packaged build so deps-pinned passes and
 reproducibility actually matches the header comment

---
 backend/requirements.txt | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/backend/requirements.txt b/backend/requirements.txt
index 2f166bf0..61b0595c 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -8,18 +8,18 @@
 #   pydantic 2.13.3    — required floor for mcp >=1.27
 anthropic==0.97.0
 claude-agent-sdk==0.1.70
-jsonschema
-fastapi[standard-no-fastapi-cloud-cli]
+jsonschema==4.26.0
+fastapi[standard-no-fastapi-cloud-cli]==0.136.3
 pydantic==2.13.3
 typeguard==4.4.2
 python-dotenv==1.1.1
-Pillow
-httpx>=0.27.0
-trafilatura
+Pillow==12.2.0
+httpx==0.28.1
+trafilatura==2.0.0
 # tzlocal: dev-mode fallback for resolving the user's IANA timezone when
 # Electron's OPENSWARM_TIMEZONE env var isn't set (i.e. `bash run.sh`).
 # Packaged builds get the env var directly so this is a safety net.
-tzlocal
+tzlocal==5.3.1
 # Test deps (pytest, pytest-asyncio) live in requirements-dev.txt — they
 # never ship to production users and shaved ~3 MB / ~200 files off the
 # Mac DMG when removed from the prod env.
\ No newline at end of file